Privacy Policy
Last updated: 2026-10-06
In short
- Zeldina is an AI shopping assistant that online stores add to their websites.
- For a store's shoppers, we act on behalf of the store. We store chat conversations for 12 months, then delete them automatically.
- We don't use cookies in the assistant, we don't sell personal data, and we don't use it for advertising.
- Conversations are processed by our AI provider only to generate answers. They are not used to train AI models.
1. Who we are
Zeldina is operated by Zeldina ("Zeldina", "we", "us"). You can reach us about privacy at [email protected].
This policy explains how we handle personal data when:
- you use our website zeldina.com,
- you run a store that uses Zeldina (a "merchant"), or
- you chat with the Zeldina assistant on a store's website (a "shopper").
2. Our role
- Merchants and website visitors: we decide how your data is used. We are the controller (in Türkiye, the "data controller" under KVKK).
- Shoppers: the store you are shopping at decides how your data is used. We process it on the store's behalf as a processor, under our Data Processing Agreement with the store. For privacy requests, please contact the store first. If you contact us, we will forward your request to the store and help it respond.
3. What we collect
Merchants
- Account details: name, email address, password (stored only as a one-way hash), and preferred language.
- Store connection: store address and the access credentials your platform (Shopify, WooCommerce, Ticimax and others) issues to us. Credentials are encrypted with AES-256.
- Store content: products, prices, stock, collections and discounts, which we use to answer shoppers.
- Billing records: plan, credit usage and payments.
- Support: messages you send us.
Shoppers
- A random visitor identifier: stored in your browser's local storage so a conversation can continue across pages. It is not a cookie and does not identify you by name.
- Conversations: the messages you write or say, the assistant's answers, the language you use, and any preferences you mention (for example, size or budget).
- Voice: if you use voice chat, your audio is streamed in real time to our AI provider to understand you and to answer. We do not record or store audio. We keep only the text of the conversation.
- Interactions: opening the assistant, products shown, products clicked and items added to cart. We use these to show the store how the assistant performs.
- Orders: if you buy after chatting, the store's platform tells us the order number, total and currency, linked to the conversation. We do not receive your name, address or payment details.
- Order status questions: if you ask about an order, you give the assistant your order number and email. We check them against the store's records in real time and do not store them separately. They remain part of the conversation text.
- Technical data: IP address and browser information. We process these to deliver the service, prevent abuse and keep server logs.
Website visitors
Our website uses no analytics or advertising cookies. Our servers keep standard access logs (IP address, page, time and browser) for security.
4. Why we use it and our legal basis
| Purpose | Legal basis (GDPR / KVKK) |
|---|---|
| Providing the assistant and the merchant panel | Contract with the merchant (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)). For shoppers: the store's instructions. |
| Billing, accounting and tax | Legal obligation (Art. 6(1)(c); KVKK Art. 5(2)(ç)) |
| Security, abuse prevention and fixing errors | Legitimate interest (Art. 6(1)(f); KVKK Art. 5(2)(f)) |
| Measuring and improving answer quality | Legitimate interest. Used only for the store's own reports and our service quality, never for profiling individuals. |
| Service emails (verification, credit and billing notices) | Contract with the merchant |
We do not use personal data for advertising. We do not sell or rent it. We do not make automated decisions that have legal or similarly significant effects on anyone.
5. How the AI works with your data
To answer a shopper, we send the conversation and the relevant product information to our AI provider, OpenAI. Under its API terms:
- this data is not used to train its models,
- we ask it not to keep conversation state where the API allows this,
- it may keep data for up to 30 days to detect abuse, then deletes it.
AI answers can be wrong. Prices and stock are checked against the store before products are shown or added to cart. The store's checkout is always final.
6. Who we share data with
We use these service providers (sub-processors). Each one receives only what it needs:
| Provider | Purpose | Location |
|---|---|---|
| VeriUp Bulut İnternet Hizmetleri A.Ş. | Server hosting and database | Türkiye |
| OpenAI, L.L.C. | Generating answers, voice chat, product analysis | United States |
| Cloudflare, Inc. | Network delivery and security (traffic passes through) | Global |
| Google LLC (Google Workspace) | Sending service emails | Global |
We also exchange data with the store's own e-commerce platform (for example, Shopify) on the store's instructions. We may disclose data if the law requires it. If our business is ever transferred, data would move only under this policy's protections. We will inform merchants about new sub-processors in advance.
7. International transfers
Our servers are in Türkiye. Some providers process data in other countries, including the United States. For those transfers we rely on safeguards required by law, such as standard contractual clauses under the GDPR and the standard contracts required by Article 9 of KVKK.
8. How long we keep it
| Data | Retention |
|---|---|
| Shopper conversations and interactions | 12 months, then deleted automatically. A store can ask for earlier deletion. |
| Order attribution (order number, total, linked conversation) | The link to the conversation is removed when the conversation is deleted. The order total remains in the store's anonymous sales statistics. |
| Merchant account and store data | While the account is active. Deleted within 90 days after the account is closed or the app is uninstalled. On Shopify, store data is deleted when Shopify sends the shop deletion request, 48 hours after uninstall. |
| Store access credentials | Deleted immediately when the app is uninstalled |
| Billing and invoice records | As long as tax and commercial law requires (up to 10 years in Türkiye) |
| Server logs | Up to 30 days |
| Encrypted backups | Daily backups for 14 days, monthly backups for 12 months. Deleted data disappears from backups as they expire. |
9. Security
We protect data with:
- encryption in transit (TLS) and encryption of credentials and backups (AES-256),
- strict access control and two-factor authentication for administrative access,
- logging of access to personal data,
- separate test and production environments.
Details and our incident response commitments are on our Security page.
10. Your rights
Depending on where you live, you can ask us to:
- access your data,
- correct it,
- delete it,
- restrict its use,
- receive a portable copy of it,
- stop processing it (object).
Under KVKK Article 11 you also have the right to:
- learn whether your data is processed and for what purpose,
- know the third parties who receive it,
- object to a result that arises solely from automated processing,
- claim compensation for unlawful processing.
- Merchants: write to [email protected].
- Shoppers: contact the store. Stores can export or delete your conversations through us. When a store receives your request through its platform (for example, Shopify's customer data request), we carry it out automatically.
We answer within 30 days. You also have the right to complain to a data protection authority. In Türkiye this is the Kişisel Verileri Koruma Kurumu. In the EU, it is the authority in your country.
11. Children
Zeldina is not directed at children under 16. We do not knowingly collect their data.
12. Changes
We will post updates on this page. We will tell merchants by email before material changes take effect.
13. Contact
Zeldina
[email protected]