Privacy Policy
Kalagh is a shared inbox for the channels your customers already use. That means we handle real conversations, so this page says plainly what we collect, exactly which permissions each connected service grants us, what we do and never do with them, and how to get your data back or erased.
- Last updated
- 26 September 2026
- Effective
- 26 September 2026
Who we are, and what this policy covers
Kalagh is an omnichannel customer-messaging platform operated by AchaSoft ("AchaSoft", "we", "us"), based in Gayrettepe, Istanbul, Türkiye. Kalagh is offered internationally, so this policy is written to meet the Turkish Personal Data Protection Law (KVKK, Law No. 6698), the EU and UK GDPR, and the California Consumer Privacy Act as amended by the CPRA.
It covers the website kalagh.chat, the Kalagh application at app.kalagh.chat, the API at api.kalagh.chat and the realtime service at socket.kalagh.chat.
Two different roles matter throughout this document:
- We are the controller
- for Kalagh account data — the names, email addresses, sign-in records and settings of the people who use Kalagh, and of anyone who contacts us through this website.
- We are the processor
- for the conversations, contacts, files and messages a business manages inside Kalagh. There, our business customer is the controller: it decides what to collect from its own customers and why, and we process it on its instructions and under our agreement with it.
If you are an end customer who messaged a business through WhatsApp, email or any other channel it connected, that business decides what happens to your conversation. Ask it first; if you cannot reach it, write to us at [email protected] and we will pass your request on and help it respond.
Information we collect
- Account data: your name and email address, a password stored only as an argon2 hash, the six-digit codes we email to verify an address or reset a password, and — if you use Sign in with Google — the Google account id, email address, verified-email flag, name and profile picture Google returns.
- Organisation data: the organisation name, its members and their roles, and the settings and channels the organisation configures.
- Data from the channels you connect: the messages, conversations, contact details, attachments, media and delivery metadata that arrive at or are sent from the channels you connect. What that includes depends on the channel, and section 3 says so for each one.
- Usage and technical data: the technical records our services produce in order to run: sign-in and session records, message delivery and error logs, inbound webhook journals, the outbound message queue, and automation run history (including the truncated AI prompts and responses kept for usage and budget reporting).
- Payment data: for organisations that collect payments from their own customers, we keep the masked card number, the cardholder name, the payer’s email address and phone number, and the gateway’s responses. The full card number and CVV pass through to the bank for 3-D Secure and are never stored by Kalagh.
- Website chat widget: visitors chat anonymously — no account is needed. The widget keeps a visitor id in the local storage of the site it is embedded in, so the same visitor’s thread continues, and it collects what the visitor writes plus anything a form inside the chat asks for.
- Enquiries: what you send us through a form on this website or by email, so we can answer you.
We never ask you for special-category data — health, biometrics, beliefs — and no Kalagh feature requires it. Whatever of that kind arrives inside a conversation is content you and your customers control, and it is subject to your own lawful basis for collecting it.
Third-party services you connect
Kalagh reaches an external service only when someone in your organisation connects it, through that service’s own OAuth or pairing flow. Every permission we request is listed below with the feature it exists for, so you can match this page line by line against the consent screen you are shown.
Two of these connections use our application registration (Gmail and Microsoft mail, because they are a product feature) and two use your own (Google Drive and Dropbox, because the File Manager reaches into storage you already own). Where it is yours, you enter your own client id and secret and you can revoke it at any moment without us.
Gmail
Connecting a Gmail mailbox turns it into an email channel: its threads appear as conversations in your shared team inbox, and your agents read and reply to them without leaving Kalagh. This uses Kalagh’s own Google OAuth application, and we request offline access (a refresh token) so the mailbox keeps syncing without asking someone to sign in again every hour.
openidIdentifies the Google account being connected.emailReads the mailbox address, so the channel is labelled correctly and replies are sent from the right identity.profileReads the account’s name and picture, shown on the connected channel.https://www.googleapis.com/auth/gmail.modifyReads your messages and their attachments, and marks a message as read (removes the UNREAD label) when an agent opens it in Kalagh so the two stay in step. This is the narrowest scope Google offers that both reads a mailbox and changes a label. Kalagh never deletes, trashes or archives your mail.https://www.googleapis.com/auth/gmail.sendSends the replies and new emails your agents compose in Kalagh, with their attachments. Nothing is ever sent that your team or your own automation did not write.
- What we access
- new mail through Gmail push notifications (a watch on the inbox) and Gmail history; the full content of those messages including attachments; and, once when you connect, an import of recent inbox history — up to 200 messages by default — so your inbox is not empty on the first day.
- Why
- to show the mailbox as conversations in the shared inbox, to send the replies your agents write, and to keep read state consistent between Gmail and Kalagh.
- What we store
- the messages and attachments, as conversations in Kalagh’s database and object storage, and the OAuth tokens, encrypted at rest.
- What we never do
- we never delete or trash your mail, never send anything your team or your automations did not compose, never use Gmail data for advertising, and never use it to train AI models. If you delete a message in Gmail, Kalagh follows Gmail and removes it too — never the other way round.
- How to disconnect
- delete the Gmail channel in Kalagh, or revoke Kalagh at myaccount.google.com/permissions. Deleting the channel stops the Gmail watch, revokes the token at Google, and deletes the stored tokens together with that channel’s conversations, messages and media. Contacts are kept unless you erase them separately with the in-app Privacy tools (section 9).
Google Drive
The Kalagh File Manager can use a Google Drive folder as a storage source, so your team can browse, upload, download, rename and delete the files it already keeps in Drive from inside Kalagh and attach them to a conversation. Drive is connected with your own Google OAuth client — you enter the client id and secret from your own Google Cloud project — so this access is between your organisation and your Drive.
https://www.googleapis.com/auth/driveLists, opens, uploads, renames, moves and deletes files in the Drive folder your organisation chooses, which is exactly what the File Manager offers. A narrower scope such asdrive.filereaches only files the application itself created, so it cannot list the folder you already have — which is the whole feature.
- What we access
- the file and folder listings of the Drive you connect, fetched live when someone opens the File Manager, and the content of a file only when it is opened, downloaded or attached.
- What we store
- the OAuth tokens and the client secret you entered, both encrypted at rest, plus the source’s settings. File listings are read live and are not copied into Kalagh.
- Deleting a file
- deleting from the File Manager moves the file to your Drive’s trash, where you can restore it. Kalagh never permanently erases Drive content.
- How to disconnect
- remove the storage source in Kalagh: its tokens are revoked at Google and deleted along with the client secret. You can also revoke the app in your own Google account.
Sign in with Google
Sign in with Google is an identity check for the Kalagh account and nothing else. It requests no offline access, keeps no refresh token, and calls no Google API afterwards.
openidAuthenticates you and returns your Google account identifier.emailReturns your email address and whether Google has verified it, so we can create or match your Kalagh account. An unverified address is refused.profileReturns your name and profile picture, shown in the application.
- How to disconnect
- remove Kalagh at myaccount.google.com/permissions. Your Kalagh account stays; sign in with your email address and a password instead.
Microsoft Outlook / Microsoft 365
An Outlook or Microsoft 365 mailbox connects as an email channel in the same way Gmail does, through Kalagh’s own Microsoft application and Microsoft Graph.
openidIdentifies the Microsoft account being connected.emailReads the mailbox address, so the channel is labelled correctly.profileReads the account’s basic profile, shown on the connected channel.offline_accessKeeps the mailbox syncing without asking someone to sign in again.Mail.ReadWriteReads your messages and attachments and marks a message as read when an agent opens it in Kalagh. Microsoft Graph has no scope that reads mail and sets a flag without also granting write, so this is the least we can ask for. Kalagh never deletes or moves your mail.Mail.SendSends the replies your agents compose. Sent mail is saved in your own Sent Items, so your mailbox stays the record.User.ReadReads the signed-in user’s name and mailbox address for the connection itself.
- What we access
- new mail through Graph change notifications (a subscription), an import of recent inbox history when you connect, and the content of those messages including attachments.
- What we store
- the messages and attachments as conversations, and the OAuth tokens, encrypted at rest.
- How to disconnect
- delete the channel in Kalagh: the Graph subscription is deleted, the stored tokens are deleted, and that channel’s conversations, messages and media go with them. You can also remove Kalagh from the connected applications of your Microsoft account or have your tenant administrator revoke it.
Dropbox
Dropbox is the File Manager’s other storage source, and it works the same way as Drive: you connect it with your own Dropbox app key and secret, and your team works with files that stay in your Dropbox.
- Permissions
- whatever your own Dropbox app is configured with. For the File Manager’s features that means listing files and folders, uploading, downloading, deleting, moving and renaming, and reading the account information used by the connection test. Offline access keeps the connection alive.
- What we store
- the tokens and the app secret you entered, encrypted at rest. Listings are read live and not copied into Kalagh.
- How to disconnect
- remove the storage source in Kalagh, which revokes and deletes the tokens; you can also disconnect Kalagh in your Dropbox account settings.
Facebook Messenger & Instagram
Kalagh’s Meta application lets your team answer Facebook Page messages and Instagram Direct messages in the shared inbox. You choose which Page or Instagram business account to connect during the flow, and Kalagh reaches no other Page.
pages_show_listLists the Pages you manage, so you can pick one.pages_messagingReceives the messages sent to that Page and sends your replies.pages_messaging_subscriptionsKeeps the message subscription for that Page alive, so a message that arrives while nobody is looking still reaches your inbox.pages_manage_metadataSubscribes the app to the Page’s messaging webhooks and removes that subscription again when you disconnect.instagram_basicReads the Instagram business account linked to the Page — its id, username and picture — so the channel can be labelled.instagram_manage_messagesReceives Instagram Direct messages for that account and sends your replies.business_managementResolves which business assets the connecting user is allowed to link, which is what Meta requires for an Instagram messaging connection.
- What we access
- the Pages and Instagram business accounts you select, and the messages people send them, including attachments.
- What we store
- those conversations, messages and media, and the Page access token — long-lived and refreshed automatically — encrypted at rest.
- How to disconnect
- delete the channel in Kalagh: the app is unsubscribed from the Page and the token is deleted with the channel’s data. You can also remove Kalagh in your Page or Business settings, or in your Facebook account’s Business Integrations.
WhatsApp is connected by scanning a QR code with your phone, exactly as WhatsApp Web does: Kalagh becomes a linked device of that WhatsApp account. There is no Meta Cloud API in between.
A linked device receives what the phone receives — your chats, contacts, groups, messages and media. Kalagh stores those so the shared inbox works, and sends only what your agents or your own automations compose.
- Choose the account deliberately
- because a linked device sees the whole account, connect a business WhatsApp number rather than a personal one, and tell your team what will be visible in the shared inbox.
- How to disconnect
- unlink the device from WhatsApp on your phone, or delete the channel in Kalagh — which logs the device out and deletes the session keys along with that channel’s conversations, messages and media.
Telegram, Viber, IMAP/SMTP email and the website widget
- Telegram: connected either as a bot (you paste a bot token) or as a personal account (a phone number and the login code Telegram sends you). A personal-account connection gives Kalagh the same reach as the Telegram client it replaces, so use a business account for it.
- Viber: connected with a bot token you create in your own Viber account.
- IMAP / SMTP email: you enter the mailbox host, user name and password. They are stored encrypted and used only to fetch and send that mailbox’s mail.
- Website chat widget: embedded on your own site with a one-line script. Visitors are anonymous unless they tell you who they are; the widget keeps a visitor id in your site’s local storage so a returning visitor keeps the same thread.
Google user data and Limited Use
Limited Use disclosure
Kalagh’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
The full policy is published by Google: Google API Services User Data Policy.
In practice, that commitment means all of the following.
- Only for the features you connected. Google user data is used only to provide and improve the user-facing features you connected it for, as described in section 3: the shared inbox that shows your mailbox as conversations, sending the replies your agents write, keeping read state in step, and the File Manager for Drive.
- No advertising. We do not use Google user data for advertising of any kind — not for personalised, re-marketed or interest-based advertising — and Kalagh serves no ads.
- No sale, no unrelated transfer. We do not sell Google user data, and we do not transfer it to anyone except where it is necessary to provide those features (the infrastructure that runs Kalagh, listed in section 7), for security investigations, to comply with applicable law, or as part of a merger or acquisition — and then only after we have given you notice and the chance to delete your data first.
- Never used to train AI models. Google user data is never used to develop, train, retrain or fine-tune any AI or machine-learning model, ours or anyone else’s. Kalagh contains no model-training code, and the optional AI features in section 6 never receive Google user data for training — only to answer the request your organisation asked them to answer.
- Humans do not read it. No one at AchaSoft reads your Google user data, except (a) with your affirmative consent for specific messages, (b) where it is necessary for security purposes or to investigate abuse, (c) to comply with applicable law, or (d) in aggregated and anonymised form for internal operations. Your own agents reading your own connected mailbox inside Kalagh is the feature you connected it for, and it is governed by the roles and permissions your organisation sets.
How we use information, and our legal bases
We use the information described above to:
- create and run your account, your organisation and its permissions;
- receive, display, route, translate, search and send the messages of the channels you connected, and keep their state in step with the platform they came from;
- run the automations, playbooks and workflows you build;
- keep the service secure — authentication, abuse prevention, rate limiting and audit;
- answer your support requests and tell you about changes that affect you;
- invoice you, and let you invoice your own customers through a gateway;
- diagnose faults and keep the service reliable, using logs and error diagnostics;
- meet our legal, tax and accounting obligations.
Under the GDPR (Article 6) and the KVKK (Article 5), we rely on these bases:
- Performance of a contract
- GDPR Art. 6(1)(b); KVKK Art. 5(2)(c) — running your account, the channels you connect and the messaging you signed up for.
- Legitimate interests
- GDPR Art. 6(1)(f); KVKK Art. 5(2)(f) — keeping the service secure and available, preventing abuse, diagnosing faults and defending our rights, balanced against your own.
- Consent
- GDPR Art. 6(1)(a); KVKK Art. 5(1) — connecting a third-party account, and switching on an optional feature such as an AI step, translation or a document preview. You can withdraw it by disconnecting the account or turning the feature off, with no effect on what was lawful before.
- Legal obligation
- GDPR Art. 6(1)(c); KVKK Art. 5(2)(a) — keeping the records tax, accounting and commercial law require.
Where we act as a processor for a business customer, we process its customers’ data on its instructions and under our agreement with it. That customer is responsible for having its own lawful basis — and, where the platform requires it, consent — for the messages it sends.
AI features, translation and document preview
The AI features are optional and off until an organisation turns them on with its own provider and its own API key. Kalagh is not tied to one AI vendor, and a self-hosted model is a first-class choice.
- What is sent: when an AI step runs in a playbook — an AI agent or an auto-reply — the recent conversation history, which can include email content, is sent to the provider your organisation configured: for example OpenAI, Anthropic, Google Gemini, Azure OpenAI, AWS Bedrock, Mistral, Groq, DeepSeek, xAI, OpenRouter, or a model you host yourself.
- Your provider, your key, your terms: the request is made with your organisation’s own key, so your agreement with that provider governs it. Your keys are stored encrypted.
- What we keep: a truncated record of prompts and responses, so an owner can see usage and stay inside a budget. An owner or admin can erase that history from the in-app Privacy tools.
- Never for training: no conversation content is used to train, retrain or fine-tune a model. Kalagh has no training pipeline.
- Translation: when an agent clicks to translate a message, only the text being translated is sent — to Google Cloud Translation or DeepL, with your organisation’s own key.
- Document preview: if your organisation enables it, an attachment can be previewed through the Microsoft Office Online or Google Docs viewer, which means that viewer is given the file’s URL in order to render it. Leave the viewer off and no attachment leaves Kalagh.
- Automation you configure: workflow HTTP actions, webhooks and n8n steps send the conversation data you select to the URLs you choose. Those destinations are yours, and so is the responsibility for them.
International transfers
AchaSoft is established in Türkiye and Kalagh’s servers are operated by us. If you are in the European Economic Area, the United Kingdom or Switzerland, your data is therefore transferred outside your own country.
Where a transfer needs a safeguard, we rely on the European Commission’s standard contractual clauses or another lawful transfer mechanism, together with the technical measures in section 10. Transfers abroad under the KVKK are made on the conditions its Article 9 allows. Every processor is held to the same standard by contract.
Write to [email protected] for a copy of the safeguards that apply to your organisation, or for a data processing agreement.
Retention and deletion
We keep data while it is needed for the purpose it was collected for, and no longer. Concretely:
- While a channel is connected
- conversations, contacts, files and settings are kept while the account and the channel are active, because they are the record your team works from.
- Deleting a channel
- deletes that channel’s conversations, messages, media and stored credentials, and ends its connection at the platform. Contacts are deliberately kept, so deleting a channel does not erase the customer list your team built; erase them separately if you want them gone.
- The in-app Privacy tools
- an organisation owner or admin can erase media, whole channels, automation run history (including the stored AI prompts) and contacts from Settings → Organization → Privacy, without asking us.
- Deleting your account
- write to [email protected] from the address on the account. We delete the account and its organisation data within 30 days of confirming the request, and tell you when it is done.
- Operational records
- inbound webhook journals and the outbound message queue are purged after a short retention window once they have done their job.
- Backups
- deleted data can remain in encrypted backups for a limited period until they rotate out. Backups are used to restore the service after a failure, never to bring deleted data back into it.
How we protect information
These are the measures we actually operate:
- every public endpoint — website, application, API and realtime — is served over HTTPS/TLS.
- OAuth tokens, third-party client secrets, mailbox passwords, AI keys and payment-gateway credentials are encrypted at rest.
- account passwords are stored only as argon2 hashes, never in a readable form.
- access inside an organisation is role-based, so a member sees the channels and conversations their role allows.
- OAuth state is signed, and inbound platform webhooks — including Gmail push notifications — are verified before they are accepted.
- we request the narrowest permission each feature can work with, which is why section 3 lists them one by one.
No service can promise perfect security, and we do not claim a certification we do not hold. If a personal data breach occurs, we notify the competent supervisory authority and the people affected as the law requires — within 72 hours of becoming aware where GDPR Article 33 applies, and on the KVKK’s timetable in Türkiye.
Your rights
Whatever law applies to you, you can ask us what we hold, have it corrected, have it deleted and have it sent to you. In detail:
EEA, UK and Switzerland (GDPR / UK GDPR)
- access to your personal data and information about how it is processed;
- rectification of data that is wrong or incomplete;
- erasure, where we have no overriding reason to keep it;
- restriction of processing, and objection to processing based on legitimate interests;
- portability — a copy in a structured, machine-readable form;
- withdrawal of a consent you gave, at any time;
- not to be subject to a decision based solely on automated processing with legal effect — Kalagh makes no such decision about you.
Türkiye (KVKK, Law No. 6698, Article 11)
- to learn whether your personal data is processed, and to request information if it is;
- to learn the purpose of the processing and whether it is used accordingly;
- to know the third parties to whom data is transferred, in Türkiye or abroad;
- to have incomplete or inaccurate data corrected;
- to request erasure or destruction where the conditions of Article 7 are met;
- to have a correction or erasure notified to the third parties it was passed to;
- to object to a result reached solely by automated analysis, and to claim compensation for damage caused by unlawful processing.
California (CCPA / CPRA)
- to know what we collect, why, and who we disclose it to;
- to delete and to correct;
- to a portable copy;
- not to be discriminated against for exercising a right.
No sale, no sharing
We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. We do not use or disclose sensitive personal information beyond what is needed to provide the service you asked for.
- How to exercise a right
- email [email protected] from the address on your account and say what you want. We answer within 30 days (one month under the GDPR), and we tell you if we need longer and why. We may ask for what is needed to confirm it is really you, and for nothing more. If the data is inside a business customer’s workspace, that customer is the controller: we forward your request to it and help it answer.
- Complaints
- you can complain to a supervisory authority — in Türkiye the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu), in the EEA your national data protection authority, in the UK the Information Commissioner’s Office. We would much rather you wrote to us first, and we will try to put it right.
Children
Kalagh is a tool for businesses and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child’s data has reached us, write to [email protected] and we will delete it.
Changes to this policy
We update this policy when the product or the law changes. The date at the top of the page is the version date. A change that materially affects your rights is announced in the application or by email before it takes effect, and the current version always lives at kalagh.chat/privacy. Continuing to use Kalagh after a change takes effect means you accept the updated policy.
Contact us
- Data controller
- AchaSoft, Gayrettepe, Istanbul, Türkiye.
- Privacy, data requests and deletion
- [email protected]
- Terms of Service
- kalagh.chat/terms
Write in English, Turkish, Persian or Arabic. A privacy or data-protection request is answered by a person, not a form.
This policy is published by AchaSoft for the Kalagh platform. If you need it in another form for a security review or a procurement process, write to [email protected] and we will help.