Privacy Policy

Effective Date: September 1, 2026
Last Updated: October 28, 2026

Cheto (“we”, “our”, or “us”) is a service operated by Lega Digital Yazılım Anonim Şirketi. We provide an AI assistant that answers messages and comments for businesses on their own messaging channels. This Privacy Policy explains how we collect, use, share and store information, including data received from Meta platforms — Instagram, Facebook Messenger and WhatsApp — and from other channels a business chooses to connect.

1. Our Role: Controller and Processor

Two different relationships are covered by this policy:

• Businesses that use Cheto. For the account data of the business itself (the connected account, its settings and its billing records) we act as the data controller.
• Customers who message a business. When you message or comment on a business that uses Cheto, we process that data on behalf of that business, as a processor. The business decides what the assistant does and can switch it off or disconnect at any time. Requests about your data can be made either to that business or to us.

2. What Information We Collect

a. Instagram

• The Instagram account ID and username of the connected business account
• Direct messages sent to or from that business account
• Comments left on that business account's own posts, and the commenter's username and user ID
• The access token issued when a business connects its account

b. Facebook Messenger

When a business connects a Facebook Page with Facebook Login for Business, we may receive:

• The Page ID and Page name of that business
• The Page-scoped ID and the first and last name of customers who message that Page
• The content of messages exchanged with that Page, including any media sent in the chat
• The Page access token issued when the business grants access

We only ever access the Page a business has explicitly connected to us. We never access personal Facebook profiles, friend lists, or any conversation that does not involve the connected Page.

c. WhatsApp

When a business connects a WhatsApp Business account, we may receive:

• The WhatsApp Business Account ID and business phone number of that business
• The phone number and WhatsApp profile name of customers who message that business
• The content of messages exchanged with that business, including any media sent in the chat
• Message templates created for that business and their approval status
• The access token issued when the business connects its account

We only ever access the WhatsApp account a business has explicitly connected to us. We never access personal WhatsApp accounts, groups, or any conversation that does not involve the connected business.

d. Conversation and Appointment Data

• Responses to appointment prompts and date/time preferences
• Booking confirmations
• Conversation history, so a conversation can continue naturally
• Complaint records created when a comment or message is flagged for follow-up

e. The Cheto Gallery Mobile App

Cheto Gallery (Android and iOS) lets a business's staff review the videos its customers sent over the channels above. There is no public sign-up: each person signs in with a username and password that we make for them at the business's request, and sees only the accounts the business assigned to them. When you use the app:

• Your username and password are sent to our servers once, at sign-in. The app keeps only a session cookie on the phone; it does not store your password.
• The app loads the business's conversations and plays the customers' videos from our servers. It does not upload any photo, video or file from your phone.
• Actions you take are sent to our servers: clearing a reviewed customer, which deletes that conversation from our servers; changing your password; and, on business accounts that use it, reporting a video to the traffic-violation reporting service we operate.
• When you ask for a caption, the conversation's text, or the description you type, is sent to our AI providers (see section 4).
• Face and licence-plate blurring, the watermark and the speech recognition behind the profanity filter run on your phone. The speech recognition models are downloaded once from public model hosts (Hugging Face, GitHub); no user data is sent with that download. A video leaves the phone only when you save it or hand it to Instagram.
• On Android, face detection uses Google's ML Kit, which runs on the device. Google may receive diagnostic and usage information about the detector (such as device model, operating system and app version), never the video itself.
• The app contains no ads and no tracking, and we collect no analytics from it; the ML Kit diagnostics above are the only usage data that leaves the phone.

Staff accounts are made by the Cheto team at a business's request. To have yours deleted, follow the steps at https://cheto.ai/auth/data-deletion.

3. How We Use Your Information

• To generate and send replies on behalf of the connected business
• To publish replies to, and hide, comments on that business's own posts
• To identify returning customers and continue existing conversations
• To book appointments where the business has enabled booking
• To show the business its own conversations, complaint tickets and settings
• To maintain security and prevent abuse

We do not use your data for advertising, ad targeting or profiling, and we do not sell it. We do not use message or comment content to train our own models.

4. Automated Processing by AI Providers

To generate a reply, the text of the conversation is sent to a third-party AI provider — currently Anthropic (Claude), with OpenAI as a fallback — which returns suggested reply text. Short yes/no and category questions (for example, whether a message asks for an appointment) may be answered by TypeSafe's decision model, reached through OpenRouter. Only the content needed to produce that reply or decision is sent. These providers act as our processors under contract and are not permitted to use the content for their own purposes.

5. How We Share Your Information

We do not sell or share your personal data with third parties for marketing. We use the following service providers, each processing data only on our behalf and under confidentiality obligations:

• Meta Platforms – Instagram, Messenger and WhatsApp messaging infrastructure
• Our hosting provider – application and database servers, located in Türkiye
• Anthropic / OpenAI – generating assistant replies (see section 4)
• TypeSafe, via OpenRouter – answering short yes/no and category questions about a message (see section 4)
• Google (Gmail) – sending e-mail notifications to the business
• Google (ML Kit) – on-device face detection in the Cheto Gallery Android app; Google receives only diagnostic data about the detector (see section 2e)
• PayTR and iyzico – payment processing for business subscriptions (customer message data is never shared with the payment providers)
• Telegram – only where a business has chosen to connect it for staff notifications

6. Data Retention

Conversation content and comment content are retained for 30 days, after which they are automatically deleted. Complaint records and appointment records are kept for as long as the business needs them to serve the customer, and are deleted when the business's account is closed. Access tokens are deleted immediately when a business disconnects a channel.

You may request deletion at any time by visiting: https://cheto.ai/auth/data-deletion

7. User Rights

Depending on your jurisdiction — including under the Turkish Personal Data Protection Law (KVKK) and the GDPR — you may have the right to:

• Access the personal data we hold about you
• Request correction or deletion
• Object to or restrict processing
• Withdraw your consent at any time

8. Security Measures

We apply reasonable security measures including HTTPS encryption in transit, access controls, server-side storage of access tokens (never exposed to a browser), and data minimization.

9. Public Authority Requests

If a public authority requests personal data, we apply the following process:

• We review the legality of the request before disclosing any data
• We challenge unlawful or overly broad requests
• We only disclose the minimum necessary information
• We document such requests, our responses, and the reasoning involved
• Where the request concerns a customer of a business that uses Cheto, we direct the authority to that business as the controller of that data, unless we are legally required to respond ourselves

10. Changes to This Policy

We may update this Privacy Policy from time to time. Significant changes will be communicated to connected businesses by email or through the Cheto portal.

11. Contact Us

If you have any questions or requests regarding your privacy, please contact:

Lega Digital Yazılım Anonim Şirketi
Halaskargazi Mah., Şişli, İstanbul, Türkiye
Email: info@cheto.ai
Phone: +90 555 400 53 47