Last updated: 25 October 2026
This policy explains how we protect your privacy when you visit 28assist, contact us, or message a business that uses 28assist.
1. Scope
This policy covers the 28assist website provided by Süleyman Girgin (28sec), its demo request and contact forms, and the 28assist platform that businesses use by connecting their WhatsApp, Instagram and Facebook Messenger accounts and their website chat widget. Third-party websites are subject to their own privacy policies.
2. Information We Collect
When you use the demo or contact form, we may collect your name, company name, business email, phone number, the solution you are interested in and your message. When you visit the site, technical records such as IP address, device and browser type, access time, pages viewed, referral information and cookie preferences may be created. Data processed when you message a business that uses 28assist is described in Section 6.
3. How We Use Information
We use information to respond to your requests, schedule demo meetings, improve our services, keep the site secure, fix technical issues and meet our legal obligations. Your information is processed in a way that is relevant, limited and proportionate to these purposes.
4. Cookies
Strictly necessary cookies keep the site secure and working correctly. Where non-essential cookies for preferences, analytics or marketing are used, your choice is collected through the cookie management tool as required by applicable law. You can also manage cookies in your browser settings; blocking some cookies may affect site functions.
5. Sharing and Service Providers
Information may be shared with hosting, email, security, infrastructure and technical support providers to the extent necessary to provide the service. Personal data is never sold. Lawful requests from authorised public bodies may be fulfilled.
6. Data Processed Through Messaging Channels
28assist is a software service that lets businesses manage their WhatsApp, Instagram, Facebook Messenger and website chat conversations, and comments on their Instagram and Facebook posts, from a single dashboard. This section explains how your data is processed when you message a business that uses 28assist or comment on one of its posts.
Roles. The business you message is the data controller for your personal data. Süleyman Girgin (28sec) acts as a data processor on behalf of, and under the instructions of, that business.
Data we process.
- Your WhatsApp phone number; your WhatsApp, Instagram or Messenger username and user ID; and the name, profile photo and profile information shared by these platforms
- The name, phone number and other details you enter in the website chat widget
- The content of your messages and the files you send (photos, videos, audio, documents, locations)
- Comments you write on the business’s Instagram or Facebook posts
- When messages were sent, delivered and read
- If you reached the business through an ad, information about that ad
- Your consent to receive WhatsApp campaign messages, and any opt-out requests
- Notes and tags added by the business’s staff about the conversation
Source. This data is sent to us by Meta Platforms (WhatsApp Business Platform, Instagram API, Messenger Platform) under the permission granted by the business. For the website chat widget, it is collected directly from you. 28assist does not access any other data in your account, such as your followers, your own posts or your conversations with others.
Purposes.
- Delivering your messages to the business and its replies to you
- Replying to comments on the business’s posts
- Depending on the business’s settings, AI-generated reply suggestions for its staff or AI replies sent directly to you
- If you have consented, WhatsApp campaign messages from the business
- Measuring service quality, such as response times
- Security and abuse prevention
Your data is not used for advertising or profiling and is never sold.
Artificial intelligence. If the business has enabled this feature, message content is sent to an AI service provider (Google Gemini) to generate replies. Depending on the business’s settings, the AI either suggests replies to staff or replies to you directly. Replies are based on information defined by the business. Conversations the AI cannot answer are handed over to a staff member. The AI service provider does not use this data to train its models.
Retention.
- Data is kept while the business’s 28assist account is active and can be deleted by the business.
- Raw notifications received from Meta are deleted automatically after 30 days.
- If the business’s account is closed, either at the business’s request or by 28assist because no payment was made after the trial or subscription ended, all of its data is permanently deleted 90 days after the closure. The business can withdraw the closure during this period.
- Deleted data also expires from backups automatically within 90 days at the latest.
International transfers. To provide the service, this data is transferred to service providers outside Türkiye:
- Hosting: Hetzner, Germany
- Content delivery and file storage: Cloudflare, USA
- AI (only if the business has enabled it): Google, USA
- Mobile notifications to the business’s staff (only your name and the name of the channel you wrote through; message content is never sent): Apple, Google and Expo, USA
Transfers are made under the safeguards described in Section 7.
Your rights. You can exercise your rights under Article 11 of the Turkish Personal Data Protection Law (KVKK) against the business, which is the data controller. If you send your request to us, we will forward it to the business. See the Data Deletion page for how to request deletion of your data.
6A. 28assist Mobile App and Platform Users
This section explains the data processed through the web panel and the iOS / Android mobile app for employees (admins, supervisors and operators) of businesses that use 28assist. Your account is created by the business you work for; you cannot sign up in the app.
Data we process.
- Your name, email address and, if you upload one, your profile photo
- Messages you write to customers, internal notes and files you send
- Photos you take with the camera and photos or videos you pick from your library — only when you send them
- Your location — only when you choose “Send location” and allow it; never in the background
- Your device’s notification token (push token), so we can send you notifications; they are delivered through Apple (APNs), Google (Firebase Cloud Messaging) and Expo
- App version, operating system, device language and the last time the app was opened
- A crash report when the app crashes (error message, device model, operating system and app version). Crash reports do not include your name, email, IP address, message content or screenshots; they are stored by Sentry in Germany.
We use this data to provide the service, send you notifications and fix errors. The app has no ads, no advertising identifier and no tracking; data is never sold. You can turn camera, photo library, location and notification access off at any time in your device settings.
You can ask for your account to be deleted in the app under Settings → Profile → Delete my account, or as described on the Data Deletion page.
7. International Transfers
Where a service provider we use is located outside Türkiye or accesses data from abroad, the transfer is carried out in line with applicable data protection law and the appropriate safeguards set out in Article 9 of the KVKK.
8. Retention and Security
Information is kept for as long as necessary to handle the related request and to meet legal obligations. Appropriate security measures such as access control, logging and up-to-date software are applied. Please note that no method of transmission over the internet is completely secure.
9. Your Rights and Contact
For requests about your personal data, contact us at info@28assist.com. For more details, see the KVKK Privacy Notice. To request deletion of your data, see the Data Deletion page.
10. Policy Updates
This policy may be updated to reflect changes in our services or the law. The current version applies from the date it is published on this page.