When you put an AI assistant on your website, the messages visitors write may be personal data. In the URİKEM AI Customer Assistant, chats are stored on a server in Istanbul, are deleted automatically 180 days after the last message, and the business can delete a chat at any time. Messages are sent to an AI provider abroad so that a reply can be generated; visitors are informed of this and asked for consent before their first message.
One of the first questions businesses ask when they consider adding an AI-powered chat assistant to their website concerns personal data: Where do the messages visitors write go, how long are they kept, can they be deleted, and how should this be explained to customers? In this article we answer these questions using our own product, staying within what is written in the KVKK (Turkish data protection law) privacy notice on our website. What follows is general information; for your own business's obligations, get the opinion of your own legal adviser.
What data does the assistant generate?
When a visitor types a question into the assistant, several kinds of information are recorded. Our KVKK privacy notice lists the following for the AI Customer Assistant:
- The messages written in the chat,
- The visitor's name and phone number, if they leave them,
- The address of the page where the chat was opened,
- The IP address.
When the assistant does not know the answer to a question, it takes the customer's phone number, and a summary of the chats is sent to the business by email. So although it looks like a question-and-answer tool, in practice it is also a channel that collects customer contact details. If you are curious about which questions the assistant answers, see the article which questions can the assistant answer.
Who is the data controller, and what is URİKEM's role?
The business that uses the assistant on its own website is the data controller for the data visitors write: the business decides for what purpose the data is processed. URİKEM acts as a data processor on the business's behalf; as stated in our privacy notice, it processes this data only on the business's instructions and for the purpose of providing the service, and does not use it for its own purposes, sell it or share it for marketing. This distinction matters, because the duty to inform visitors lies first with the business that uses the assistant.
In practice, this means you should review your own privacy notice before adding the assistant to your website. If your site only has a notice written for a contact form, it may not cover the data collected through the chat assistant, the purposes it is used for and who it is transferred to. Updating the notice is a task that should be planned at the same time as setting up the assistant.
Where are chats stored, and for how long?
As stated in our data security section, customer, appointment and assistant records are kept on our server in Istanbul, in a directory closed to the web. Records are backed up every day and backups are kept for 30 days.
On retention, the rule in our privacy notice is this: AI Customer Assistant chats are deleted automatically 180 days after the last message. The business, however, can delete a chat at any time without waiting for this period. For example, if a visitor wrote something in the chat that they should not have, that chat can be removed immediately.
The period runs from the last message. So if a visitor returns to the same chat a few days later and continues writing, the count starts again from the date of the last message. A business that wants to keep chats for a shorter time can delete them itself without waiting for the 180 days.
How is transfer abroad disclosed?
So that the assistant can generate a reply, the message the visitor writes is transferred to an AI service provider based abroad. According to our privacy notice, visitors are informed of this and asked for consent before their first message. The contract with the provider stipulates that the transferred data is not used for model training and is kept for a limited period. We covered the question of whether the data trains the AI separately in the article does an AI tool learn my company's data.
How do deletion and requests work?
To exercise their rights regarding the data they wrote in the assistant, visitors first apply to the business that uses the assistant. If they cannot reach the business, they can write to info@urikem.com; in that case the request is forwarded to the business and acted on according to the business's instructions. For this flow to work, the business needs to show clearly on its own website where requests should be sent.
For the business, the simplest arrangement is to decide from the outset who will handle such requests. When a visitor asks for their chat to be deleted, the person receiving the request should be able to find and delete the chat and let the visitor know it has been done. If it is not clear who is responsible when a request comes in, a simple task drags on unnecessarily.
How should it be explained to customers?
The information given to visitors does not have to be a long legal text; what matters is that it is clear and easy to find. In practice, it helps to set out the following points in plain language:
- That what is written in the chat goes to an AI provider abroad in order to generate replies,
- How long chats are kept,
- Who to contact for deletion and other requests,
- That special categories of information, such as health information, should not be written in the chat.
Putting this information in a short sentence in the chat window, with the details in the privacy notice, is a simple way to inform visitors without greeting them with a long text. Visitors use a tool more comfortably when they know what it is; uncertainty, on the other hand, can put them off asking questions at all.
This information should also appear in your own privacy notice on your website. Decide on the wording and scope of the notice together with your own legal adviser.
Points to watch
Do not put customers' personal data into the information you give the assistant; what the assistant needs to know is general information such as your services, prices, address and opening hours. Warn visitors not to write special categories of personal data in the chat; this warning is especially important for businesses working in healthcare. Because chat summaries arrive in your email, how those emails are stored and who can access them is now up to your own arrangements. When you see a wrong or inappropriate chat, delete it without waiting for the 180 days. We explained what can be done in case the assistant gives a wrong answer in the article if the assistant gives a wrong answer. You can see how the product works on the AI Customer Assistant page. What is described here relates to the URİKEM product and is not a substitute for legal advice.
Frequently asked questions
How long are chats kept in a website AI assistant?
In the URİKEM AI Customer Assistant, chats are deleted automatically 180 days after the last message. The business can delete a chat at any time without waiting for this period.
Do messages written to the assistant go abroad?
Yes. So that a reply can be generated, messages are transferred to an AI service provider based abroad. Visitors are informed of this and asked for consent before their first message.
Who is the data controller for the assistant's data?
The business that uses the assistant on its own website is the data controller; URİKEM is the data processor acting on the business's behalf. For your own obligations, get the opinion of your legal adviser.
Is there a job that keeps repeating at your company? Tell us about it and we will build the tool that does it.
Tell us what you needOther articles
Why do automation projects fail?
Automation projects usually fail not because the software is broken, but because the organisation around the work was never set up. The five most common reasons are: the scope growing along the way, messy data, only one person using the tool, no training for the team, and nobody owning maintenance after setup. All five can be discussed before the work begins.
29 September 2026Read →What should you check before having a website built?
When having a website built, most attention goes to design, yet the issues that cause the most trouble later stay on the unseen side: whose name the domain and hosting are registered under, who holds the text, how fast the site opens on a phone, and whether it has been submitted to Google. A company that settles these four points from the start also removes the risk of losing its site years later.
28 September 2026Read →Does automating social media make a brand feel like a robot?
Automating social media does not make a brand feel robotic; what does is text published without anyone reading it and comments left unanswered. In the right setup, the calendar, preparation and timed publishing run automatically; the brand's voice, final approval and conversation with customers stay with a person.
28 September 2026Read →Is it safe to move our data to the cloud, or should we keep it on our own server?
The cloud is neither safe nor unsafe in itself; what determines security is whose responsibility the data sits under, who can access it and how it is backed up. If you can answer these three questions clearly, your data is safe whether it is on your own server or in the cloud; if you cannot, changing its location will not solve the problem.
27 September 2026Read →What determines the cost of AI software?
The cost of AI software is made up of four items: setting up the work, monthly use and hosting, the usage fee for the AI model, and maintenance. In a ready-made package these items are combined into a single monthly fee; for a custom tool, a separate quote is given according to the size of the job. The hidden cost is often in maintenance and data preparation.
27 September 2026Read →Do you have to prepare the monthly sales report by hand every month?
If the report is prepared every month from the same source, in the same layout and with the same calculations, you do not have to prepare it by hand. An automation that takes the data and produces the tables, charts and summary by the same rules reduces copy-paste errors and delivers the report in the same format every month.
26 September 2026Read →What does an unanswered phone cost a business?
The cost of an unanswered phone is the customer who made that call ringing another company instead. An online booking system lets customers book their own appointment outside business hours and at busy times too; reminders and easy cancellation reduce the slots that go unused.
26 September 2026Read →Which questions can an AI customer assistant answer?
An assistant answers well the questions that can be answered with the information the company gives it: prices, opening hours, address, scope of services, appointments and return terms. Questions that require a decision, negotiation or individual review should be passed to a person without guesswork.
25 September 2026Read →Turning hundreds of PDFs and documents into one table: by hand or with AI?
If there are few documents and they share the same layout, manual entry may be enough. If documents number in the hundreds, their layouts differ and new ones keep arriving, reading them with AI and turning them into a table makes more sense; but suspicious fields must be checked by a person.
25 September 2026Read →How many days does an automation project take?
Duration is set not by how much code is written but by how organized the data is and who needs to approve, and when. Even a simple task can stretch out as more approvers get involved.
23 September 2026Read →Does a small company need an AI budget?
The budget is not set by the size of the company but by how many hours a specific task wastes. A small company can also start with a single repeating task and a measurable budget.
23 September 2026Read →Who benefits from an appointment system?
An appointment system can help when customers need to reserve a time slot and arranging those slots by phone interrupts your work. First clarify service durations, shared resources and exceptions.
22 September 2026Read →What if AI makes things up?
A fluent answer is not verified information. A business tool needs more than well-written output: it needs a workflow that prevents actions based on incorrect or incomplete information.
22 September 2026Read →Can a spreadsheet with thousands of rows be entered into a system in bulk?
In most cases, yes. The hard part is not the entry itself but getting the data into the shape the system expects and verifying that every row was really saved. If the system offers no bulk route, the work goes through the screen, and that depends on the rules of that system.
21 September 2026Read →Why does preparing a quote take so long?
Writing the quote does not take long; the time goes into hunting for the price, copying and correcting an old quote, and rebuilding the layout every time. Once the price list sits in one place and the rules are written down, a quote comes out in minutes.
21 September 2026Read →Which jobs are suited to automation, and which are not?
The job best suited to automation is one that repeats often, whose rules can be written down and whose data is already digital. Work that needs judgement, is full of exceptions or has its data on paper needs another step first.
18 September 2026Read →What if the AI assistant on your site gives a wrong answer?
The risk is real, but manageable. An assistant's wrong answer usually comes from guessing about something it does not know. The solution is to draw a clear line from the start around what the assistant knows and does not know, and to have it hand over to a person when it does not know.
18 September 2026Read →Is ranking in Google the same as being mentioned by AI?
Partly. Both draw on the same foundation, but they do not reward the same thing: Google ranks a page, while AI reads several sources, writes an answer and decides for itself who to mention in it.
17 September 2026Read →Why doesn't ChatGPT mention my company?
The reason is rarely “the AI does not like us”. Usually it is a technical block, scattered company information, or the company not being mentioned anywhere else online. All three can be fixed.
17 September 2026Read →What should your site have so AI describes you correctly?
When AI describes a company, it uses the clearest sentences it finds on the site. The list below goes page by page through where those sentences should sit, how they should be written and the markup machines will read.
17 September 2026Read →What is GEO? Being visible in AI answers
GEO (Generative Engine Optimization) is the work of making sure that when ChatGPT, Gemini, Perplexity and Google's AI Overviews answer a question, they find your business, describe it correctly and cite it as a source. It does not replace SEO; it builds on top of it.
17 September 2026Read →Will an AI tool learn my company's data?
Short answer: not in a tool running through a commercial API. But that answer depends on how the setup was done, so it is worth knowing what goes where.
16 September 2026Read →When does a spreadsheet stop being enough?
Excel is not a bad tool; it handles most jobs and more. The problem is carrying on with it for months after the point where it stopped being the right fit.
16 September 2026Read →Off-the-shelf software or custom-built?
The right answer depends on how specific the work is to you. Work that everyone does the same way is cheaper off the shelf; work you do your own way is cheaper built for you.
16 September 2026Read →