Turleno Privacy Policy

1. Who we are

Turleno is an AI-first B2B corporate-travel management software platform, sold primarily to travel agencies. "Turleno" is our public brand. Turleno is operated by Fikret Burak Gazioğlu, a sole proprietorship established in Türkiye ("Turleno", "we", "us").

Brand: Turleno
Operated by: Fikret Burak Gazioğlu
Legal form: Sole proprietorship established in Türkiye
Country: Türkiye
Business address: Gülbahar Mah. Cemal Sururi Sk. No: 15 E İç Kapı No: 15, Şişli / İstanbul, Türkiye
Website: https://turleno.com
Privacy contact: privacy@turleno.com

The same details are on our Legal and Company Information page.

2. Scope

This policy may apply to personal data handled in connection with:

the Turleno website (turleno.com) and demo requests;
the Turleno software platform, including reporting and administration interfaces;
travel-agency users, corporate-company users, managers and approvers, administrators, and the employees and travellers they add to the platform;
the Turleno web chat and AI travel assistant;
WhatsApp integrations, both Turleno's own WhatsApp business number and WhatsApp accounts that travel agencies connect to Turleno; and
support communications.

Travel agencies may offer Turleno to their corporate customers under their own branding. If you use Turleno through an agency or company, that organisation may also give you its own privacy information.

3. Our role: controller, processor, or both

Our role depends on the processing activity, and we do not describe it the same way for every activity.

For our own purposes (for example platform and account administration, security, fraud prevention, billing, support, operating the service and meeting legal obligations) Turleno may determine why and how personal data is processed.
When providing the platform to a travel agency or corporate customer, Turleno may process certain personal data on their instructions, for example traveller records, bookings, approvals and messages handled inside their account.
Travel agencies and corporate customers may have their own obligations as data controllers, such as informing their employees and travellers and having a lawful basis for their communications.
Airlines, hotels and other travel suppliers, and Meta/WhatsApp, process information under their own terms and policies.

Specific responsibilities may be set out in our service agreement, a data processing addendum (see the draft DPA) or the customer agreement.

4. Categories of personal data

Depending on the service used, we may process the following. Not every category applies to every person.

Identity and contact: name, surname, work email address, telephone number, company, and position or business relationship.
Account: login and account information, organisation, roles, permissions and account activity.
Traveller: traveller profile, passenger information (which may include date of birth, nationality and passport or ID details where a supplier or destination requires them), travel preferences, itineraries, booking references, tickets and vouchers.
Travel requests: origin, destination, travel dates, and flight, hotel, car-rental, transfer and visa-assistance searches and requests.
Corporate travel: company travel policy, approval requirements, approval decisions, rejection reasons, policy exceptions, budgets and account permissions.
Financial and business metadata: balances, credit information, transaction ledger entries, and invoice and payment references held in the platform. Turleno is a software provider and is not a bank or payment institution.
Communications: support communications, web-chat messages, WhatsApp messages and email communications.
WhatsApp data: WhatsApp phone number and user identifiers, WhatsApp Business Account (WABA) IDs, WhatsApp phone-number IDs, message IDs, message content, media where applicable, timestamps, message-template identifiers and delivery, read and failure status events.
Technical: to the extent collected, logs, IP address, browser and device details, and security events.
Website and demo requests: the details submitted in the demo form (such as name, work email, agency or company, role, team size and optional phone number).

Information comes from you, from your agency or company, from Meta/WhatsApp when messages are exchanged, and from travel suppliers (for example booking confirmations).

5. Why we process personal data

to create and manage accounts and authenticate users;
to search travel inventory and query suppliers;
to make, modify and cancel bookings and to handle tickets and vouchers;
to apply travel-policy rules and run manager approvals;
to send notifications and to operate web chat and WhatsApp;
to provide customer support and reporting;
for billing and account administration;
for platform security, fraud prevention and troubleshooting;
to comply with legal obligations; and
to improve the service.

6. WhatsApp and Meta

Turleno integrates with the WhatsApp Business Platform provided by Meta. People may communicate on WhatsApp with Turleno, or with a travel agency that has connected its WhatsApp number to Turleno. Meta may process information independently, under WhatsApp's and Meta's own terms and privacy policies. We do not control that processing.

What Turleno receives. Turleno receives the information required to provide the integration, such as phone numbers, WhatsApp identifiers, message content, message IDs, timestamps and delivery, read or failure status events.
Agency-connected accounts. Travel agencies may connect their own Meta assets, such as a Meta Business Portfolio, WhatsApp Business Account and phone number, to Turleno using Meta's Embedded Signup. The agency continues to own and control those assets. Turleno receives the technical authorisation needed to operate the integration. Turleno does not own an agency's WhatsApp Business Account or phone number, and cannot override Meta's policies. Agencies remain responsible for their own customer communications, including any lawful basis or consent.
How we use it. We process WhatsApp information for messaging, travel assistance, booking, policy and approval workflows, notifications, support, security and troubleshooting.
No sale. Turleno does not sell WhatsApp message content.

Meta's information about its own processing:

To request deletion of information Turleno received through this integration, see Data Deletion Instructions.

7. Artificial intelligence

Turleno provides an AI travel assistant through web chat and WhatsApp. Automated and AI systems, including third-party AI model providers, may be used to interpret requests, assist travel search, operate platform workflows, assist travel-policy checks and approvals, and assist support.

Supplier and platform information remains authoritative for price, availability, booking status and ticket status.
AI output can be mistaken or incomplete and should be checked before you confirm.
Actions that commit a booking follow the confirmation and approval steps configured in the platform. Approval decisions are made by the responsible managers or agencies rather than by the AI.
You can use the standard web interface instead, or ask to be directed to your travel agency's support.

Please do not send passwords, access tokens, PINs or payment-card numbers to the assistant.

Website assistant (“Ask Turleno”)

On turleno.com, a separate AI assistant, “Ask Turleno”, answers visitors' questions about Turleno. It is not the platform's travel assistant: it has no access to the Turleno platform, to agency or company accounts, or to any traveller or booking data, and it cannot book travel.

What we process: the messages you type and the assistant's replies, the language you choose, a random chat identifier, the time of each message, and a one-way keyed hash of your IP address that changes every day. The assistant does not store your IP address itself; our web server processes it as it does for every page request.
Purposes: answering your questions about Turleno; offering you the demo form or WhatsApp; preventing abuse by limiting each address to a few chats a day and the assistant's total use to a daily limit; and improving the assistant's answers.
Legal basis: our legitimate interest in answering prospective customers' questions and protecting the website from abuse (KVKK Article 5(2)(f); GDPR Article 6(1)(f) where the GDPR applies). When you ask for a demo, processing is directly related to steps towards a contract that you ask us to take (KVKK Article 5(2)(c); GDPR Article 6(1)(b)).
AI model: your messages and the chat so far are sent to Google Cloud Vertex AI, which processes them on our behalf as a service provider, in its europe-west3 region (Frankfurt, Germany).
Demo request from the chat: if you open the demo form from the chat and submit it, the details you enter are handled like any other demo request, and a short summary of the chat is sent with them to our internal Slack workspace so our team can prepare for the demo.
Retention: chats are deleted automatically 30 days after they are written; the daily IP-address hash is deleted after 2 days. A demo request is kept as described in section 11.

Please do not give the assistant personal data it does not need to answer you, such as identity or passport numbers, health information or other people's details.

8. Legal bases

Turleno operates from Türkiye. Under the Turkish Personal Data Protection Law (KVKK), depending on the activity, we rely on processing conditions the law recognises, for example that processing is necessary for the performance of a contract, is required to meet a legal obligation, is necessary for our legitimate interests without harming your fundamental rights and freedoms, or, where the law requires it, is based on your explicit consent.

Where the EU General Data Protection Regulation (GDPR) applies, the possible bases include contract, legal obligation, legitimate interests and, where required, consent. GDPR does not necessarily apply to every user or every processing activity.

the responsible travel agency and the corporate customer, and their authorised users;
travel suppliers: airlines, GDS and travel-inventory providers, hotel providers and suppliers, car-rental providers, and transfer and visa-assistance providers where used;
Meta / WhatsApp;
service providers: cloud and infrastructure, email and communications, support, and analytics or security providers where actually used;
professional advisers and public authorities where legally required.

Named providers we currently use are listed on our Subprocessors page. We do not sell personal data.

10. International transfers

Turleno's core application infrastructure is currently hosted in Frankfurt, Germany. Some providers, such as Meta/WhatsApp, AI-model, email and travel providers, may process information outside Türkiye and/or the European Economic Area, so we do not say that all data stays in one country. Where the law requires it, we use the applicable transfer mechanisms and safeguards.

11. Retention

We keep personal data for as long as the purpose requires and the law allows. Retention depends on the purpose and on our legal obligations, including:

providing the service and meeting contractual obligations;
travel and booking records;
accounting and tax obligations and other legal requirements;
customer support;
security and fraud prevention; and
resolving disputes.

Some operational data, such as chat and notification working data, is configured to expire automatically after a limited period. Backups age out through their normal lifecycle. When a purpose ends, data is deleted or anonymised unless the law requires us to keep it.

12. Security

We apply technical and organisational safeguards appropriate to the risk, such as encrypted connections, access control, separation of each agency's data from other agencies' data, protected handling of credentials, and logging and monitoring. No system is completely secure. We do not publish detailed security configuration.

13. Your rights

Under the KVKK, you may apply to the data controller to:

learn whether your personal data is processed and request information about it;
learn the purpose of processing and whether it is used accordingly;
learn the third parties to whom data is transferred in Türkiye or abroad;
request correction of incomplete or inaccurate data, and deletion or destruction where the conditions are met;
object to a result that is against you arising from automated analysis; and
request compensation for damage caused by unlawful processing.

Where the GDPR applies, you may also have the right to access, correction, deletion, restriction of processing, objection, portability, and withdrawal of consent where processing relies on consent, and the right to lodge a complaint with a supervisory authority. In Türkiye, the competent authority is the Personal Data Protection Board (kvkk.gov.tr).

To exercise your rights, write to privacy@turleno.com. We may need to verify your identity, and if your data is held on behalf of an agency or company we may need to involve them. To request deletion, see our Data Deletion Instructions.

14. Children

Turleno is a B2B corporate-travel service and is not directed at children as independent users. Traveller records are created by agencies and companies; if a record concerns a minor, it is handled only as part of arranging that person's travel.

15. Changes to this policy

This policy is effective from 3 October 2026 and was last updated on 6 November 2026. We may update it, and will post the updated version publicly on this page with a new date. If a change is material, we will also notify agency customers through the platform or by email.

Privacy Policy