Version: 1.1
Effective date: 08.11.2026
Data controller: Produck AI Yazılım Danışmanlık Sanayi Ticaret Limited Şirketi (“BiDilek”, “we”, “us”)
Address: Adalet Mah. Manas Bul. Folkart Towers No: 47B İç Kapı No: 2601 Bayraklı / İzmir
Privacy contact: info@teslim.ai
Request channel: info@teslim.ai or the postal address above
1. Purpose and scope
This notice explains the following when you use the BiDilek mobile application and related services:
- who processes your personal data;
- what data is collected;
- the purposes and legal grounds for its use;
- to whom and why it may be transferred;
- how long it is retained;
- your choices and rights under Türkiye's Personal Data Protection Law (KVKK).
BiDilek may offer some or all of phone authentication, communication with contacts, voice calls, real-time speech translation, synthetic speech, optional Voice Clone, dialogue in a shared location, messages, voice messages and conferences. Features not yet available do not start collecting data. If a new feature processes different data, this notice and in-app disclosures are updated before it is enabled.
2. Data controller
The data controller under the KVKK is:
Produck AI Yazılım Danışmanlık Sanayi Ticaret Limited Şirketi
MERSİS No: 0733127284000001
Adalet Mah. Manas Bul. Folkart Towers No: 47B İç Kapı No: 2601 Bayraklı / İzmir
info@teslim.ai
+90 551 520 95 99
Apple, Google/Firebase, payment institutions and other relevant third parties may act as separate data controllers for processing performed for their own purposes, as may users for their own processing. Cloud, translation or support providers serving on our behalf may act as processors under their contracts.
3. Personal data we process
3.1. Account and authentication data
- phone number and country code;
- Firebase authentication information and verification result;
- username/account ID and display name;
- access and refresh tokens;
- creation, sign-in, sign-out and account status information;
- selected application, speech and display languages.
Google Firebase Authentication also processes the phone number and authentication information during phone sign-in. Firebase phone authentication may transmit and retain provided phone numbers in Google systems to prevent abuse.
3.2. Profile data
- name, profile photo/avatar and technical file information;
- initials, language preferences and online/availability status;
- Voice Clone status, voice model ID and selected preview language;
- plan, usage allowance and remaining minutes/credits.
3.3. Device, connection and security data
- an app-generated device ID;
- operating system, application version, device type and basic compatibility information;
- IP address, connection time, session and security events;
- APNs/PushKit, FCM or other applicable notification tokens;
- call delivery, session refresh and abuse prevention records;
- error codes and technical logs.
BiDilek does not currently intend to use advertising IDs or advertising profiles. If analytics or crash reporting tools are added later, this notice and store privacy declarations are updated before data collection starts.
3.4. Address book and contact matching data
With your permission, the application reads names and phone numbers from your device's address book.
- Contact names and address book organisation may be stored in the local app database to display and sort contacts on your device.
- Normalised phone numbers are sent to the matching server to find which contacts use BiDilek.
- Matched users' account IDs, names, languages and avatar IDs may be cached on the device.
- Suitable alternatives, such as manually entering a number to call or add a contact, should be offered without address book access.
When supplying contacts' information, you must meet your notice and lawfulness obligations towards them. BiDilek does not sell address book data for advertising or use it to create independent marketing lists.
3.5. Call and communication metadata
- caller and callee account/phone identifiers;
- call ID, direction, type and translation mode;
- start/end times, duration and answered/missed/termination reasons;
- participants, languages, connection and delivery status;
- billed duration and usage balance;
- blocking, muting and call security preferences.
This information is processed to establish calls, display call history, send notifications, calculate charges/quotas, prevent abuse and investigate disputes.
3.6. Live audio, speech and translation data
During voice calls, face-to-face dialogue or conferences, the following may be processed in real time:
- microphone audio and audio received from the other party;
- audio packets/streams;
- temporary text or phonetic outputs for speech recognition;
- source and target languages;
- machine translation output;
- synthetically generated speech.
Ordinary conversations should not be recorded by default to offer a call recording afterwards. If permanent storage beyond temporary buffers necessary for live audio, translation and transmission is intended, all participants are clearly informed and the necessary legal conditions are met before it starts.
Audio or text sent to real-time translation providers should be used only to recognise, translate and speak the relevant communication. Users' communication content is not used for general-purpose AI training or advertising profiling without separate, optional consent.
3.7. Voice Clone data
When Voice Clone is enabled, the following may be processed:
- a raw voice sample of 15–25 seconds or the duration stated in the app;
- recording file type, size, duration and creation time;
- voice characteristics derived from the audio, model/embedding and voice ID;
- clone status and generated audio previews.
Voice data may qualify as biometric and special-category personal data insofar as it undergoes technical processing to uniquely identify or authenticate a person. BiDilek's Voice Clone feature must not be used for authentication; the voice model is nevertheless protected as highly sensitive data.
Voice Clone is optional. A separate notice and, where necessary, specific and withdrawable explicit consent are obtained when enabling it. Refusing Voice Clone should not prevent a basic account or calls without cloning. Withdrawing consent stops new synthetic speech generation and starts deletion of your voice model.
3.8. Messages, voice messages and shared content
When these features are offered, the following may be processed:
- message text, voice messages, photos, videos, files and captions;
- sender, recipient and conversation/conference ID;
- sending, delivery, reading, deletion and error times;
- reply, translation, transcript and synthetic speech preferences;
- spam, blocking and reporting information.
The encryption, server retention and backup model for messages is clearly disclosed before the feature launches. No end-to-end encryption claim is made unless it is technically active and verified.
3.9. Payment, subscription and usage data
- selected plan, subscription status, renewal and usage period;
- used/remaining minutes or credits;
- store, order and transaction IDs;
- purchase verification result, currency, amount and tax information;
- refund, cancellation and support records.
Full card details are processed by Apple App Store, Google Play or an authorised payment institution; BiDilek aims not to store card numbers directly. If web payments are offered in production, the provider and data flow must be added to this notice.
3.10. Support, request and complaint data
When you contact us, your contact details, request, attachments, support correspondence, transaction records and request outcome may be processed.
We recommend not entering health, religion, political opinions or similar sensitive information in free text, message or audio fields. We do not specifically request such data where it is unnecessary for the Service's purpose.
4. How we obtain data
We obtain data electronically and partly through automated means:
- directly from you and permitted areas of your device;
- from other BiDilek users you communicate with;
- from Firebase, Apple, Google, payment institutions and notification services;
- from automatic technical records during interaction with the Services;
- from legally authorised authorities.
5. Processing purposes and legal grounds
Under Articles 5, 6 and other relevant provisions of the KVKK, data may be processed for the following purposes and on these grounds:
| Purpose | Main data groups | Legal ground |
|---|---|---|
| Account creation, sign-in and session management | Phone, Firebase verification, account and device IDs | Formation/performance of a contract; legal obligation; legitimate interests |
| Calls, messages, conferences and communication delivery | Communication content, metadata, push token | Contract performance; processing at your request |
| Real-time speech recognition, translation and speech output | Live audio, temporary transcript, language and synthetic speech | Contract performance for the feature; explicit consent where necessary |
| Voice Clone creation and use | Raw audio, voice model, voice ID | Separate explicit consent and/or applicable processing condition under KVKK Article 6; provision of the feature |
| Contact matching | Phone numbers, local contact name | Your permission/request; contract performance; legal ground appropriate to the specific flow |
| Profile and personalisation | Name, avatar, language and appearance preferences | Contract performance; legitimate interests |
| Security, fraud and abuse prevention | Device, IP, session, blocking and logs | Legitimate interests; legal obligation; establishment, exercise or protection of a right |
| Fees, quotas and subscription management | Plan, usage and transaction information | Contract performance; legal obligation |
| Support and dispute management | Correspondence, account, technical and transaction records | Contract performance; legitimate interests; establishment, exercise or protection of a right |
| Responding to legal requests | Relevant records | Legal obligation; express provisions of law |
Processing based on legitimate interests is subject to a balancing test against your fundamental rights and freedoms. If explicit consent is withheld and no other legal ground exists, the relevant optional processing is not performed.
Providing information and obtaining explicit consent are separate processes. Acknowledging this notice does not constitute explicit consent to Voice Clone, marketing or other optional activities.
6. Who we may share data with
We may share data with the following recipient groups only as necessary for the relevant purpose:
- Users you communicate with: your name, avatar, language, availability and content you send;
- Authentication and notification providers: Google Firebase Authentication/Cloud Messaging, Apple APNs/PushKit and, where applicable, Expo notification infrastructure;
- Cloud and infrastructure providers: server, database, file, security, monitoring and backup services;
- Speech and AI providers: speech recognition, translation, synthetic speech and Voice Clone — Soniox (speech recognition and translation, USA) and Cartesia (synthetic speech and Voice Clone, USA);
- Communication infrastructure providers: WebRTC/STUN/TURN and call relay services — Google STUN servers (USA) and TURN servers running in our cloud infrastructure;
- Payment and store providers: Apple and Google;
- Professional advisers and support services: only under confidentiality obligations;
- Authorised public authorities and courts: upon valid, lawful requests;
- Parties to a business transfer/reorganisation: under necessary confidentiality and legal safeguards.
We do not sell personal data. We do not share personal communication content for third parties' independent advertising profiles.
All processors and subprocessors, including name, service, country, data category and retention role, are published in a public Subprocessor List: https://bidilek.ai/subprocessors/.
7. International data transfers
Servers of Firebase, Apple, Google, cloud, speech recognition, translation or synthetic speech providers may be outside Türkiye. Your personal data may therefore be transferred abroad.
International transfers rely on a valid mechanism under KVKK Article 9 and the relevant regulation, such as an adequacy decision, standard contracts published by the Board, binding corporate rules or applicable exceptions. Where standard contracts are used, the required notification to the Authority is made on time.
Transfer details: Your data may be transferred to provider server locations, particularly the United States of America. Recipients are Google (Firebase Authentication, Firebase Cloud Messaging, STUN), Apple (APNs/PushKit), Soniox and Cartesia. Transferred categories include phone number and authentication information, notification tokens, connection information, live speech audio, transcripts and translation outputs, and Voice Clone samples and models. Purposes are authentication, notification delivery, call connection, real-time speech recognition, translation, speech output and Voice Clone services. Transfers rely on standard contracts published by the Board under KVKK Article 9, with required notifications to the Authority made on time.
8. Retention and deletion periods
We do not retain data longer than necessary for its purpose or required by law. The following table describes the proposed maximum retention policy for the product; it must not be published before production servers and provider agreements are technically aligned with these periods.
| Data | Proposed retention period / deletion rule |
|---|---|
| Active account and profile | While the account is open; within 30 days of a deletion request in active systems |
| Deleted account in secure backups | Up to 90 days; not restored for normal use during that period |
| Firebase/session tokens | Until the session ends, is revoked or technically expires |
| Push/VoIP tokens | While device registration is active; removed on sign-out, revocation or account deletion; inactive tokens cleaned within 90 days |
| Address book number matching request | As long as matching requires; not retained as an independent marketing list |
| Device address book cache | Kept on the device until account deletion; no new contacts read after address book permission is revoked |
| Live call audio and temporary translation buffers | Real-time processing period; no permanent call recording; error buffers, if necessary, up to 24 hours with restricted access |
| Raw Voice Clone sample | Up to 12 months after successful model creation; within 7 days if cloning fails. Deleted earlier when consent is withdrawn, the voice clone is deleted or the account is deleted. |
| Voice model/embedding and voice ID | Until the user deletes the feature, withdraws consent or deletes the account; from backups within 90 days |
| Call metadata and usage accounting | 12 months for history and dispute/security purposes |
| Undelivered message/voice message | Up to 30 days for delivery, then deletion |
| Delivered message content | Until user deletion or removal from the server after delivery, depending on the declared messaging architecture; to be clarified before launch |
| Security and access logs | 12 months |
| Support records | 3 years after the request is closed |
| Invoices and mandatory financial records | For the period required by relevant tax/commercial legislation |
For disputes, fraud investigations, legal measures or authorised authority requests, relevant records may be kept longer only to the necessary extent. On expiry, data is deleted, destroyed or anonymised.
9. Account and data deletion
You can delete your account through Profile/Settings → Delete account. This:
- stops use of the account;
- starts deletion of the profile, avatar, contact matches, in-app history, push registrations and Voice Clone;
- clears account-related local cache and session information on the device.
Messages or audio delivered to other users' devices, their lawful copies, or financial/security records required by law may not be immediately recalled. These exceptions are clearly limited.
Account deletion may not automatically cancel an Apple/Google store subscription. Cancel your store subscription separately.
If you cannot access in-app deletion, you can submit a request to info@teslim.ai.
10. Choices, permissions and withdrawing consent
- Microphone: Disable it in operating system settings; calls, translation and recording will not work.
- Contacts: Revoke address book permission in operating system settings; the address book will not be read again. Previously imported device contacts are cleared when you delete your account. You can also request deletion at info@teslim.ai.
- Photos/camera: Revoke permission; you will not be able to select new avatars/media.
- Notifications: Change them in operating system settings. iOS VoIP call delivery may technically differ from ordinary notification preferences.
- Voice Clone: Delete your voice model and withdraw explicit consent within the app.
- Marketing: Separate choices are offered for each channel, if applicable; service messages do not depend on marketing consent.
Withdrawal of explicit consent takes effect going forward. It does not invalidate lawful processing based on consent before withdrawal.
11. Your rights under the KVKK
Under KVKK Article 11, you may contact us to:
- learn whether your personal data is processed;
- request information if it has been processed;
- learn the processing purpose and whether use matches that purpose;
- learn the third parties receiving data in Türkiye or abroad;
- request correction of incomplete or inaccurate data and notification of recipients;
- request deletion/destruction when processing grounds cease and notification of recipients;
- object to a result against you arising exclusively from automated analysis;
- seek compensation for damage caused by unlawful processing.
You may submit requests to info@teslim.ai, in writing to the postal address above, by secure electronic signature, mobile signature, email registered in our system or other legally permitted methods. We may request proportionate additional information to verify identity. Requests are answered within statutory periods and normally free of charge, subject to costs permitted by the Board's tariff.
12. Security
We apply technical and organisational measures proportionate to risk. Where appropriate, these include:
- encryption in transit;
- storing session tokens in operating system secure storage;
- role-based and least-privilege access;
- access logs, rate limiting and abuse detection;
- separation of development/test and production environments;
- data minimisation and deletion at the end of defined periods;
- provider security and confidentiality agreements;
- incident response and breach notification procedures.
No system guarantees absolute security. If a personal data breach affects your rights and freedoms, required notifications are made to the Board and affected people under applicable law.
13. Children's data
The Services are not directed at children. If you believe we knowingly created a child's account or process a child's data without necessary parental/legal representative consent, notify info@teslim.ai. After verification, we delete the account and relevant data in accordance with legislation.
14. Other people's data
Contact matching, conference invitations, calls or translation in a shared location may process phone numbers or voices of people who are not yet BiDilek users. These activities must be purpose-limited and follow data minimisation.
Where possible, the app should visibly or audibly inform participants that translation/synthetic speech is used. Users must also inform people in the conversation and obtain necessary permissions; this does not remove BiDilek's own notice obligations as controller.
15. Automated decisions and AI
Speech recognition, translation, spam/security detection and synthetic speech generation may use automated systems. Automatic translation can be incorrect. BiDilek does not aim to make decisions producing legal or similarly significant effects about users solely through automated processing.
If such a mechanism is introduced, its logic, effects, objection procedures and human review options are explained beforehand.
16. Changes to this notice
We update this notice when services, providers, purposes, legal grounds or retention periods change. Material changes are communicated in the app or through an appropriate contact channel. If new explicit consent is required, a separate choice is requested; silence or continued general use alone does not constitute explicit consent.
Current and previous versions are published at https://bidilek.ai/en/privacy/.
17. Contact and requests
Data controller: Produck AI Yazılım Danışmanlık Sanayi Ticaret Limited Şirketi
Address: Adalet Mah. Manas Bul. Folkart Towers No: 47B İç Kapı No: 2601 Bayraklı / İzmir
Privacy/KVKK: info@teslim.ai
Phone: +90 551 520 95 99
Your right to complain about personal data and to apply to the Personal Data Protection Board remains unaffected.