This policy says what personal data OXS Bilişim [TBC: full legal name, registered address, MERSİS and tax number] ("OXS", "we") collects through this website, the customer portal and the licence service of Lumate, why, and what rights you have. We are the data controller for this data. Questions: [TBC: privacy contact email].
1. What this policy does not cover: the data inside Lumate
Lumate runs on the customer's own computer or server. What a customer keeps in it (contacts, messages, call transcripts, files, app records) stays there. OXS does not receive it, store it or see it. The customer is the controller of that data and decides what happens to it; Lumate sends parts of it only to the services the customer sets up (the AI providers it chose: Anthropic for the agents, OpenAI for voice and voice notes; its WhatsApp, phone system and email; the websites its agents open; outside systems an admin connects), on the customer's own accounts. If you are a customer's contact and have a question about your data in Lumate, ask that company.
The data flow of Lumate itself is described on the security page.
2. What we collect
| What | Examples | Why |
|---|---|---|
| Your portal account | name, email address, password (only as a hash), two-step sign-in secret, language, last sign-in. Lumate's first run (from 2.3.0) opens or signs in to this account with the user's name, email address, password and company | to give you your account, keep it safe and talk to you about it |
| Your company's account | company name, country, billing email, tax number, the sector you are interested in, invitations to your team | to give you licences and invoices, and to know who the customer is |
| Licences and installs | each install's id, edition, operating system, version, update channel, the name you gave it, a hash of the machine (not the machine's details), the country of its internet address, when it was first and last seen, how updates went | to activate and check licences, offer the right updates, and catch a key used where it should not be |
| The licence's check-ins | counts and codes only: how many companies, users, agents, calls and messages, the database's size, update results. Never names, phone numbers, messages, transcripts or files. | to apply your plan's limits and keep the service working |
| Messages you send us | the contact form and support emails: your name, email address and what you write | to answer you |
| Emails we send | delivery of verification, password reset, licence, billing and service emails; OXS news (you can turn news off) | to run your account; news only while you want it |
| Technical data | the internet address and browser of each request in our server logs; the internet address and browser of each signed-in session; the internet address in our record of account and staff actions (the audit log) | to protect the service against abuse and know who did what |
We do not use advertising or tracking cookies, and we do not sell personal data.
3. Cookies
- Sign-in cookie (
axp_session): keeps you signed in to the portal. Strictly necessary; set when you sign in; it ends after 7 days without use and at most 30 days after you signed in, or when you sign out. - Account choice (
axp_account): remembers which of your companies' accounts the portal shows, when you have more than one. A preference; it lasts a year. - OXS staff have their own sign-in cookie (
axs_session) on the admin side, for at most 12 hours. - Bot protection: the sign-up form may use Cloudflare Turnstile to tell people from bots. It may set its own strictly necessary cookies.
- There are no analytics or advertising cookies, so no cookie banner.
4. Legal bases
Depending on the data: performing our contract with you (accounts, licences, support), our legitimate interest in running a secure service and preventing abuse (logs, install hashes), our legal obligations (invoices and tax records), and your consent where we ask for it (news emails). [TBC: map to KVKK article 5 and GDPR article 6 bases.]
5. Who else handles it
We use a small number of service providers, under contracts that oblige them to protect the data:
- Hosting: our own servers [TBC: location];
- Cloudflare, in front of the website and the services, for delivery and protection against attacks;
- Email delivery: [TBC: email provider];
- Payments: [TBC: payment provider, when paid plans start]. Card details go to the payment provider, never to us.
Some of them may process data outside Türkiye. Where they do, we use the transfer safeguards the law requires [TBC: KVKK article 9 mechanism; standard contractual clauses for the EU].
6. How long we keep it
- Accounts: while the account is open. When you ask us to delete it, we delete it within 30 days, except what we must keep by law (for example invoices, for the period tax law requires).
- Check-ins: each one for 90 days, then only monthly totals per install, kept for 400 days.
- Sessions: a signed-in session's internet address and browser until the session ends.
- The audit log of account and staff actions (with the internet address) is kept apart and cannot be changed or deleted, also when an account is deleted [TBC: retention period and legal basis].
- Server logs: [TBC: e.g. 30 days].
- Messages to support: as long as needed to answer, then [TBC: e.g. 2 years].
7. Security
Passwords are stored only as hashes, licence keys only as hashes, two-step sign-in secrets encrypted. Access to the admin side of OXS Cloud is limited to OXS staff, from the office network, with two-step sign-in, and every action is recorded. No one at OXS can see into a customer's Lumate.
8. Your rights
Under the law that applies to you (such as KVKK article 11 in Türkiye or the GDPR in the EU) you can ask to know what we hold about you, get a copy, correct it, have it deleted, object to or restrict its use, and take it elsewhere. Write to [TBC: privacy contact email]; we answer within 30 days. You can also complain to the data protection authority (in Türkiye the KVKK Board, in the EU the authority of your country).
9. Children
Lumate and OXS Cloud are for companies. We do not knowingly collect data about children.
10. Changes
We will announce changes to this policy on this page and, for important ones, by email before they apply.