Privacy Policy

VoltraChat is a service brand operated by Odrin Yazılım, registered in Türkiye.

• Operator: Odrin Yazılım
• Tax ID: 6470447526 — Kordon Tax Office, İzmir
• Address: Halkapınar Mah. Mürselpaşa Blv. No: 174 İç Kapı No: 204, Konak / İzmir, Türkiye
• Email: destek@voltrachat.com

The operator is the data controller for your account data (email, sign-in, subscription).

We process only the data strictly needed to run the service:

• Your account data: the email address you sign in with and, if you use Google sign-in, your Google account name. We never use or store passwords; sign-in works via Google OAuth or a one-time code sent to your email.
• Instagram account info: the username and account ID of the professional account you connect.
• Access token: the access token obtained through Meta's official OAuth screen. Tokens are stored only encrypted with AES-256-GCM. We never see your Instagram password.
• Interaction events: comment and message events delivered by Meta's webhooks to trigger your automations (including the username/ID of the person who wrote the comment or message and the comment/message text).
• Conversations and contact info: the username, display name, and profile picture address of the people who message your account; the message history between you and that person (incoming messages plus the replies sent by your automations and the ones you write manually from the panel). The profile picture is not copied to our servers; we store the temporary address provided by Meta and refresh it every 24 hours.
• Delivery records: a record of every DM sent — when and under which rule (the transparency log in your panel).
• Published content: the photo/video files you submit on the Publish page (or via the API or your AI connection); caption and hashtags, alt text, cover choice, the "AI-generated" and "also show in feed" settings; the scheduled time, the text of the first comment to be posted after publishing and the linked automation; publish status, the media IDs and permalink returned by Instagram, error details if any; who created and who confirmed the draft or schedule (panel user, API key or AI connection) and when. If you provide a URL instead of a file, that URL is stored.
• AI DM reply drafts: where this feature is enabled, the text of a reply draft that your connected AI assistant leaves in a conversation, which connection wrote it, and when.
• Insights: the performance figures Instagram provides for your account and posts (followers, views, reach, engagement, likes/comments/shares/saves, profile visits and link taps, follows/unfollows, daily series, per-post, Reel and Story metrics) and the age, gender, country, city and online-hours distribution of your followers. These are aggregate figures; they do not identify individual people.
• Billing data: name and invoice details when you purchase a paid plan. Your card details never reach us; payments are processed by iyzico, a licensed payment institution.
• Technical logs: server access logs (IP address, time, request) for security and debugging.
• Consent record: when you accepted the Terms of Service, the terms version you accepted, the boxes you ticked and the screen language. Kept for the formation and proof of the contract (KVKK Art. 5/2-c) for the life of your account and afterwards for the statutory limitation period.

We process data received from the Meta Platform (account identity, comment/message events, publishing records, insights, tokens) only to:

• run the automation rules you configure (public reply and DM in response to a comment or story reply),
• show incoming messages in your panel's inbox and let you reply manually from the panel,
• report deliveries transparently in your panel,
• publish to your Instagram account the post you prepared and explicitly confirmed (immediately or for the time you scheduled), or the post your AI connection requested under the condition described in "Content publishing and insights" below, show its status and your scheduled and recent posts in the panel, and limit publishing frequency to protect your account,
• show insights for your account and posts only inside your own workspace,
• deliver to the AI connection you authorized the data it requests, only for your own workspace, and show you the DM reply drafts it leaves,
• show the connection health of your account,
• calculate your quota and plan limits.

We do not use this data for advertising, do not sell, rent, or share it with third parties or ad networks, do not build profiles, do not combine insights across businesses, and do not use it to train AI models. Processing complies with the Meta Platform Terms and the purposes stated in this policy.

• Publishing starts as a draft or as a post scheduled for a later time; neither is visible on Instagram. A post is published only in one of two cases: when you confirm it in the panel, immediately or for the time you scheduled; or, if you have turned on "AI can publish without approval" in the panel (off by default), when your own AI connection, authorized by you with an API key or through the sign-in screen, requests it. A publish is never repeated automatically.
• The file you upload is kept on our server at an unguessable, signed, time-limited URL so that Instagram can fetch it. For a post published immediately, the file is deleted automatically about 24 hours after upload. For a draft awaiting confirmation or a scheduled post, the file is kept until the post is published, fails or is canceled, but in any case for at most 32 days after upload (scheduling up to 30 days ahead plus a delay allowance). After that, the file is deleted automatically within half an hour if 24 hours have passed since upload, or once 24 hours have passed otherwise.
• This data is collected electronically when you submit it in the panel, via the API or through your AI connection, and through Meta's official API.
• A post published to Instagram stays on your Instagram account. VoltraChat cannot edit or delete a published post; you do that in the Instagram app. Deleting your data in VoltraChat does not delete the post on Instagram.
• You are responsible for the personal data of people who appear in the content and captions you publish; VoltraChat processes that content only on your instructions, to deliver it to Instagram.

• You can connect your own AI assistant to VoltraChat from the panel (with an API key or through a sign-in and consent screen). The connection can access only your own workspace's data, within the permissions you grant, and you can remove it from the panel at any time.
• When your connection requests it, your automations, posts, comments, insights and (where this feature is enabled) your conversations and messages are delivered to it. This data is transferred to the AI provider you chose, on your instructions: you initiate the transfer, VoltraChat only responds to your connection's requests and does not share data with that provider on its own. How the provider processes the data is governed by its own terms. For this transfer, you are the data controller of the data of the people you message, and VoltraChat acts as a data processor on your behalf. Your obligations towards these people, including privacy notices and the conditions for transfers abroad (KVKK Art. 9; e.g. standard contractual clauses with the provider), remain yours.
• The AI connection does not send DMs. It can only leave a reply draft in a conversation; you see the draft in the panel, can edit it and, if you wish, send it yourself. A draft is deleted when it is sent or when you delete it, and together with its conversation.
• Inbox history: where this feature is enabled, when you or your AI connection ask for it, a conversation's older Instagram messages (the latest 20 messages Meta provides) are read from Meta's official API; these messages are not stored on our servers. If you asked, they are only displayed to you; if your AI connection asked, they are delivered to it.
• Actions taken through the AI connection (when and through which connection; IP address and client information) are written to activity records for security and auditing.

We rely on: performance of a contract (account, automation, delivery, content publishing, insights, AI connection, and billing data, as regards data about your own account; we process the data of people who message or interact with your account on your behalf as a data processor, see "Data of people who interact with your account" below); compliance with legal obligations (invoices and financial records); and legitimate interest (security logs, publishing and AI connection activity records, abuse prevention). We do not rely on consent for any current processing; if we ever want to send you marketing messages, we will ask for separate, explicit opt-in.

When your automations run, the usernames and comment/message contents of people who comment on your posts or reply to your stories pass through our systems. As the operator of your social media account, you are primarily responsible towards these individuals; VoltraChat processes their data only on your instructions (the rules you configure) and strictly for the purposes in this policy. If such a person sends us a deletion request, we delete the related records.

We share data only with providers that are strictly necessary to run the service:

• Hetzner Online GmbH (Germany): hosting — your data and the files you upload for publishing are stored on servers in Germany.
• Meta Platforms (US/Ireland): the Instagram API — data flows to and from Meta by the nature of automation and publishing; Instagram fetches the file you want to publish from our time-limited URL.
• Google (US): authentication, only if you choose Google sign-in.
• iyzico (Türkiye): payment processing.
• Email delivery provider: transactional emails (sign-in codes, order confirmations, service notices such as quota warnings).
• The AI provider you connect: only if you set up a connection, only the data your connection requests, and on your instructions (see "AI connection" above).

Your personal data is transferred abroad within the meaning of KVKK Art. 9: to Germany for hosting (Hetzner), to Meta (US/Ireland) for Instagram automation and publishing, to Google (US) for authentication only if you choose Google sign-in, and to our email delivery provider (Resend, US) to send sign-in codes and service emails. If you set up your own AI connection, the data it requests is transferred on your instructions to the provider you chose, which may be located abroad. Each transfer is limited to these purposes and to the data each purpose requires; you can request information about the legal basis for the transfer at destek@voltrachat.com. We share your data with no other third party, except where disclosure is required by law to competent authorities.

• Files uploaded for publishing: for a post published immediately, deleted automatically about 24 hours after upload; for a draft awaiting confirmation or a scheduled post, kept until the post is published, fails or is canceled, for at most 32 days, and deleted automatically afterwards; incomplete uploads within 1 hour.
• AI DM reply drafts: kept until sent or deleted; deleted together with their conversation.
• Older messages read from Instagram (inbox history): not stored on our servers; displayed to you or delivered to your AI connection if it requested them.
• Publishing records (caption, media IDs, permalink, status): kept while your Instagram account remains registered in VoltraChat; deleted on account deletion or a Meta Data Deletion request.
• Insights: refreshed at most every 15 minutes and overwritten on each refresh; the latest snapshot is kept and deleted on the same terms as publishing records.
• Publishing and AI connection activity records (who acted, when, and through which channel; for API and AI connection actions, IP address and client information): kept until your panel account is deleted.
• Interaction events and delivery records: up to 12 months while your account is active; expired records are purged periodically.
• Inbox messages (conversation history): messages older than 12 months are deleted; a conversation inactive for 12 months with no remaining messages is deleted entirely.
• List of people who asked not to receive messages (e.g. by writing "STOP"): kept while your Instagram account remains registered in VoltraChat so that no automated message is sent to them again; only the person's Instagram ID, the reason and the date are stored.
• Account protection records (Meta error and restriction signals): kept while your Instagram account remains registered, to protect your account; in records older than 12 months the related person's ID is removed.
• Account deletion requests: all account data, tokens, and interaction records are deleted within 30 days.
• When you disconnect your Instagram account: the access token is revoked and no new data is processed; existing records follow the 12-month schedule unless you delete your account (except the "STOP" list and account protection records, which are kept as stated above).
• Invoices and financial records: kept for the mandatory retention periods under tax and commercial law; these are exempt from deletion requests.
• Pre-payment contract consent records (time of consent, version of the accepted texts, consent statements, digest of the related payment form): kept for 3 years from the last transaction of the related subscription (last payment or termination) as required by Art. 20 of the Turkish Distance Contracts Regulation and not deleted when you delete your account; in that case the IP address and the information linking the record to your account are removed.
• Server access logs: up to 12 months.

Access tokens are encrypted with AES-256-GCM; there is no password-based login (one-time codes / Google OAuth); every customer's data is isolated per workspace (row-level access control); unsigned webhook requests are rejected. In case of a breach we notify the competent authority and affected users as required by law.

Depending on your jurisdiction (including KVKK Art. 11 and, where applicable, the GDPR), you have the right to access, correct, and delete your data, to learn who it has been shared with, to object to processing, and to lodge a complaint with a supervisory authority. Send requests to destek@voltrachat.com; we respond within 30 days.

Two ways — details on the Data Deletion page:

• From Panel → Settings you can request deletion of your account (two-step confirmation).
• When you remove VoltraChat's access in your Instagram/Meta settings and ask for your data to be deleted, Meta sends us a Data Deletion request; we process it and return a confirmation code you can use to track it. Removing access alone (without asking for deletion) does not create a deletion request; the access token is revoked and historical records are not deleted.

Posts already published on Instagram are outside the scope of these deletions; you delete them on Instagram.

The panel uses only strictly necessary (technical) cookies to keep your session alive. We use no analytics, advertising, or third-party tracking cookies.

We may update this policy. We announce material changes in the panel or by email; the current version always lives on this page.

For privacy questions and data requests: destek@voltrachat.com