Privacy policy

This policy explains how personal data is processed in the Inovinn service and on the inovinn.com website, both provided by İnovecho Yazılım Sanayi ve Ticaret Limited Şirketi ("Inovecho", "we"). This is a translation; the Turkish version prevails.

1. Who we are

• Legal name: İnovecho Yazılım Sanayi ve Ticaret Limited Şirketi
• Address: Değirmenler Mah. Cevat Sayılı Blv. Teknokent No: 120/24 İç Kapı No: 114 Merkez/Burdur, Türkiye
• Tax office and number: Burdur · 4781216636
• MERSIS number: 0478121663600001
• Email: support@inovinn.com

Inovinn is a software service that lets hotels manage their conversations with guests on WhatsApp, Instagram, Messenger, email and similar channels in a single panel.

2. Our roles

If you have messaged a hotel, that hotel decides why your data is processed. We process this data only on the hotel's instructions and to provide the service. You can exercise your rights against the hotel; if you contact us, we forward your request to the hotel and help it respond.

3. Data we process

Website visitors

• Technical logs: IP address, browser and device information, time of visit, kept by the provider that hosts and protects the website.
• Cookie choice: The choice you make in the cookie banner.
• Marketing measurement: Only if you allow it, Meta Pixel tells Meta that you visited our website. See our cookie policy.
• Correspondence: Your name, email address and message when you email us.

Customers and panel users

• Name, email address, phone number, hotel and role.
• Account security data: a one-way hash of the password, two-step verification settings, session and sign-in logs.
• Audit logs of actions in the panel (e.g. who viewed which conversation).
• Contract and billing details.

Data from Meta platforms

When a hotel connects its WhatsApp Business account, Instagram account or Facebook Page to Inovinn, we process the following through Meta's official APIs:

• Business assets: WhatsApp Business account and phone number IDs, Instagram account and Facebook Page IDs, business name, message templates and their review status.
• Access tokens: Access keys issued by Meta. They are stored encrypted and used only to receive and send messages on behalf of the hotel's account.
• Messaging data: Messages between the hotel and its guests, attachments such as photos, documents and audio, delivery and read statuses, reactions.
• Guest identifiers: Phone number, WhatsApp user ID, app-scoped Instagram and Messenger user IDs, the guest's profile name.

We use this data only to provide the service to the hotel concerned. We do not sell it, use it for ad targeting, combine it with another customer's data, or use it for any purpose not permitted by Meta's platform terms.

4. Purposes and legal bases

For guest data, the hotel as controller determines the legal basis.

5. Who we share data with

We share data only as far as needed for the service, with:

• Meta Platforms (WhatsApp, Instagram, Messenger): messages pass through Meta because they are sent over the channel the hotel chose.
• Infrastructure providers: The service's database, files and backups are kept on servers in Türkiye. The inovinn.com website is delivered through a content delivery network (Cloudflare).
• Email and SMS delivery providers: For notifications and messages the hotel sends.
• AI providers: Only if the hotel turns on AI features, and only to the provider the hotel chose, with the content that feature needs.
• Competent authorities: Where required by law.

The current list of sub-processors is attached to the data processing agreement with our customers.

6. International transfers

Because Meta, our website infrastructure (Cloudflare) and, where used, some AI providers are located outside Türkiye, data sent to them is transferred abroad. We rely on appropriate safeguards under Article 9 of the Turkish Personal Data Protection Law (KVKK), in particular the standard contracts published by the Personal Data Protection Board. Meta Pixel relies on your explicit consent.

7. Retention

• Panel accounts and contract data: For the term of the contract and afterwards for the period required by law (e.g. 10 years for commercial records).
• Guest messages and attachments: For the retention period the hotel sets in the panel; content is then deleted or anonymised.
• Meta access tokens: Deleted when the channel is disconnected.
• Audit logs: 2 years.
• Backups: Deleted data drops out of backups within 35 days.
• End of contract: The customer's data is deleted, subject to the customer's right to export it.

8. Security

Data is encrypted in transit with TLS. Access tokens and other secrets are stored encrypted. Access in the panel is limited by role and property, two-step verification is available, and views of personal data are logged. Guest message content is never written to system logs.

9. Your rights

Under Article 11 of KVKK you may ask whether your data is processed, request information about it, learn the purpose and whether it is used accordingly, know the third parties it is transferred to, ask for correction, deletion or destruction, ask that these actions are notified to recipients, object to a result against you arising solely from automated analysis, and claim compensation for damage.

Send your request to support@inovinn.com or in writing to Değirmenler Mah. Cevat Sayılı Blv. Teknokent No: 120/24 İç Kapı No: 114 Merkez/Burdur, Türkiye. We respond within 30 days. Our notice under Article 10 of KVKK is available in Turkish.

10. Data deletion

How to request deletion of your data, including data connected through your Meta accounts, is explained step by step in our data deletion instructions.

11. Children

Inovinn is a service for businesses and is not directed at anyone under 18.

12. Changes

We may update this policy. The current version is on this page and the date at the top shows the last change. We notify our customers of material changes separately.