Privacy notice

OliveSupp handles two different sets of data, and our role differs for each:

• Customer data (the website owner using the service and their team): here we are the data controller.
• Visitor data (what people visiting a customer's website write and where they browse): here we are the data processor. We store it on behalf of, and on the instructions of, the customer, who is the controller.

If you add OliveSupp to your website, you are responsible for informing your visitors. You may reference this notice in your own privacy policy. The panel has an option that asks visitors to confirm your privacy notice before their first message.

[ŞİRKET UNVANI — yönetim panelinden doldurulacak]
[AÇIK ADRES — yönetim panelinden doldurulacak]
Email: kvkk@olivesupp.com

For customer accounts: name, email address, an irreversible hash of the password (the password itself is never stored), account creation date, panel language, plan and account status, team members' names and emails; if the customer connected them, a HubSpot access token and a webhook URL.

For visitors: a random identifier created in their browser, the messages they write, the files and images they send, IP address, the address of the current page, the addresses and titles of pages they browse on the site (with timestamps), the address they came from, device type (desktop/mobile), first and last seen times, number of visits, and the chat rating they give. If visitors type their name or email (e.g. the "we'll get back to you" box while offline), those are stored too. If the customer turned on "read the cart", a cart summary (product names, quantities, total) is stored. If the consent box is enabled, the fact that consent was given is kept in the visitor's own browser.

IP address: the visitor's last seen IP is stored so the customer can tell visitors apart, block unwanted visitors and prevent abuse (fake messages, request floods). Customers can anonymize old IPs from the panel. Payment card details never reach us.

Mobile app and notifications: the OliveSupp Android app opens the same panel and processes the same data. If you turn on notifications, your device's notification identifier (in the app, a Firebase Cloud Messaging token; in a browser, the browser's push address) is stored linked to your account and team member; it is deleted when you turn notifications off. The app does not collect location, contacts or advertising ID.

• To provide the service: delivering and storing conversations.
• To let customers manage their account: inbox, visitor list and browsing history, search, reports, automated messages.
• To notify customers by email when a message arrives while they're offline.
• To run integrations the customer has turned on (see section 6).
• Security: preventing abuse and misuse.

This data is not used for advertising, not sold to third parties, and not shared between customers.

Processing is necessary to enter into and perform the contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c) and is based on our legitimate interest in keeping the service secure (GDPR Art. 6(1)(f); KVKK Art. 5/2-f). For visitor data, the duty to inform visitors and, where required, obtain consent lies with the customer as controller.

Data is kept on our hosting provider's servers, which may be located in European Union countries (Germany/France). Email notifications are sent through Resend, which is also located outside Türkiye. Data may therefore be transferred abroad. By using the service you accept this transfer; if you don't, you can close your account at any time.

Notifications to the mobile app are sent through Google's Firebase Cloud Messaging. Only the device's notification token and the text "You have a new message" are sent to it; message content is not.

Integrations turned on by the customer: if the customer chooses, some visitor data is sent to the customer's OWN accounts — HubSpot (email and name of visitors who leave their email), Google Analytics 4 (event names such as chat opened/started, sent from the visitor's browser to the GA4 code on the customer's site) and a webhook URL set by the customer (message text, visitor name/email, page). These transfers are the customer's instruction and can be turned off.

Conversations, visitor records and page history are kept as long as the customer's account is open. Customers can delete chats older than a chosen period from the panel. When the owner deletes the account from the panel (see section 12), all of its data is deleted immediately. If we close an account, its data is deleted within 3 months at the latest. Removal from our hosting provider's backups takes up to 3 months.

To recognize a visitor on their next visit, the chat widget writes a random identifier to their browser. It is stored on the domain of the website being visited, is not used for advertising and does not track across sites. If the site isn't visited for 6 months, the identifier renews itself. If the visitor clears their browser data, it's deleted; in both cases past conversations no longer show in the widget. Whether an automated message was shown in the current session is kept in the browser for that session only.

The panel uses only a strictly necessary session cookie and a cookie remembering your chosen panel language. Your theme preference is kept in your browser. There are no analytics or advertising cookies.

You have the right to know whether your data is processed, to request information about it, to learn whether it is used for its purpose, to have it corrected or deleted, to restrict processing, to data portability, to object, and to claim compensation for damage. If you are in the EU you may also lodge a complaint with your data protection authority.

Send requests to kvkk@olivesupp.com; we reply within 30 days. If the request concerns visitor data on a customer's website, the customer is the controller and we forward the request to them.

Passwords are stored as irreversible hashes. Each customer's data is tied to their account ID, and every record the panel reads is scoped to that account. Connections are encrypted with TLS. Webhook requests are signed and only sent to https addresses on the public internet.

If this notice changes, the date at the top changes. Customers are notified by email of material changes.

You can delete your OliveSupp account and all your data yourself, from the web panel or the OliveSupp mobile app:

1. Sign in at olivesupp.com/giris or in the app.
2. Open the My account page from the menu.
3. In the Delete account section, enter your password, tick the confirmation box and press "Permanently delete account".

What is deleted: account details, team members, chats, messages, files, visitor and page history records, automated messages, canned replies, notification registrations and all settings. Deletion is immediate and can't be undone; data disappears from backups within 3 months at the latest.

Only the account owner can delete the account. If you can't sign in, email destek@olivesupp.com from your registered address with the subject "Account deletion"; once we confirm the account is yours, it is deleted within 30 days.