Privacy notice
What personal data Sol and Sol Digital process, why, on what legal basis, who receives it and for how long. This notice is given under article 10 of Turkey’s Personal Data Protection Law No. 6698 (KVKK). It is the English version of our Turkish notice. If the two versions differ, the Turkish version prevails.
No lawyer has reviewed this text yet. Our counsel or founders will fill in the square brackets marked with a ring. Once it is approved, this note goes and the date is updated.
Where things stand today
Sol is in development and testing. Tests use only fictional businesses marked “Example” and test accounts. Sol starts talking to a real business’s customers only once the KVKK steps are done: contracts with our suppliers and privacy notices written by counsel. This notice also describes what will happen to your data then.
The company behind Sol
Sol is Sol Digital’s AI assistant. Sol Digital is a product of SolarDetech Bilişim Ltd. Şti.. When this notice says “SolarDetech”, “we” or “us”, it means this company.
- Company
- SolarDetech Bilişim Ltd. Şti.
- Address
- Üniversiteler Mah. 1597 Cad. No: 3 İç Kapı No: 127, Çankaya/Ankara
- Trade registry details
- On request at iletisim@solardetech.com
- Data protection requests
- iletisim@solardetech.com
We assess our duty to register with Turkey’s data controllers’ registry (VERBİS) against the criteria in the law, and will update this notice if that changes.
On whose behalf we process data: two roles
When Sol works for a business: processor
When a business uses Sol, that business is the controller of its customers’ and staff’s data. SolarDetech processes that data on the business’s behalf, on its instructions and under our contract, as a data processor. The business’s own privacy notice then also applies, and you can send requests about your rights to the business. If you write to us instead, we pass your request on and help the business answer it.
For our own contacts: controller
SolarDetech is the controller for data about people who write to us, the contact people at businesses that are our clients, and our suppliers. For people given an account in the Sol app (owners, managers, staff), we process their details on the business’s instructions; for the records needed to keep accounts and sessions secure, we are the controller.
What data we process
When Sol talks to a business’s customers and staff
- Identity and contact details: your name and phone number; if you wrote on WhatsApp, Instagram or Facebook, that account’s name and ID.
- Conversations: the messages you write and Sol’s replies.
- Voice notes: turned into text; the audio file is deleted once the text exists.
- Phone calls: the conversation is turned into text during the call. No audio is recorded; the business keeps a written summary of the call.
- Photos and files: the photos, documents and videos you send.
- Records: bookings, orders, quotes, the status of jobs and approvals.
- Technical data: connection and security logs, such as IP address, date and time.
Please don’t share ID numbers, card details or health information with Sol. Sol doesn’t answer health questions; it leaves them to a person at the business.
When a business connects its Meta accounts to Sol
When a business connects its WhatsApp Business, Instagram or Facebook account to Sol with Facebook Login, we receive from Meta: the name and Meta user ID of the person connecting it; details of the connected Facebook Page, Instagram account and WhatsApp number; and the access token Meta issues to receive and send messages for those accounts. We use them only to bring the business’s incoming messages to Sol, send Sol’s replies, and publish posts a person at the business has approved. We ask Meta only for the permissions these purposes need.
When you write to us or are our client
Your name, contact details, business name and message; for clients and suppliers, also contracts, invoices and correspondence.
This website
This site uses no cookies, analytics, advertising tags or trackers, and loads its font and images from its own server. Like any website, the hosting provider keeps technical logs, such as IP address, date and time and the page requested, to deliver the pages and keep the site secure. We keep these logs only for security and fault investigation, and only as long as that needs.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Sol answering customers for a business and recording bookings, orders and jobs | The business, as controller, sets the legal basis; we process on its instructions. |
| Connecting businesses’ Meta accounts to Sol and running their messaging | Entering into and performing a contract (KVKK art. 5/2-c) |
| Replying to you, preparing offers, running contracts and invoicing | Entering into and performing a contract (art. 5/2-c); our legal obligations (art. 5/2-ç) |
| Keeping the service and the site secure and preventing misuse | Our legitimate interest, provided it does not harm your fundamental rights and freedoms (art. 5/2-f) |
| Measuring and improving the service with de-identified statistics | Data with names, phone numbers, number plates and health details removed. Because this data no longer identifies anyone, it is not personal data. |
How we collect it: electronically, through WhatsApp, Instagram, Facebook, the website chat, phone and email, partly by automated means.
We don’t sell personal data and don’t use it for advertising.
Who receives data, and transfers abroad
We share data only with the suppliers needed to run the service, who process it on our behalf under a contract. The list is not final; our counsel and founders will confirm the suppliers below.
Transfers abroad
The suppliers below process data outside Turkey. Under article 9 of the KVKK this is a transfer abroad. We make these transfers under one of the appropriate safeguards in article 9, for example the standard contract published by Turkey’s Personal Data Protection Board, notified to the Board.
| Supplier | What for | Country |
|---|---|---|
| Anthropic | The AI model that writes Sol’s replies | United States |
| ElevenLabs | Phone calls and turning voice notes into text | United States |
| Image and video generation; Google Business Profile | United States / EU | |
| Meta | Delivering WhatsApp, Instagram and Facebook messages | United States / Ireland |
| Cloudflare | Network connection and secure tunnel (no data is stored) | Worldwide |
Within Turkey
- Netgsm (Turkey), for phone numbers and call forwarding.
- Our accountant and legal advisers, where their work needs it.
- Authorities, only where the law requires it.
How long we keep it
We keep personal data only as long as we need it or the law requires. After that we delete it, destroy it or make it anonymous.
| Data | How long |
|---|---|
| Message text and conversation transcripts | 30 days |
| Voice-note audio | Deleted once it has been turned into text |
| Phone call audio | Not recorded |
| Job photos | 90 days after the job is delivered |
| De-identified statistics (counts, timings, outcomes) | Kept indefinitely; names, phone numbers, number plates and health details are removed, so they identify no one |
| Meta access tokens | Until the business disconnects or the contract ends |
| Enquiries and correspondence with us | As long as needed to answer the request and handle any dispute |
| Contracts and invoices | For the statutory period |
| Website logs | Short-lived technical logs, kept only for security and fault investigation |
| Contact records | 365 days after last activity |
| Approval evidence records (Commit) | 3 years |
AI and decisions
Sol is an AI and says so in the first sentence of every conversation. Sol answers questions, records bookings and orders and takes messages; a message that changes money, time or scope goes out only with the approval of someone with approval rights at the business. We don’t take decisions about you based solely on automated processing.
Your rights under KVKK article 11
By applying to us, or to the business that uses Sol, you can ask:
- whether your personal data is processed;
- for information about it, if it is;
- why it is processed and whether it is used for that purpose;
- which third parties, in Turkey or abroad, it is transferred to;
- to have it corrected if it is incomplete or wrong;
- to have it deleted or destroyed under the conditions in article 7 of the KVKK;
- for third parties who received it to be told about a correction, deletion or destruction;
- to object to an outcome against you that results solely from automated analysis;
- for compensation if you suffer damage because of unlawful processing.
How to apply
- If Sol talked to you for a business, you can apply to that business. If you write to us instead, we pass your request on and help the business answer it.
- You can apply to us in writing, as set out in the Communiqué on the Procedures and Principles for Applications to the Data Controller, at our address (Üniversiteler Mah. 1597 Cad. No: 3 İç Kapı No: 127, Çankaya/Ankara),, or by email to iletisim@solardetech.com from an email address you have already given us and that is in our records.
- Include your full name, your Turkish ID number if you are a Turkish citizen (or your nationality and passport number if not), your postal address, a way to reach you and what you are asking for. Telling us which phone number or account you used with Sol helps us find your data faster.
- We answer within 30 days, free of charge as a rule. If your request causes an extra cost, we may charge the fee in the Board’s tariff.
- If we refuse your request, you find our answer insufficient, or we don’t answer in time, you can complain to the Personal Data Protection Board (KVKK).
If you only want your data deleted, the steps are on the data deletion page.
Consent is asked separately
This notice only informs you; it never asks for your agreement or consent. Where processing rests on your explicit consent, we ask for it separately, with its own text and a box that isn’t ticked in advance. You can withdraw consent at any time.
Security and changes
For now, data is kept on our own server in Turkey: the database and files stay in Turkey. Backups are encrypted and kept for 35 days, with an encrypted offsite copy. Access is limited to authorised people.
When we change this notice, we update this page and the date at the top.