Your data, kept safe.

Where data is stored

Your customers' messages and files, and your approved answers, are stored in our database and file storage at Supabase. Today our Supabase project runs in the Tokyo, Japan region; we plan to move it to the EU. Our workflow automation (n8n Cloud) is hosted in the EU, in Germany, and the AI model providers are in the USA. Each service, and where it stores data, is listed on our subprocessors page.

Retention and deletion

• During your contract: we keep your customers' messages and files while your contract runs, and delete them sooner if you ask. Patient voice notes are deleted after 30 days.
• On request: when a customer asks you to delete their data, tell us. We delete it from the database and file storage and confirm it to you in writing.
• When you leave: we delete your data, or return it to you, within 30 days after the contract ends.

Backups

We rely on the standard backup features of our database provider, so any backups stay with that provider and are encrypted at rest like the rest of your data. We don't run a separate backup system of our own yet.

Monitoring and alerts

Questions the assistant can't answer go straight to your staff, and so do emergencies, complaints and refund requests. Your staff can take over any chat at any time. If something in your system isn't working, tell us and we look at it as soon as possible.

If something goes wrong

• First, we stop it. We switch off the affected part, close the access and keep the logs.
• We tell you. Without undue delay, and within 72 hours of becoming aware of it: what happened, which data, and what we are doing about it.
• The KVKK Board. Under KVKK, the data controller must tell the KVKK Board (Kişisel Verileri Koruma Kurulu) about a personal data breach within 72 hours, and tell the people affected as soon as possible. For your customers' data you are the controller, and we give you what you need to do this in time. For data where we are the controller, such as our own contacts and website visitors, we notify the Board ourselves. Where GDPR applies, the same 72-hour rule applies to the EU or UK authority.
• Afterwards. A written report of what happened and what we changed.

KVKK, GDPR and the DPA

For your customers' data, your business is the data controller and WildZero is the data processor. We process it only on your instructions, under a data processing agreement signed before your system goes live. Read the DPA.

Health details are special category data under KVKK (Article 6) and GDPR (Article 9). The assistant says it is an AI assistant in its first reply, and photos, X-rays and health details are shared only with your own team. Where GDPR applies to your customers in the EU or UK, we support you with your duties under it too.

We don't hold a security certification yet. We'd rather say so than show a badge we haven't earned.

Subprocessors

These are the services our systems are built on. The full list, with what each one does and where it stores data, is on the subprocessors page.

• Meta (WhatsApp, Instagram, Messenger): where your customers write to you, and how messages are delivered.
• Zernio: connects WhatsApp, Instagram and Messenger to our system.
• n8n (Germany): runs the workflows that answer, alert and book, hosted in the EU.
• Supabase: the database and file storage, currently in the Tokyo, Japan region.
• Google Gemini: the AI models for replies, translation, language detection, voice notes and speech.
• Anthropic Claude and OpenAI: AI models and speech-to-text used by the interpreter app.
• Telegram: where your staff get alerts and questions.
• Cal.com: appointment booking, only if you switch booking on.
• Cloudflare: this website, security and the interpreter app's server.
• Our email hosting provider: email at wildzero.works.

Several of these providers are outside Turkey, so personal data is transferred abroad. Under KVKK Article 9 (as amended in 2024), we rely on the providers' standard contractual clauses, or on explicit consent where that is required. We tell you before we add or change one.

Your part

• Keep your personal admin and staff codes to yourselves, and don't share one code between people.
• Turn on two-step verification for the phones and accounts your team uses for WhatsApp and Telegram.
• Remove people from your team group on the day they leave.
• Tell us straight away if a work phone is lost or an account looks wrong.

Reporting a security problem

Found a weakness in our website or systems? Write to [email protected]. We reply as soon as we can and keep you updated until it's fixed. Please don't access or change other people's data while testing, and give us time to fix the problem before you tell anyone else. We don't run a paid bug bounty, but we're happy to thank you by name.