Security and privacy

Client data is yours. The system shows plainly how it protects it.

This page is not a legal commitment; it explains how the system works. The binding texts are the Data Processing Agreement and the KVKK Privacy Notice (KVKK is Türkiye's Personal Data Protection Law), both published in Turkish.

KVKK Privacy Notice (Turkish)Legal documents (Turkish)

Who is responsible for what

For client data, your firm is the data controller. TalyaSmart processes that data only on your firm's instructions, to provide the service, and acts as the data processor. For your firm's own account details (billing, users), TalyaSmart is the data controller.

DATA CONTROLLER

Your firm

Decides what is processed, and why

DATA PROCESSOR

TalyaSmart

Processes data on the firm's instructions, under the DPA

DATA SUBJECT

The client

Exercises their rights against the firm

Separate accounts, separate files

Every firm's account is separate; no firm can see another firm's data. In the client portal, each client sees only their own returns, documents, reports and messages. Within the firm, staff permissions are set by role.

Firm ownerAll clients, settings, permissions
StaffThe clients assigned to them
ClientOnly their own file
KolaySMM supportNothing, by default

Support access: time-limited permission, complete log

The support team can reach firm data only with time-limited permission from the firm owner. When the permission expires, access closes automatically. Every action taken in the meantime is logged, and the firm owner can see the log in the dashboard.

Access log · sampleOct 10, 2026

10:05Firm owner granted 2-hour support access10:12Support: viewed document settings10:19Support: edited the WhatsApp line matching rule12:05Permission expired, access closed

AI agents and approval

Agents produce suggestions and drafts. Finalizing a record, sending a message to a client or approving a document requires staff approval. Who approved, and when, is recorded.

The agent suggests: "Invoice number field read with 64% confidence."

Your staff decide: correct it, approve it or reject it.

Topics still being finalized

Infrastructure details are reviewed every year; the current state is published on this page.

Data hosting location

Data centers in Türkiye; data is not transferred abroad.

Encryption (in transit / at rest)

TLS 1.2 or higher in transit, AES-256 at rest.

Backups and retention

Daily encrypted backups, kept for 30 days. When an account is closed, its data is deleted within 30 days.

Certifications and audits