1. Who we are
1.1 Otai is a hospitality communications and operations platform operated by Çallıoğlu İnşaat Turizm Sanayi ve Ticaret A.Ş. ("Otai", "we", "us" or "our"), a company incorporated in Türkiye.
1.2 Registered office: Sedir Mahallesi, 725. Sokak No: 2, Muratpaşa, Antalya, Türkiye Tax office / number: Antalya Kurumlar Vergi Dairesi / 2270065139 Privacy contact: info@otai.app Website: https://otai.app/
1.3 This Policy explains how we handle personal data when a person visits the Otai website, communicates with us, administers a business account, uses the Otai platform, or communicates with one of our business customers through an Otai-enabled channel, including WhatsApp.
2. Our different privacy roles
2.1 Our role depends on the context:
2.2 If you are an end user communicating with a Customer Business, that business’s privacy notice is the primary notice for the conversation and related service. Please contact that business first about the substance of its processing. We will assist it with valid requests as required by our agreement and applicable law.
- Customer communications and operational content. A business that uses Otai—such as an accommodation, travel, service or hospitality business ("Customer Business")—normally determines why and how it communicates with its guests, prospects and other end users. The Customer Business is normally the controller of that data, and Otai processes it on the Customer Business’s documented instructions as a processor/service provider.
- Otai’s own business operations. Otai acts as controller for data used to operate our website, create and administer business accounts, secure the service, manage contracts and billing, provide support, comply with law, and protect or establish legal rights.
- Customer acting as a processor. If a Customer Business processes data for another controller, Otai may act as its subprocessor under the Otai Data Processing Addendum.
3. Personal data we handle
3.1 We process only data reasonably needed for the purposes described below. Depending on how Otai is configured, this may include:
3.2 We do not ask users to send full payment-card data, financial-account credentials, medical records or other unnecessary confidential or sensitive information through WhatsApp or Otai. Do not include such data in free-text messages. If a user voluntarily includes sensitive data in a request, we process it only as needed to transmit and handle that request under the Customer Business’s instructions, protect vital interests where applicable, or comply with law.
- name, business email address, business telephone number, job title and employer;
- account identifier, role, access permissions, authentication records and login history;
- company, contract, subscription, billing and invoice information;
- support requests, meeting notes and communications with us;
- Messaging integration data: business account and phone identifiers, approved templates, connection status and access credentials.
- audit, activity, security and administration logs.
- telephone number and WhatsApp profile/display name made available through the integration;
- message content, attachments or media that the user chooses to send;
- message metadata, timestamps, delivery/read status and conversation identifiers;
- language preference and communication choices;
- booking, stay or service reference supplied by the Customer Business or the user;
- requests, complaints, feedback, service needs and the operational tasks created from them;
- responses and notes added by authorised Customer Business personnel;
- opt-in, opt-out and suppression information where the Customer Business records it through Otai.
- IP address, browser and device type, operating system, date/time, referring page and requested URL;
- session, error, diagnostic, security and network logs;
- authentication and session identifiers stored through cookies, browser storage;
- language, interface, cookie and privacy choices;
- a pending chat request temporarily stored on the device to continue after login;
- where enabled, usage events, visitor/session identifiers and recorded page interactions for analytics, subject to consent where required.
- information submitted through forms, email, demonstrations, support or sales enquiries;
- records needed to investigate incidents, prevent abuse, answer legal requests, enforce agreements or establish legal claims.
4. How we obtain data
4.1 We obtain data:
- directly from Customer Businesses, their authorised users, website visitors and support contacts;
- from end users who communicate with a Customer Business through WhatsApp or another enabled channel;
- electronically through Customer-authorized messaging integrations;
- automatically from browsers, devices, servers and security systems;
- from integrations a Customer Business lawfully connects to Otai.
5. Why we use data and our legal grounds
5.1 Depending on applicable law and our role, we use personal data to:
| Purpose | Typical legal basis where Otai is controller |
|---|---|
| Provide accounts, contracted services, onboarding, support and requested demonstrations | Contract performance or steps requested before a contract |
| Operate the WhatsApp integration and connected business assets | Contract performance; the authorised Customer Business’s instructions |
| Authenticate users, prevent fraud and abuse, troubleshoot, monitor availability and secure the service | Legitimate interests in secure and reliable operations; legal obligations where applicable |
| Maintain a user-requested login, account-merging, widget or deferred-action flow and remember an express language/interface choice | Contract performance or steps requested by the user; legitimate interests where appropriate |
| Administer contracts, subscriptions, invoices and business relationships | Contract performance; legal obligations; legitimate interests |
| Respond to privacy requests, regulator enquiries, litigation and lawful demands | Legal obligations; establishment, exercise or defence of legal claims |
| Measure usage and diagnose usability issues through optional analytics, including recorded interactions where enabled | Consent where required; optional tracking remains disabled until the relevant choice. |
| Improve reliability using strictly necessary, minimised security/error logs and properly anonymised statistics | Legitimate interests, balanced against user rights; legal obligations where applicable |
| Send product news or marketing to business contacts | Consent where required; otherwise a permitted business-marketing basis with an easy opt-out |
5.12 When Otai acts as processor, the Customer Business determines the legal basis and instructs us through the applicable customer agreement and DPA.
5.13 We do not sell personal data. We do not use WhatsApp Business Solution Data to build advertising profiles. We do not use message content, metadata, or any anonymous, aggregate or derived form of WhatsApp Business Solution Data to create, train or improve a shared or general-purpose AI/ML model. An AI subprocessor may process content only to produce the contracted Otai response or workflow for the relevant Customer Business, under contractual restrictions that prohibit provider model training with that content.
6. Artificial-intelligence processing
6.1 Otai may use automated language and classification systems to interpret a request, retrieve Customer Business information, draft a response, translate or summarise content, identify operational intent, and route or create a task. The result can be inaccurate or incomplete. Customer Businesses must maintain appropriate human oversight and a clear route to human assistance, especially for safety, health, legal, payment, cancellation, accessibility or other consequential matters.
6.2 Otai is not intended to make solely automated decisions that produce legal or similarly significant effects about an end user. If a Customer Business configures a materially different use, it is responsible for an appropriate legal assessment and notice, and must not use Otai contrary to our Terms or instructions.
7. Who receives data
7.1 We may disclose data only as reasonably necessary to:
7.2 The categories of service providers we use are described above and in the Otai DPA. We require processors to handle data only for the contracted service, protect it, and comply with applicable privacy and security obligations. Specific provider identities are disclosed to authorised Customer Businesses or competent authorities where contract or law requires it.
- the relevant Customer Business and its authorised personnel;
- messaging platform providers to operate the authorized channels and deliver messages;
- contracted subprocessors that provide hosting, databases, authentication, analytics, security, performance/error monitoring, logging, support, communications and AI inference;
- professional advisers, auditors and insurers subject to confidentiality duties;
- public authorities, courts or law-enforcement bodies where disclosure is legally required or necessary to protect rights and safety;
8. International transfers
8.1 Otai is operated from Türkiye, and some service providers or Meta/WhatsApp systems may process data in other countries. Before a restricted transfer, the responsible party must use an applicable lawful transfer mechanism. Depending on the parties and law, this may include an adequacy decision, the relevant Turkish KVKK standard contract, EU Standard Contractual Clauses, the UK Addendum, another approved safeguard, or a legally permitted exception for an occasional transfer.
8.2 Where Otai acts as processor, international transfers are made only on the Customer Business’s documented instruction or as otherwise permitted by the DPA and applicable law. Transfer safeguards do not remove the Customer Business’s own controller responsibilities.
9. Retention
9.1 We retain personal data only for the period required by the stated processing purpose, the Customer Business’s documented configuration or instructions, contractual requirements and applicable law. Retention periods are reviewed according to the nature of the data and the reason for processing it.
9.2 When the applicable purpose and legal basis end, or following termination or a valid deletion instruction where appropriate, the relevant data is deleted, destroyed, returned or irreversibly anonymised. Data remaining in protected backups is isolated from ordinary use and removed through the applicable backup-deletion cycle, unless restoration or continued retention is required for disaster recovery, security, compliance or legal claims.
9.3 WhatsApp authorisation credentials and tokens are revoked or deleted when the relevant connection and need for access end. Limited business, billing, contract, security, support, audit, consent-withdrawal and opt-out records may be retained for as long as needed to comply with legal obligations, establish or defend rights, investigate incidents, demonstrate compliance and honour communication preferences; they are then securely deleted or irreversibly anonymised.
9.4 Irreversibly anonymised information that cannot reasonably be linked back to a person is not personal data and may be retained for statistical and service-reliability purposes. We do not treat pseudonymised or merely masked data as anonymous.
10. Security
10.1 We use access controls, encryption, authentication checks, abuse prevention, security records and incident response measures to protect personal data.
11. Your choices and rights
11.1 Depending on the law that applies, a person may have rights to obtain information about processing; access, correct or delete data; restrict or object to processing; withdraw consent; receive portable data; object to certain automated decisions; and complain to a competent authority.
11.2 For a conversation with a Customer Business, contact that business first. You may also contact us at info@otai.app. We will verify requests proportionately and, where we act as processor, refer the request to or assist the relevant Customer Business. Withdrawing consent does not affect processing that occurred lawfully before withdrawal, and some records may be retained where law requires or permits.
11.3 WhatsApp messaging opt-out instructions are available at https://otai.app/whatsapp-permissions.
Data deletion and integration disconnection
To request deletion of personal data controlled by Otai, email info@otai.app with the subject “Otai Data Deletion Request”. State the contact information used with Otai, the relevant Customer Business or account, and enough detail to locate the data. Do not send unnecessary confidential information or a copy of an official identity document. We may request proportionate verification where necessary to protect the requester and other users.
Where the relevant Customer Business is controller, we will direct the request to that business or assist it as processor. Where Otai is controller, we will evaluate and complete a valid request within the period required by applicable law. Data may be retained only where a legal obligation, security requirement or the establishment, exercise or defence of a legal right requires it; remaining data is then deleted, destroyed or irreversibly anonymised when that need ends.
An authorised business administrator may also disconnect Otai from the relevant Meta/WhatsApp business settings or request assistance from info@otai.app. After verified disconnection, Otai stops new processing through that integration and revokes or deletes its access credentials. This does not delete data independently retained by the Customer Business or Meta/WhatsApp, which must be addressed under their own procedures.
13. Other privacy information
13.1 Otai’s business services are not directed at children.
14. Changes to this Policy
14.1 We may update this Policy to reflect legal, technical or service changes. We will post the revised version with a new effective date and provide additional notice where a material change requires it. A material new purpose will not be applied retroactively without an appropriate legal basis and notice.
15. Contact
15.1 Çallıoğlu İnşaat Turizm Sanayi ve Ticaret A.Ş. Sedir Mahallesi, 725. Sokak No: 2, Muratpaşa, Antalya, Türkiye Email: info@otai.app
15.2 For Turkish data subjects, see the separate KVKK Disclosure Notice at https://otai.app/kvkk.