Privacy Policy

For Customer account and billing data, the data controller is Devbase OÜ (address: Sepapaja tn 6, 15551 Tallinn, Harju Maakond, Estonia, email: support@lorki.co). For messages and end-user data flowing through a Customer’s own Instagram account, the Customer business is the data controller and Lorki acts as a data processor on the Customer’s instructions.

• Account data: name, email, avatar, business name/sector, phone, address.
• Instagram data: the access token and account ID issued by Meta when you connect your Instagram Business account, plus direct messages, comments and shared post/reel context delivered via the Instagram Messaging API.
• Knowledge base & business data: services/prices, products/inventory, FAQs, assistant configuration.
• Calendar data: availability and appointments, if you connect Google Calendar.
• Payment data: billing runs through Stripe; we never store your card number.
• Usage & log data: login times, IP address, browser info, audit logs, messaging stats.
• Cookies: session and language-preference cookies — see Section 8.

To auto-generate replies to end-user messages, message content and your knowledge-base data are sent to our AI model provider, Anthropic (Claude models), solely to generate the reply; under Anthropic’s commercial API terms this data is not used to train their models. For certain cases (contacts marked “personal”, low confidence, etc.) the AI stays silent and hands the conversation to the business owner.

The Service reads and writes data via the Google Calendar API (calendar.readonly and calendar.events scopes) solely to (a) check your business’s availability and (b) create, update or delete calendar events for appointments booked through end-user conversations. This data is used for no other purpose, is never used for advertising, and is never reviewed by humans except at your request or where required by law.

The use of raw or derived user data received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We share data with the following subprocessors, to the extent necessary to run the Service. Some process data outside your country (notably in the US):

• Supabase — database, auth, file storage.
• Anthropic — AI reply generation (Section 3).
• Meta / Instagram — messaging infrastructure.
• Google — Calendar integration (only if connected; see Section 4).
• Stripe — payment processing and billing.
• Vercel — hosting and server infrastructure.

Transfers to these providers are covered by contractual safeguards (standard contractual clauses or equivalent). We never sell your data or rent it out for marketing.

We retain your data while your account is active and as needed to provide the Service. Deleting your account (Settings → Account) permanently removes associated business, conversation and message data within a reasonable period; data we must retain by law (e.g. billing records) is kept for the legally required period.

From Settings → Account you can, at any time:

• Download a copy of your data as JSON,
• Permanently delete your account and all associated data.

If Turkish data-protection law (KVKK) applies to you, see the separate KVKK notice for your statutory rights.

Data is stored in an isolated database with row-level access control so each business can only reach its own data, transmitted over encrypted (TLS) connections. Admin access is recorded in an audit log. No method of transmission or storage is ever 100% secure.

We use strictly necessary cookies to keep you signed in (Supabase Auth) and to remember your language preference (the locale cookie). We do not use third-party advertising or tracking cookies.

The Service is B2B and is not knowingly directed at or collecting data from anyone under 18.

We may update this policy from time to time. We’ll notify you of material changes through the Service or by email. The current version is always published on this page.

Questions? Reach us at support@lorki.co.