Privacy Notice

1. Who we are

HY AI Platform is operated by Hüsnüye Yaşar, a sole proprietorship registered in Türkiye and trading as HY AI Platform. HY provides software to businesses and has no UK company, branch, office or employees. Last updated: 28 October 2026.

• Controller: Hüsnüye Yaşar (sole proprietorship), trading as HY AI Platform
• Turkish tax ID: 9390389782
• Address: Çınarlı Mah. 1572 Sk. Kapı No:33 Daire No:Z18 Konak/İzmir, Türkiye
• Email: privacy@hyaiplatform.com

2. What this notice covers

HY acts as controller for its own website, enquiries, demos, business accounts, billing, support and security activities. For personal data in Customer Data processed on a business customer’s behalf, that business is generally the controller and HY acts as processor on its documented instructions under the applicable Data Processing Addendum (DPA). If you are an end-customer of a business using HY, contact that business about your data. Requests received by HY are routed to the business where appropriate.

3. Personal data

Depending on the service and enabled features, data may include:

• Contact, demo and account data: name, company, email, phone, role, account and billing contact information and enquiries sent to HY.
• Customer Data: names, contact details, delivery addresses, platform identifiers, messages and attachments, product, price, stock, order, delivery, invoice and payment-status information.
• Technical and security data: IP address, device and browser information, sign-in, activity, audit, security and error records.
• Billing and accounting information: invoices, payment status and payment references. HY’s own subscription fees are currently invoiced and paid by bank transfer; there is no online subscription checkout.

4. Meta messaging data

When a business connects WhatsApp, Instagram or Messenger, HY processes messages sent to and from the connected account, platform identifiers, timestamps and attachments to display and respond to customer messages and support order handling. HY processes this Customer Data on the business’s behalf. Meta message data is not sold or used by HY for advertising or profiling. Removing the connection stops new message exchange through that integration; it does not delete the business’s Meta account.

5. AI use

HY uses AI systems for certain service functions. Customer messages and the commercial context, product, price, stock and order information necessary to provide the service may be processed to generate responses and recommendations. Processing is limited to the information needed for those functions. AI output can be incomplete or incorrect; staff can take over a conversation, and an order requires the end-customer’s confirmation. HY is not intended for solely automated decisions that have legal or similarly significant effects on individuals.

6. Purposes and lawful bases

For its controller activities, HY uses data to respond to enquiries, administer business accounts and subscriptions, provide support, maintain security and reliability, meet accounting and other legal obligations, and protect rights. Depending on the activity, the lawful basis is contract or pre-contract steps where applicable, legitimate interests in business administration and service security, or legal obligation. Where consent is required, it is requested separately and may be withdrawn. Business marketing must also meet the applicable rules for the recipient and channel. Customer Data is processed under the business customer’s instructions; the customer is responsible for its own lawful basis and notices.

7. Service providers and data flows

HY uses hosting, database, AI, messaging, email and technical providers, including Railway, Supabase, Vercel, OpenAI, Meta and Cloudflare, together with email delivery providers selected for the configured service. Email flows can include account notifications and invoice/accounting messages with PDF, Excel or ZIP attachments. The relevant data depends on the message and enabled service. Provider functions and Customer Data flows are described separately on the Service Providers and Data Flows page (/legal/service-providers?lang=en). Provider roles depend on the particular processing and contract; customer-selected third-party integrations are not automatically HY subprocessors.

8. Connected services and payments

A business may connect its own marketplace or other third-party accounts. Marketplace order and buyer information may flow into HY, while product, stock and price information flows to the marketplace. The business’s separate provider terms also apply. Customer-connected Stripe and iyzico payment links are intended for a business to collect from its own customers through its own provider account, separately from HY subscription fees. These payment-link integrations are not currently offered as live collection services. GoCardless is planned and is not a current live service. Google Maps address validation is not currently enabled.

9. International transfers

HY is based in Türkiye. UK Customer Data may be transferred to HY in Türkiye and to service providers in other countries. Where a transfer is restricted under applicable UK data protection law, an applicable lawful transfer route and the required assessment must be in place before it proceeds. Depending on the flow, appropriate safeguards may include the UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses with the UK Addendum. This notice does not confirm that a particular transfer agreement has been executed.

10. Retention and deletion

HY keeps data for the purposes for which it is processed and for applicable legal retention obligations. After account termination, export, deletion and return are handled under the agreed service terms and DPA. Provider backups and technical logs may follow separate replacement or retention cycles; records required for accounting, tax, disputes or other legal obligations may be retained. Third-party providers may retain their own records under their own terms and duties. Data Deletion Instructions (/legal/veri-silme?lang=en) explain how to make a request.

11. Security

HY uses logical tenant separation, authentication, role-based access controls, HTTPS connections and audit/security logging. Access to Customer Data is limited according to role and service needs.

12. Rights and complaints

Subject to applicable law, you may have rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent. Contact privacy@hyaiplatform.com. HY may verify your identity and will respond within the applicable statutory period. You may also complain to the UK Information Commissioner’s Office at ico.org.uk.

13. UK representative

Where required under applicable UK data protection law, HY will appoint a UK representative and publish the representative’s contact details here.

14. Changes and contact

HY may update this notice when its service, providers or applicable law changes and will communicate material changes to business customers where appropriate. Privacy contact: privacy@hyaiplatform.com. Business contact: hello@hyaiplatform.com.