1. Data controller
CS Digital Wonders LLC ("SemAgent", "we") — operator of semagent.ai. Contact: [email protected]
2. Data we collect
- Account: name, email, hashed password, company name; billing handled by Stripe (we never store card data).
- Usage: IP address, browser/device info, features used, API metrics (tokens/requests).
- Conversations: widget chat messages and session metadata; e-commerce queries (product/order lookups).
- Integrations: access tokens for services you connect (e.g. Shopify, Google), stored encrypted (AES-256/Fernet); data reached through integrations is used only to provide the service.
- Email channel: emails sent to your support address and your team's replies are stored as conversations; the details of the Gmail / Microsoft 365 account or SMTP server you connect for sending replies are kept encrypted. Details: section 14.
- Memory (opt-in): if you enable memory, the profile, history summaries and rules the agent learns — all visible and deletable in your panel.
- Community messages (Telegram): messages in the groups our community bot is added to; the author's name and username are not stored. Details and how to opt out: section 13.
- Visitor metadata (belonging to the tenant's customer): the visitor's IP address, country and city, time zone, a short browser/OS summary, browser language and the paths they visited on your site. None of it is fetched from an outside service: country and city come from headers Cloudflare adds to the request, time zone and language from what the visitor's own browser reports, and the browser summary from the
User-Agent header — the raw User-Agent is not stored. This data is shown only in the tenant's agent panel; it never reaches a message sent to the customer and never enters the AI's context. On messaging channels (WhatsApp, Instagram, Telegram) IP and location are not collected — the provider does not supply them. See section 16.
- Customer data entered by the tenant: tags, a note and free key/value fields typed into the person panel by an agent. The tenant decides the content and is responsible for what it contains (see section 11).
3. Purposes and legal bases
Contract performance (service delivery, account and billing), legitimate interest (security, abuse prevention, product analytics and the Telegram community bot — see section 13), consent (memory/personalization, marketing) and legal obligation — under Turkish KVKK and aligned with GDPR principles.
4. Your data never trains models
Your knowledge base, chats and agent tasks are never used to train any AI model. Conversation context is routed through our own AI gateway to enterprise, no-training endpoints (Anthropic, OpenAI, Google, Together AI).
5. Sharing
We do not sell personal data. We share only as needed to run the service: AI providers (response generation), Stripe (payments), hosting (Contabo, France), Cloudflare (CDN/TLS and file storage), Resend (transactional email), Soniox/ElevenLabs (Voice AI plans only), and authorities where legally required. Full list: Sub-processors.
6. Retention
Account data: for the life of your account, purged within 30 days of deletion. Conversations: per your tenant settings, deletable anytime. Memory: until you delete it or withdraw consent. Usage logs: up to 12 months. Support and contact attachments: files you attach to a support request are deleted 12 months after the request is closed; files in a contact-form thread after 6 months — the file is deleted and the record of it (name, size, date) stays so the thread remains readable. Chat files: files a visitor or an agent shares in a widget chat are deleted after 12 months; the record of the file (name, size, date) stays in the conversation. Telegram community messages: raw messages are deleted automatically after 14 days. Email connections: the Gmail / Microsoft 365 token and SMTP details are kept until you disconnect, then deleted. Billing records: as required by tax law.
7. Security
Tenant-isolated architecture, AES-256/Fernet secret encryption, HTTPS/TLS, password hashing, 2FA and role-based access, restricted production access, HA infrastructure with backups and monitoring. Details: Trust Center.
8. Your rights
You may request access, correction, deletion, information about transfers, object to automated analysis, and claim damages for unlawful processing (KVKK art. 11; GDPR-equivalent rights honored). Write to [email protected] — we respond within 30 days. Memory data can also be viewed and deleted directly in your panel.
9. International transfers
Data is primarily hosted in data centres in France (EU). Some AI providers and sub-processors are US-based; such transfers are covered by contractual safeguards.
10. Cookies & tracking
We use strictly necessary cookies to maintain your session and for security. For aggregate visit statistics we may use privacy-friendly, cookieless measurement such as Cloudflare Web Analytics. We do not use third-party advertising trackers and do not build advertising profiles. You can manage cookie preferences in your browser; blocking strictly necessary cookies may break some functionality.
11. Controller/processor roles (B2B)
We are the data controller for your account and billing data. For the end-user (customer) data you process through the widget or agent, you are the controller and we act only as a processor on your instructions. The parties' obligations under this split of roles are set out in section 7 of the Terms of Use; enterprise customers may additionally sign a Data Processing Agreement (DPA).
12. Children's privacy
The Service is not directed at anyone under 18 and we do not knowingly collect personal data from children. If we learn we have processed a child's data without a lawful basis, we delete it without undue delay.
The SemAgent Community bot (@SemAgentbot) reads the messages in the Telegram groups and channels it is added to; it does not take part in conversations. We are the data controller for this processing.
- When it starts: no message is stored when the bot is added to a group. Reading starts only after we approve the group and its members are informed: the bot posts one fixed notice in the group, or the group admin pins the same information.
- What we process: message text or captions, when a message was sent or edited, and its topic and reply link. We don't store the author's name, username or Telegram ID; to link messages from the same person we keep an irreversible keyed hash. Photos and files themselves are not stored. We keep the display name of the person who added the bot to a group, to show it on the approval screen.
- Purpose: compiling general tips about e-commerce and selling from these posts, with personal details removed, and adding them to the knowledge base of SemAgent's AI assistant. The compiled tips contain nothing linked to a person. No model is trained on this data.
- Legal basis: legitimate interest (KVKK art. 5/2-f; GDPR art. 6(1)(f)). Members are informed in advance and can opt out at any time.
- Retention: raw messages are deleted automatically after 14 days (the cleanup runs every hour). Daily message and author counts contain no personal data and are kept.
- Transfers: messages are processed on our servers in France (EU). When tips are compiled, text with contact details removed may be sent to our no-training AI providers (see sections 4 and 9).
- Opting out and deletion: send /optout to the bot in a private chat (Turkish: /cik). Your messages are no longer processed and your stored raw messages are deleted right away; the opt-out list keeps only the keyed hash. For your other rights: [email protected] (see section 8).
- Telegram's own processing: what you share on Telegram is governed by Telegram's own privacy policy; we only process the messages the bot receives.
14. Email channel and connected mailboxes
If you turn on the email channel, emails sent to your support address become conversations in Conversations and your team's replies reach your customers by email. For your customers' data in these threads you are the controller and we are the processor (see section 11). You choose how replies go out:
- Through SemAgent: replies go out through our email provider, Resend. To send from your own domain you verify it with DNS records; for a verified domain we create a sending key that can only send from that domain, stored encrypted (AES-256/Fernet).
- Gmail / Google Workspace: when you connect your Google account we ask only for permission to send email (
gmail.send) and for your email address (openid, email) to show which account is connected. We don't read your mailbox and we don't store your emails. The refresh token Google issues is stored encrypted; when you disconnect, it is deleted and we revoke the permission at Google.
- Google API data, Limited Use: SemAgent's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This information is used only to provide the feature you use; it is not used for advertising, not sold, not read by anyone except for security, legal obligations or with your explicit permission, and never used to train any AI model.
- Microsoft 365: when you connect your Microsoft account we ask for permission to send email (
Mail.Send), for your basic profile (User.Read, openid, email) to show which account is connected, and for offline_access to keep the connection. We don't read your mailbox. The refresh token is stored encrypted and deleted when you disconnect; you can also remove the permission from your Microsoft account's apps page.
- Your own SMTP server: the server name, port, username and password are stored encrypted; the password is never shown in the panel again. We connect to your server only to send replies and to test the connection.
- Sending log: for every reply sent through SemAgent we record the provider's message ID, the sending route and its status (sent, bounced, spam complaint); the recipient's address and the message content are not written to this log. If an account's bounce or complaint rate over the last 30 days exceeds the limit, its sending through SemAgent is paused to protect the shared email reputation (legitimate interest); sending from your own mailbox or SMTP server is not affected.
- Who processes it? The Google, Microsoft or SMTP provider you connect works as your own account, under its own terms. When sending through SemAgent, Resend is our sub-processor (see Sub-processors).
15. WhatsApp and Instagram channels (Meta)
If you connect your WhatsApp Business number or your Instagram professional account under Messaging, the messages your customers send you there become conversations in Conversations, and replies from our AI assistant (if you turn it on) or from your team go back to them through Meta. You connect in Meta's own sign-in window and choose there which accounts to share; the SemAgent app can reach only those. For your customers' data in these conversations you are the controller and we act as your processor (see section 11).
- What we receive from Meta: message text; the photos, videos, voice messages and documents customers send; delivery and read statuses; reactions; and the customer's WhatsApp number or Instagram-scoped ID. For Instagram we also read the customer's name and username from Meta's profile endpoint, because incoming messages don't carry them. If you also use the WhatsApp Business app on your phone with the same number, you can choose to share up to 180 days of earlier chats and your phone's contact names, and the replies you type in the app appear in the same conversation.
- What we don't do: we don't sell this data or use it for advertising or profiling, and it never trains AI models (section 4). We don't process group chats, calls or broadcast lists.
- Purpose: showing and answering your customers' messages, the AI assistant's first replies, handing conversations over to your team, notifications, and your conversation and cost reports.
- Access tokens: the access token Meta issues when you connect is stored encrypted; if encryption isn't available the connection isn't saved at all. The token is never shown in the panel or returned by our API.
- Files: every file is scanned for viruses; a file that isn't clean can't be opened or sent. Files are kept in private storage, never published on the internet, and deleted automatically 12 months after they arrive; the record of the file (name, size, date) stays in the conversation.
- Retention: conversations follow your tenant settings and can be deleted at any time. If a customer unsends an Instagram message, its text is removed from SemAgent too and only a “message unsent” note remains.
- Disconnecting: press Disconnect under Messaging. The access token is deleted right away; for WhatsApp, if no other number of that account is still connected, we also remove our webhook subscription. Existing conversations stay until you delete them.
- Transfers: messages are processed on our servers in France (EU) and files are stored with Cloudflare; the message text needed for an AI reply is sent to our no-training AI providers (sections 4 and 9).
- Meta's own processing: WhatsApp and Instagram handle messages under Meta's own terms and privacy policies (WhatsApp, Instagram); we only process what Meta delivers to the SemAgent app.
In the conversations screen a tenant's agent sees the following about a visitor in the person panel: IP address, country and city, time zone, a browser/OS summary, browser language, the last pages visited on the site and — if the tenant entered them — their own tags, note and free-form fields.
- How it is obtained: no external location or fingerprinting service is consulted. Country and city come from headers added by Cloudflare in front of the request; time zone and language from values the visitor's own browser reports; the browser summary from the
User-Agent header. The raw User-Agent is not stored, only a short summary (e.g. “Chrome 141 · Windows”).
- Where it appears: only in the tenant's agent panel. It never reaches a message or email sent to the customer, and never enters the AI's context.
- Unknown fields are not shown: if a value could not be obtained, that row is not drawn at all; nothing is guessed. When a country is derived from a WhatsApp number's dialling code, the panel marks it explicitly as “from phone”.
- Messaging channels: on WhatsApp, Instagram and Telegram, IP and location are not collected — the provider does not supply them.
- Legal basis: legitimate interest (GDPR Art. 6(1)(f) / KVKK Art. 5/2-f) — enabling the tenant to support its own customer and preventing abuse and spam.
- Retention: the metadata is stored with the messages of the conversation it belongs to and is deleted together with that conversation (see section 6). A person record can be deleted from the panel on a data-deletion request.
- Statistics (no personal data): we also keep a daily total: (day, channel, country, city, browser, language) → how many conversations. That record contains no IP, no person and no conversation id — only a count. Deleting a conversation therefore does not corrupt the statistics, and a person's deletion request finds nothing to delete there. Counting is per conversation, not per message.
- The person's last known metadata: for a customer with a person record (one who left an email) the last known country, city, time zone, browser and language are also kept on the person row, so they still show in the panel when a new conversation cannot measure them again. The raw IP is NOT kept on that row: the address lives only in the conversation's record and is deleted with it. Deleting the person record deletes these fields too.
- Order cache (not an archive): the panel's order box always asks the store live; the copy in our database is shown only when the store does not answer, and the screen states when that row was measured — it is never presented as current. What is stored is limited to what the panel displays (number, payment/fulfilment status, total, date, tracking number); there is no address, phone, name or item breakdown. An order the store no longer returns is deleted from the cache, and rows not refreshed for 180 days are purged automatically. For this data too the tenant is the controller (see section 11).
- Roles: for this data the tenant is the controller and SemAgent is the processor (see section 11). A visitor's request about this data is addressed to the tenant first.
If a tenant explicitly turns this on, someone who comments on their post may receive one private message. That is contact with a person who did not write to you, so the limits are tight:
- Off by default. Nothing is sent until the tenant enables it and defines at least one rule.
- One message per comment, and Instagram only allows it within 7 days of the comment.
- That first message is fixed text written by the tenant; its content is not generated by AI.
- The data processed is the comment text, the comment id and the author's Instagram user id, kept only to send the message once and to prevent a repeat.
- If the person does not answer, no conversation opens and nothing further is sent. If they do answer, it becomes an ordinary Instagram DM and section 15 applies.
- Legal basis: the tenant's legitimate interest in answering a question asked on their own post. In this flow the tenant is the controller and SemAgent is the processor (see section 11).
To tenants: using this for promotion may breach local unsolicited-messaging rules and Meta's platform policies. Keep the scope narrow and define excluded words such as complaint or refund.
18. Automated-message filter
To decide whether a message gets an automatic reply, we look at its text, its type and how many replies were sent in the past hour. The purpose is to avoid answering machine-generated messages such as verification codes or “do not reply” notices. This is not content classification or profiling: the outcome only answers “should a reply be produced”, the only thing stored is a short reason label, and the message always appears in the tenant's inbox.
19. Internal reminder emails
When an agent sets a reminder for themselves, the email goes only to that agent's own account address when it fires. The recipient is read from the user record; the customer's address in the conversation is never used in this flow.
20. How to delete your data
- If you use SemAgent: you can delete conversations and memory in your panel at any time. To remove SemAgent's access to WhatsApp or Instagram, press Disconnect under Messaging: the access token is deleted right away. You can also remove the SemAgent app in your Meta account's business integration settings. When your account is closed, your data is deleted within 30 days (section 6).
- If you wrote to a business that uses SemAgent (on WhatsApp, Instagram, by email or in a website chat): that business decides on your data, so please ask it first. You can also write to [email protected] with the business's name and the number, username or email address you used; we pass your request to the business, carry out the deletion it approves, and reply within 30 days.
- Data you gave us directly (your account, billing, a support request): write to [email protected] — your rights are in section 8. Telegram community members can opt out and delete their messages with /optout (section 13).
21. Order archive and customer events
If a tenant connects their store and uses this feature, their end customers' purchase history is stored permanently in SemAgent. This differs from the live order lookup during a chat: there the data is read only to produce that answer, here it is retained.
- What is stored: order reference, order date, status and shipping information; order amount and currency; the email address the order is keyed to (it is the record key); customer events the tenant defines (e.g. “refund requested”) and their numeric value, if any.
- Why: so the tenant can segment their own customers (e.g. “customers who ordered in the last 90 days”). The amount is kept as a number, because text makes a threshold query impossible.
- Who sees it: only the tenant concerned. It is not shared between tenants, not transferred to third parties for marketing, and not used for model training.
- Legal basis: processing on behalf of the tenant (the tenant is the controller, SemAgent the processor — section 11).
- Which addresses: the store is queried only for the addresses of customers whose identity is verified or who were linked by an agent of the tenant. An address a visitor only typed (claimed) never brings orders into the archive.
- When it is updated: when the tenant presses Sync orders; if the tenant turns on Sync automatically every night, also by itself every night (for the addresses of the 200 most recently seen customers). The switch is off by default.
- Retention and deletion: the tenant can choose a retention period in the panel (12, 24 or 60 months); orders and events past it are deleted every night and are not fetched from the store again. Without a chosen period the archive stays until the tenant deletes it or the tenant account is closed. Deleting one person's record in the panel also deletes that person's order archive and events; Delete order archive on the Customers screen removes the whole archive. When the account closes, the archive goes with it (section 6).
22. Campaign messages, consent and opt-out records
When a tenant sends a campaign or approved template message through the Service:
- What is stored: a send record showing who received the message and when; the message text (in the conversation, visible to the tenant's agents); the delivery status reported by the channel provider (delivered, read, failed and the reason).
- "Do not message me" requests: when someone says they do not want messages — with a word like "stop" — an opt-out marker is stored and no campaign message is sent to them through that channel. The opt-out is recorded with the first 120 characters of the person's own words and the date. It is kept so the request can be honoured: deleting it would let the request be forgotten and messages start again. When the person's record is deleted, the opt-out stays and their words are removed.
- Consent ledger: a tenant can record a person's marketing consent or opt-out in the panel, per channel, with its source (such as a store or website form, the customer's own statement, or an İYS record), evidence and the date it was given. Records are only ever added and the latest one applies; consent cannot be recorded without evidence. Marketing-category messages are sent only to people whose consent is recorded, and an opt-out stops every campaign message. When the person's record is deleted, their consent records are deleted too.
- Who holds consent: obtaining the recipient's prior consent for commercial electronic messages, keeping it, and registering with the Message Management System (İYS) where required are the responsibility of the tenant as the sender and data controller (Terms of Use, section 8). SemAgent does not collect consent on the tenant's behalf and does not keep İYS records; the consent ledger helps the tenant keep its own records and does not verify that consent exists.
- Legal basis: for sending the message, the basis determined by the tenant; for keeping the opt-out marker, compliance with a legal obligation (KVKK Art. 5(2)(ç)).
23. Customer profiles, temporary visitors, segments and cross-channel linking
- Temporary visitor profile: when someone sends their first message in the widget or a messaging channel, a temporary profile is opened that is tied only to that channel's or device's identifier (the visitor ID the widget keeps in the browser; a WhatsApp, Instagram or Telegram account). Viewing pages does not open a profile. A temporary profile is used only as the context of a support conversation; it is not used as a cross-visit tracking or advertising profile. A temporary profile opened from the visitor ID the widget keeps in the browser can never enter a campaign: campaign messages go only to people who wrote to the tenant on a messaging channel. Temporary people on a messaging channel stay out of segments and campaigns by default; they are included only if the tenant explicitly chooses so in a segment, and the consent and opt-out rules in section 22 still apply. It is deleted automatically after 90 days of inactivity; conversations are not affected by this deletion.
- Customer profile: kept for people whose identity has been proven or who have been linked by an agent of the tenant: a summary derived from their conversations (number of conversations, channels used, first and last seen) plus the tags, notes and free-form fields the tenant adds.
- Identities and trust: a person's identities (device, channel account, email address) are stored together with how each was linked: proven (the channel's own identifier, the sender of an inbound email, an order number matching the email on that order in the store plus a one-time code sent to that email (the match alone if the merchant has turned the code off), the email of a customer signed in to the tenant's site as signed by the tenant), linked by an agent, or claimed (an email the person typed themselves). A claimed address never merges people, never brings in the order history of that address, and never gives the AI information about the owner of that address.
- Cross-channel linking: a person is linked to a customer record only when their identity is proven or when an authorised agent of the tenant links them by hand; once linked, their messages are combined on that record. No automatic merging based on similar phone numbers or usernames takes place. Every link, move and detachment is recorded, written to the audit log and can be undone.
- Segments: the list of people matching rules the tenant defines (such as tags, channel, number of orders, spend, events) is recalculated every time it is opened; the member list is not stored separately. Segments are used for customer service and, if the tenant chooses, for campaign targeting. No automated decisions with legal effect are made about people; your right to object to results produced exclusively by automated analysis (KVKK Art. 11(1)(g)) remains reserved.
- Discount code record: if the tenant allows the assistant to give a discount code and the assistant gives it in a reply, which code was given to which person, in which conversation, on which channel and when is recorded. The record is kept to apply the "once per person" condition and to show the tenant how many people received the code; it contains no message text. The person is referred to by their profile ID; if no profile exists yet, by the conversation's channel identity, and the record is linked to the profile once it is created. It is deleted together with a temporary profile; a record never linked to a profile is deleted after 90 days.
- Deletion: when a person's record is deleted, the order archive and events of all of their proven and agent-linked addresses, the earlier temporary profiles merged into them, claims of those addresses on other profiles, and the record of discount codes given to the person are deleted as well. The archive of an address the person only claimed is not deleted, because that address was never proven to be theirs. Conversations are deleted separately.
- Legal basis and transparency: these belong to the tenant as the data controller (Terms of Use, section 7).
24. Changes & contact
Updates are published on this page; material changes are notified by email. Questions: [email protected]
Last updated: October 24, 2026