Cookie Policy

This Cookie Policy explains only the cookies and similar tracking technologies used on the https://botfront.com.tr domain, which is the BotFront management panel and website. Since the bot service provided to end users via WhatsApp does not operate through a web browser, it falls outside the scope of this policy.

Operator / Data Controller

With respect to the mandatory and functional cookies used on this website, the data controller is Lumio Studio (contact@lumiostudio.co), which operates the BotFront platform.

Contact

For questions regarding our cookie practices: contact@lumiostudio.co.

The Operator acts as the data controller with respect to the customer firm's own data (login email, subscription/billing and integration information). The session cookies of users logging in to the management panel are also assessed within this scope.

Cookies are small text files that are saved to your device (computer, smartphone or tablet) through your browser when you visit a website. Cookies keep your session active, remember your preferences, and ensure the site operates securely. In this policy, the term "cookie" also covers local storage (localStorage), session storage (sessionStorage) and similar tracking technologies.

Based on their lifespan, cookies are divided into session cookies (those automatically deleted when the browser is closed) and persistent cookies (those that remain on your device for a certain period); based on their source, they are divided into first-party cookies (placed directly by botfront.com.tr) and third-party cookies (placed by different providers).

The use of cookies is carried out in accordance with the relevant legislation, in particular Law No. 6698 on the Protection of Personal Data (KVKK), Electronic Communications Law No. 5809, Law No. 6563 on the Regulation of Electronic Commerce (ETK), and the Personal Data Protection Board's "Guidelines on Cookie Practices".

According to the Personal Data Protection Board's guiding principles, the requirement for explicit consent varies depending on the type of cookie and the purpose of its use:

• Mandatory (strictly necessary) cookies: As they constitute a technical necessity for the proper functioning of the website and the management panel, they do not require explicit consent. The use of these cookies relies on the legal ground that data processing is mandatory for the provision of an information society service requested by the data subject, pursuant to Article 5/2 of the KVKK.
• Functional, analytical and marketing cookies: These cookies, which do not constitute a technical necessity, may only be used in line with the visitor's previously obtained explicit consent (Article 5/1 of the KVKK). Unless explicit consent is given, these cookies are by no means activated.
• Explicit consent is obtained through an affirmative act of approval via the cookie notice area (banner). Refusing cookies is offered through a method as easy as accepting them, and the absence of consent cannot be turned into a precondition or imposition that prevents the use of the service (prohibition of dark patterns).

Pre-ticked boxes, scrolling down the page or continuing to browse the site are not accepted as a valid declaration of explicit consent. Explicit consent is an approval related to a specific matter, based on being informed and expressed with free will, and it can be withdrawn at any time.

In line with the principle of data minimization, the fewest possible cookies are used in the BotFront management panel. The categories of cookies used, their examples and retention periods are detailed below:

• Mandatory session cookie (__session): A persistent cookie typically valid for a maximum of 14 days; it becomes invalid automatically when the user logs out or when this period expires.
• CSRF and authentication (email-link) technical cookies: These are temporary session cookies and are automatically deleted when the relevant security flow is completed or the browser is closed.
• Functional preference records (language, theme, last firm/bot selection): Kept in the browser's localStorage or sessionStorage areas. localStorage records are retained until deleted by the user, while sessionStorage records are retained until the relevant tab or session is closed.

Mandatory Cookies (no consent required)

These are cookies that are mandatory for secure access to the management panel and for session management. The primary example is the '__session' cookie, a server session cookie created by the Firebase Admin SDK and validated on the server side. This cookie is transmitted only with the 'HttpOnly' and 'Secure' flags, authenticates the user's identity and authorizes access to panel pages. Technical cookies used for CSRF/session integrity and for email-link authentication flows also fall within this category. When these cookies are disabled, it is not possible to log in to the panel.

Functional Cookies (with explicit consent)

Used to remember preferences that facilitate the user experience, such as language/localization preferences, panel interface settings (for example, light/dark theme) and the last selected firm/bot mapping. These cookies may be stored in the browser's localStorage or sessionStorage areas and are only activated if you have given your explicit consent.

Analytical Cookies (if any, with explicit consent)

These are cookies that collect usage statistics in order to analyze how the management panel is used and to detect possible technical errors. For this purpose, BotFront currently aims not to use any non-mandatory analytical cookies. Should an analytics solution (for example, product analytics tools) be integrated in the future, these cookies will only run in line with the explicit consent obtained in advance, and this policy will be updated.

Marketing / Targeting Cookies

The BotFront management panel does not use marketing cookies for advertising or retargeting purposes. If the use of such cookies is planned in the future, your explicit consent will be obtained in advance, the relevant category will be added to this list, and any potential cross-border data transfer processes involving third-party advertising providers will be separately stated.

Services are obtained from certain infrastructure providers for the purpose of hosting the management panel and carrying out authentication processes. Since some of these providers' servers are located abroad, cross-border data transfer may take place within the scope of the relevant technical cookies and log records:

Vercel (USA)

This is the cloud infrastructure where the management panel is hosted; mandatory technical cookies and connection records may be generated for the purpose of delivering the site without interruption and ensuring its security.

Google Firebase / Google Cloud (USA/EU)

This is the infrastructure for authentication (email-link), session management (__session) and the control panel; the mandatory cookies required for secure session management are associated with this service provider.

Cross-border data transfers are carried out within the framework of the legal safeguards provided for in Article 9 of the KVKK (such as transfer to countries with an adequacy decision, or, where there is no adequacy decision, the provision of appropriate safeguards such as concluding Standard Contractual Clauses and, where necessary, notifying the Personal Data Protection Board). Providers such as WhatsApp/Meta and Anthropic relate directly to the bot message flow and are not assessed within the scope of panel cookies; those processes are addressed in detail in the Privacy Policy and Data Processing Agreement (DPA) documents.

You can withdraw the consent you have given for non-mandatory (functional or analytical) cookies, or change your preferences, at any time via the cookie preference panel on our website. Withdrawing your consent does not affect the lawfulness of the data processing activities carried out before this action.

You can also manage, delete or completely block cookies directly through the settings of the internet browser you use. In commonly used browsers, the settings for cookie management are located under the following menus:

• Google Chrome: Settings → Privacy and security → Cookies and other site data
• Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data
• Safari: Settings → Privacy → Manage cookies and website data
• Microsoft Edge: Settings → Cookies and site permissions → Manage cookies and site data

Please note that if you block mandatory cookies (for example, the '__session' session cookie) through your browser settings, you will not be able to log in to the management panel and will not be able to benefit from BotFront services. Refusing functional or analytical cookies, on the other hand, does not prevent the basic use of the site; it only results in some personalized conveniences not being remembered.

To the extent that your personal data is processed through cookies, under Article 11 of the KVKK you have the right to: learn whether your personal data is being processed; request information if it has been processed; learn the purpose of the processing and whether the data is used in accordance with its purpose; know the third parties to whom the data is transferred domestically or abroad; request the correction of incomplete or inaccurately processed data; request the deletion or destruction of the data when the statutory conditions are met; and request compensation for any damage you suffer due to the unlawful processing of your data.

To exercise these rights, you can submit a written application to the contact@lumiostudio.co email address. Your applications will be concluded free of charge, in accordance with the procedures set out in the KVKK and the Communiqué on the Procedures and Principles of Application to the Data Controller, as soon as possible and within 30 (thirty) days at the latest, depending on the nature of the request.

This Cookie Policy may be revised from time to time in line with changes in legal legislation or updates to the cookie technologies we use. The most current version of the policy will always be published on this page, and its effective date will be the date specified above. In the event that a new cookie category is introduced, this policy and the cookie preference panel will be updated simultaneously.