Privacy Policy

Complaintr ("Complaintr", "we", "us") operates an AI customer service platform. This Policy applies to complaintr.com, the product app at app.complaintr.com, the documentation at docs.complaintr.com, the embeddable widget, the API and MCP server, and the bots and integrations we run (together, the "Service").

For the processing described in this Policy, Complaintr is the data controller unless section 2 states otherwise. Our contact details are in the last section.

People use Complaintr in two ways, and our role differs between them.

Workspace owners

create an account and register applications. For account, preference, usage, partner application, and website visitor data, Complaintr is the data controller.

Reporters

send a complaint, feedback, or a survey answer about an application, usually without an account. The owner of that application decides why and how this feedback is collected and is its data controller. Complaintr processes it on the owner's behalf as a data processor.

Where we process reporter data to keep the platform secure, prevent abuse, and meet our own legal obligations, we act as a data controller.

We collect personal data by electronic means: through the forms and conversations you complete, through the sign-in providers and channels you connect, and automatically through our servers.

• Account

  Data

  Name, email address, and profile picture; a hashed password if you sign up by email; the public key of each passkey you add; and an encrypted authenticator secret with backup codes if you turn on two-step verification. The fingerprint, face, or screen lock that unlocks a passkey stays on your device and never reaches us.

  Source

  You; Google or GitHub when you sign in with them.

• Invites and the Partner label

  Data

  When the Complaintr team invites you: the address the invite was sent to, the plan it gives, and, for partners, your organization's name, which is shown as a Partner label on your account to Complaintr's staff. We record which account used each invite and when.

  Source

  The Complaintr team; you.

• Onboarding and preferences

  Data

  Your role, project name and type, an optional website and description; your language, theme, and landing-page choices. Your in-app notification and email choices, and how requests for a person reach you.

  Source

  You.

• In-app notifications

  Data

  What concerns you directly: a complaint routed to you or your unit, a team invitation and its answer, a request for a person, a verified project, and your Core allowance.

  Source

  Generated by the Service.

• Account activity

  Data

  When you sign in or out and how (with the address and browser of the request), the pages you open in the product app, and the requests you make that change something (their kind and address, never their content).

  Source

  Generated by the Service.

• Applications

  Data

  Names and descriptions of the applications you register, their widget settings, and the news and help articles you publish. For a project with a website: the website, how you proved you own it (a meta tag, a DNS record, the widget seen on the site, or an email address on the site's domain), and the address the widget was first seen on.

  Source

  You.

• Complaints and feedback

  Data

  Title and description of each report, the channel or AI agent it came from, its category, severity, and status, and any optional metadata. Widget forms can include an optional contact email, the page address, and browser details. In a conversation on the widget, Telegram, Instagram, Slack, or GitHub a sender can attach images and videos, and on the widget PDF files, with their file names.

  Source

  Reporters; AI agents; the workspace owner.

• Assistant conversations

  Data

  Messages exchanged with Complaintr Core in the workspace chat, the widget, Telegram, Slack, Instagram, GitHub comments, and the chat on our website. When a complaint or a request for a person is filed in a conversation, the owner of that application and their team can read the part of the conversation about their application, and Complaintr administrators can read all of it.

  Source

  You; reporters.

• Requests for a person

  Data

  When a sender agrees that a message should go to a person: a short summary written by Complaintr Core, the sender's name or handle on the channel, and, where nobody can answer in the conversation, the email address or phone number the sender gives.

  Source

  Reporters; Complaintr Core.

• Feedback about Complaintr

  Data

  What you send to Complaintr about Complaintr itself, in the product app, on our website, from the documentation, or through Ask Core: whether it is an opinion, a suggestion, or a complaint, your message, the page you sent it from, the email address on your account or the one you leave, a title and category Complaintr Core writes for it, and the reply our team sends. Complaintr's administrators read it, and so do the moderators an administrator allows.

  Source

  You; Complaintr Core.

• Widget e-mail sign-ups

  Data

  The e-mail address a visitor leaves in a business's widget popup, and the page it was left on.

  Source

  Widget visitors.

• Surveys

  Data

  The questions a workspace owner writes, the recipient names and optional email addresses they enter, and the answers recipients give. Answers given in the widget are tied to the visitor's random device identifier.

  Source

  The workspace owner; survey recipients.

• Channel identifiers

  Data

  Identifiers needed to reply on a connected channel: a Telegram chat ID, a Slack workspace and user ID, an Instagram sender ID, or the GitHub repository, issue, and comment a report came from.

  Source

  The connected platform.

• Partner applications

  Data

  Your name, work email, organization, and the note you write on our partners page.

  Source

  You.

• Technical and usage data

  Data

  IP address, browser type, and timestamps; records of AI usage for each account (request counts, token counts, and estimated cost).

  Source

  Generated automatically.

We never receive your Google or GitHub password, and we do not collect payment card details. We do not ask for special categories of personal data, such as health, religion, or biometric data; please do not include them in a complaint or a conversation.

• Creating and securing your account and keeping you signed in

  Data used

  Account; technical data

  Legal basis

  Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c)

• Receiving complaints and survey answers and showing them to the owner of the application they concern

  Data used

  Complaints; conversations; surveys; channel identifiers

  Legal basis

  Performance of our contract with the workspace owner; for reporter data, processing on the owner's instructions as a processor

• Running the assistant: understanding a message, asking follow-up questions, filing a report, answering questions about your own workspace, and assigning a category and severity when triage is enabled

  Data used

  Conversations; complaints

  Legal basis

  Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c)

• Passing a message to a person when its sender agrees, and telling the owner, unit, or member the owner chose in the app or by email

  Data used

  Requests for a person; conversations; account

  Legal basis

  Performance of our contract with the workspace owner; for the sender's data, processing on the owner's instructions as a processor

• Reading and answering feedback about Complaintr, and improving the Service with it

  Data used

  Feedback about Complaintr; account

  Legal basis

  Legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5/2-f)

• Checking that you own the website a project is for, so each website belongs to one project

  Data used

  Applications; account email address

  Legal basis

  Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c); legitimate interest in preventing impersonation (GDPR Art. 6(1)(f); KVKK Art. 5/2-f)

• Sending the notifications you turn on and service emails such as verification and password reset

  Data used

  Account; channel identifiers

  Legal basis

  Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c)

• Enforcing plan limits and usage budgets

  Data used

  Usage data

  Legal basis

  Performance of a contract; legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5/2-f)

• Preventing spam, abuse, and prompt injection, applying rate limits, and keeping the Service secure

  Data used

  Technical data; conversations

  Legal basis

  Legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5/2-f)

• Fixing problems and improving the Service

  Data used

  Technical and usage data

  Legal basis

  Legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5/2-f)

• Answering partner applications and inviting partners

  Data used

  Partner applications; invites

  Legal basis

  Taking steps at your request before entering into a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c)

• Meeting legal obligations, answering lawful requests from authorities, and establishing, exercising, or defending legal claims

  Data used

  The data the obligation or claim requires

  Legal basis

  Legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5/2-ç) and establishment of a right (KVKK Art. 5/2-e)

• Keeping a record of account activity, so we can secure accounts, investigate abuse or a disputed action, and help you when you ask for support

  Data used

  Account activity

  Legal basis

  Legitimate interest in the security of the Service and its users (GDPR Art. 6(1)(f); KVKK Art. 5/2-f)

We do not sell personal data, we do not use it for advertising, and we do not make decisions that produce legal effects for you solely by automated means.

Complaintr Core is an AI assistant. To produce a reply, classify a message, or triage a complaint, the relevant text is sent to the AI model providers listed in section 7. We send only what the task needs, and an assistant conversation on a public channel never has access to another person's workspace.

We do not use your content to train our own models. AI output can be wrong, so do not put information into a complaint or a conversation that you would not want processed this way, such as passwords, payment card numbers, or sensitive personal data.

A complaint is private by default. It becomes visible to others only when someone asks for a share link. The public card shows the application name and color, the title, the description, the source, the date, and the status. It never shows a contact email, page address, browser details, conversation history, or sender details.

Anyone with the link can view the card, and anything written in the title or description is visible. Sharing can be turned off from the share page at any time, after which the link stops working.

We rely on a small number of providers to run the Service. Each receives only the data its task requires and may use it only for that task.

• Google and GitHub

  Purpose

  Sign-in.

  Data

  They share your name, email address, and profile picture with us.

• Cloudflare

  Purpose

  Network protection in front of our sites, the Turnstile check that keeps bots out of public forms, and storage for images on our public pages.

  Data

  IP address and browser details; uploaded images.

• Resend

  Purpose

  Delivery of verification, password reset, account, team invitation, complaint routing, weekly summary, and request-for-a-person emails, and our replies to feedback.

  Data

  Email address and the content of the email.

• Better Stack

  Purpose

  Uptime monitoring of our sites and the public status page at status.complaintr.com.

  Data

  IP address and browser details of status page visitors.

• Amazon Web Services

  Purpose

  The servers and the PostgreSQL database where the Service runs, storage of the files attached to complaints, and the AI models behind Complaintr Core's replies (gpt-oss-120b when chosen, and Amazon Nova 2 Lite for images, videos, and PDF files), all in European Union regions. The servers, the database, and the files are in Frankfurt.

  Data

  All data stored in the Service, including attached images, videos, and PDF files.

• OpenRouter

  Purpose

  The AI model behind Complaintr Core's replies when we run it there (gpt-oss-120b), message classification (scope and safety checks, replies to confirmation questions), and complaint triage.

  Data

  The text of the relevant message, complaint, or conversation.

• Telegram, Slack, Instagram (Meta), and GitHub

  Purpose

  The channels you or your users choose to talk to Complaintr on.

  Data

  Messages sent there and the channel identifiers. These platforms also process them under their own policies.

We also disclose personal data to competent authorities when the law requires it, and to the workspace owner a complaint or survey answer is addressed to. If Complaintr is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction under the protections of this Policy.

Some of these providers process data on servers outside Türkiye and outside the European Economic Area, including in the United States. Where the law requires it, we rely on the transfer mechanisms set out in Article 9 of the KVKK and Chapter V of the GDPR, such as standard contractual clauses, for those transfers.

• Account data

  Kept for

  As long as your account exists.

• Invites and the Partner label

  Kept for

  The Partner label as long as the account exists. An invite and the address it was sent to are kept as a record of who was invited, and deleted when you ask us.

• Applications, complaints, surveys, and workspace chat

  Kept for

  Until the owner deletes them or the account is removed. Deleting an application deletes every complaint linked to it.

• Conversations on the widget, Telegram, Slack, Instagram, GitHub, and our website

  Kept for

  One year after the last message, even when the complaint filed in them is deleted earlier. They are kept as a record of what was said and to investigate abuse.

• Images, videos, and PDF files attached in a conversation

  Kept for

  90 days after they were uploaded, or sooner when the complaint they were filed with is deleted. Attachments never filed are deleted with their conversation, and an upload never sent in a message is deleted after one day.

• Requests for a person

  Kept for

  Until the application or the account is deleted.

• Feedback about Complaintr

  Kept for

  Until an administrator deletes it.

• Widget e-mail sign-ups

  Kept for

  Until the business deletes the application or the account is removed.

• In-app notifications

  Kept for

  90 days after you read them.

• Email delivery records (the address, the kind of email, and whether it was sent)

  Kept for

  30 days.

• Account activity (sign-ins, pages opened, and changes made)

  Kept for

  180 days.

• Records of messages the assistant refused (the channel and the reason, never the text)

  Kept for

  90 days.

• A project name held while its website is being proven

  Kept for

  72 hours, unless the website is proven and the project is created.

• One-time link codes and rate-limit records

  Kept for

  Briefly, until they expire.

• Backups of the database and the servers

  Kept for

  Database backups for 30 days and server snapshots for 7 days. Data deleted from the Service leaves the backups when they expire.

• Partner applications

  Kept for

  Until we remove them, or when you ask us to.

• Cookies

  Kept for

  For the periods listed in section 10.

When a retention period ends, the data is deleted or anonymized. We may keep limited records for longer where the law requires it or where they are needed to resolve a dispute. To delete your account and its data, write to us at the address in the last section.

Complaintr sets only cookies that are strictly necessary or that remember a choice you made yourself, so no consent banner is shown. We do not use advertising or analytics cookies, and none of our sites set tracking cookies.

• Session cookie

  Where

  Product app

  Purpose

  Keeps you signed in.

  Duration

  Until you sign out or it expires.

• two_factor, better-auth-passkey

  Where

  Product app

  Purpose

  Hold a sign-in that is in progress while you enter a two-step verification code or use a passkey.

  Duration

  A few minutes; removed when the sign-in completes.

• NEXT_LOCALE

  Where

  All Complaintr sites

  Purpose

  Remembers the language you chose, so the website, the documentation, and the product app open in the same language.

  Duration

  Up to one year.

• theme

  Where

  All Complaintr sites

  Purpose

  Remembers the light, dark, or system theme you chose.

  Duration

  Up to one year.

• sidebar_state

  Where

  Product app

  Purpose

  Remembers whether the sidebar is expanded or collapsed.

  Duration

  Seven days.

• github_install_pending

  Where

  Product app

  Purpose

  Secures the GitHub installation flow.

  Duration

  Short-lived; removed when the flow completes.

The language and theme cookies are shared across complaintr.com and its subdomains and hold only the chosen value, never an identifier. Your browser's local storage also keeps the selected theme and, in the widget, a visitor's own conversations and a random device identifier on that visitor's device, so a conversation can continue without an account. It also keeps when a business's widget popup was last shown, so it is not shown again too often.

You can delete cookies and local storage from your browser settings at any time. The sites keep working and fall back to your device's language and the system theme.

Data is encrypted in transit and at rest, including backups, passwords are stored hashed, and access tokens for connected workspaces are stored encrypted. Each workspace's data is isolated by ownership, incoming webhooks are signature-checked, and public endpoints are rate limited.

No system is perfectly secure. Please do not put confidential information into Complaintr that it does not need.

Under Article 11 of the KVKK, and under the GDPR where it applies to you, you have the right to:

• Learn whether your personal data is processed and request information about it
• Learn the purpose of the processing and whether the data is used for that purpose
• Know the third parties, in Türkiye or abroad, to whom your data is transferred
• Have incomplete or inaccurate data corrected
• Have your data deleted or destroyed, and have these actions notified to the third parties the data was transferred to
• Receive a copy of your data in a structured, machine-readable format
• Object to certain processing, ask us to restrict it, and object to a result against you that arises solely from automated analysis
• Withdraw your consent at any time where processing is based on consent
• Claim compensation if you suffer damage because your data was processed unlawfully

To use any of these rights, write to us at the address in the last section, by email from the address linked to your account or in writing. Tell us who you are and what you are asking for. We answer free of charge as soon as possible and within thirty days at the latest. If answering requires an additional cost, we may charge the fee set by the Personal Data Protection Board.

If you are not satisfied with our answer, or we do not answer in time, you can lodge a complaint with the Turkish Personal Data Protection Board (within thirty days of our answer and in any case within sixty days of your request) or with the data protection authority where you live.

If you submitted a complaint about someone else's application, you can also contact the owner of that application, who is the data controller for it. We will help them respond.

The Service is not intended for anyone under 16. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

We may update this Policy as the Service or the law changes. When we do, we revise the date at the top of this page, and we may notify account holders about significant changes.

For questions about this Policy or to exercise your rights, reach us here:

Service

Complaintr

Email

[email protected]

Website

complaintr.com