Privacy notice

Who is responsible for your data

The data controller is WDgrowth, the trade name of Omar Mikati’s sole proprietorship, Cevizli Mah. Zuhal Cad. A Blok No: 46 İç Kapı No: 50, Maltepe / İstanbul, Türkiye (Kartal Vergi Dairesi, tax number 6211063688). Contact: info@wdgrowth.com, +90 538 626 95 17.

This notice explains how we handle the personal data of visitors to wdgrowth.com and of the people who use our system at wdgrowth.com/app. It is given under article 10 of Türkiye’s Personal Data Protection Law No. 6698 (KVKK) and, where it applies, the EU General Data Protection Regulation (GDPR).

What we collect, how, and on what legal basis

Website visits: your IP address, browser type and the pages you open are recorded automatically by our hosting provider so the site can be delivered and protected from attacks. From the IP address the site also works out your country, only to show prices in Turkish lira or US dollars; we do not store the address ourselves. We also count visits and a few clicks (for example, seeing the plans or choosing one) with Vercel Web Analytics, which uses no cookies and does not identify you: it does not store your IP address, and a visit is recognised only for the same day, by a code that is deleted after 24 hours. Legal basis: our legitimate interest in running a safe website and improving it (KVKK article 5(2)(f)).

Your account: your email address and, if you sign in with Google, the name and profile picture Google shares, plus the times you sign in. You give these through the sign-up and sign-in forms. Legal basis: setting up and performing the contract with you (KVKK article 5(2)(c)). We never get your Google password.

Your business setup: business name, opening hours, services, prices, staff email addresses, WhatsApp and phone numbers and the answers you approve for the assistant, entered by you in the system. Legal basis: performing the contract (article 5(2)(c)).

Payments: at checkout you enter your email (if you have no account yet), your name and your mobile number; after paying you can add your business’s tax number for the invoice during setup. Your name, email and mobile number go to iyzico, the licensed payment institution that takes the payment and requires them with every card payment, together with the city and country the payment comes from in place of a billing address. We keep only your name, email, plan, payment status and renewal dates, and the tax number if you add it. Legal basis: performing the contract (article 5(2)(c)) and our tax and accounting duties (article 5(2)(ç)). We never see or store card details.

Messages you send us by email, WhatsApp or phone: what you write or tell us, to answer you. Legal basis: performing the contract or our legitimate interest in answering enquiries (article 5(2)(c) and (f)).

The “Write to the AI receptionist” demo on wdgrowth.com: what you type is sent to our AI provider so the demo clinic can answer, and is not stored by us. Please do not type personal health details there. Legal basis: our legitimate interest in showing how the service works (article 5(2)(f)).

When the service runs for a business, its customers’ messages, names, phone numbers or usernames, appointments and, for phone calls, the call record (see the next section) are processed. That business is the data controller for this data and we process it on its behalf and on its instructions only (as a data processor under KVKK).

Your customers’ conversations and calls

The assistant answers your customers automatically from the information you approved. In its first reply it says it is the business’s AI assistant, and anyone can ask for a person at any time; it does not take decisions that have legal effects for anyone.

Phone calls: callers are told at the start that they are speaking with an AI assistant and that the call is recorded. We keep the caller’s number, the number called, the time and length of the call, a transcript, a short summary and what the caller asked for, so the business can follow up. The audio recording is held by our voice provider, ElevenLabs.

Patients sometimes mention health matters, which are special-category data under KVKK article 6. The business, as controller, must inform its customers and have its own legal basis for this; we use such data only to answer and book for the business, keep it separated from other businesses’ data, and never use it for any other purpose.

Why we use it

To create and secure your account, set up and run the service you chose, take payments and send invoices, answer your messages, send the emails the service needs (sign-in links, staff alerts, reports and notices about your plan), keep the service secure and meet our legal and tax duties.

We do not sell personal data, use it for advertising or profiling, or use your customers’ conversations to train AI models.

Who receives it and why

Service providers that run parts of the service for us, each receiving only what its task needs: Vercel (website and system hosting, USA); Railway (the server that runs the assistant, servers in the EU); Supabase (database and sign-in, EU, Frankfurt); YCloud (an official Meta WhatsApp Business Solution Provider that passes WhatsApp messages between the business and Meta, Singapore); Meta (WhatsApp messages, Ireland and USA); OpenAI (writing the assistant’s replies and voice features, USA); ElevenLabs (answering, recording and transcribing phone calls, USA); Twilio (phone numbers and connecting calls, USA); Resend (sending emails, USA); Google (sign-in with Google and calendars you choose to connect, USA); iyzico Ödeme Hizmetleri A.Ş. (card payments, Türkiye).

Using the providers outside Türkiye means personal data is transferred abroad, to the USA, EU countries and Singapore, for the purposes in this notice; this is done under article 9 of KVKK.

Public authorities and courts, and our tax advisers, when the law requires it.

How long we keep it and how we protect it

Account data, conversations and call records for as long as your account exists, so you and your receptionist can look back at them; if you close your account or ask us to delete them, we delete them within 30 days. Payment and invoice records for as long as tax and commercial law require (up to 10 years); website logs only for the short period our host keeps them. Then we delete or anonymise the data.

Each business’s data is kept separate, connections are encrypted, access tokens and shop keys are stored encrypted, and only the people who run the service can reach the data, only when needed to provide or support it.

Your rights (KVKK article 11)

You can ask us: whether we process your personal data and, if so, for information about it; the purpose of the processing and whether it is used for that purpose; who it is shared with in Türkiye or abroad; to correct it if it is incomplete or wrong; to delete or destroy it under KVKK article 7; to tell those we shared it with about a correction or deletion; to object to a result against you that comes only from automated analysis; and to be compensated if unlawful processing caused you harm. Under the GDPR you also have the rights to restrict processing and to data portability.

To use these rights, write to us at Cevizli Mah. Zuhal Cad. A Blok No: 46 İç Kapı No: 50, Maltepe / İstanbul, or email info@wdgrowth.com from the email address you use with us (or send it by registered electronic mail, KEP, or with a secure electronic or mobile signature). We answer free of charge within 30 days at the latest.

If you are a customer of a business that uses our assistant, you can also ask that business directly. You can complain to the Personal Data Protection Authority (KVKK) or, in the EU, to your local data protection authority.

Cookies, children and changes

We use only the cookies the site and the system need to work; they are listed in our cookie policy.

Our service is for businesses and not meant for children under 16.

If we change this notice in a way that matters, we update the date above and tell account holders by email.