Privacy Policy

1. Who we are

MAHAM Social (https://social.maham.team) is one place to manage a business’s social media: a unified inbox (Facebook, Instagram, WhatsApp, TikTok, email and other channels), publishing, and an optional AI agent that the organization configures and trains itself.

It is a separate product from MAHAM CRM, with separate accounts and infrastructure.

Operator: [Legal entity and address — to be completed by the lawyer]

This policy addresses businesses (including clinics, medical tourism companies, agencies and marketing teams) and individual content creators. The minimum age is 18, and use is professional.

2. Our role

For the organization’s account data (users’ names, emails, password hashes, organization name, settings, logs), MAHAM Social is the data controller.

For the messages, contacts and content of the organization’s customers that arrive through the social accounts the organization connects, the organization is the controller and MAHAM Social processes them on its behalf. A data processing agreement will follow [data processing agreement — to be prepared by the lawyer].

3. Data we collect

• Account data: name, email, password (stored as a hash), organization name, settings.
• Connected-account data: tokens and profile information obtained through Zernio or direct platform connections.
• Messages, comments and contact details from connected channels.
• Posts and media the organization publishes.
• AI agent configuration and knowledge sources the organization uploads.
• Technical logs (IP address, browser, timestamps) for security.
• Support communications.

4. Why we use data

To run the service (unified inbox, publishing, agent), to protect accounts and prevent abuse, to answer support requests, and to meet our legal obligations. We do not sell data and do not use it for advertising.

5. Who receives data

• Zernio: the connection and messaging API for social accounts.
• The social platforms the organization connects (Meta: Facebook, Instagram, WhatsApp; TikTok; Google; and others), under their own terms.
• The AI provider the organization chooses and connects with its own API key, under the organization’s own agreement with that provider. MAHAM Social does not resell AI credits.
• Hosting provider: [Hosting provider and country — to be completed by the lawyer]
• An email-sending provider and a payment provider will be added later [to be completed before commercial launch].

6. Artificial intelligence

AI is optional and off unless the organization’s admin turns it on and acknowledges the AI text (link: /legal/ai). AI replies may be inaccurate. The organization is responsible for its agent’s configuration, training material and replies, and should keep human oversight. A human can take over any conversation at any time.

7. Cookies

We use no analytics or advertising cookies.

• __Host-maham_social: session cookie, strictly necessary, sliding 30 days.
• maham_lang: language preference, 1 year.

8. Security

Secrets are encrypted at rest, the session cookie is host-only, connections use HTTPS, and this product runs under a separate server user and a separate database. No system is perfectly secure; we will notify those affected by a breach as the law requires.

9. Retention

We keep account data while the account is active. After a deletion request, data is deleted within 30 days [proposed — for legal review], and copies remain in backups until their cycle ends: daily backups are kept 14 days and pre-update backups up to 30 days.

10. Your rights

We respect the Turkish personal data protection law (KVKK, Law No. 6698) and, where applicable, the GDPR. You may request access, rectification, deletion, objection, restriction and portability, and you may complain to the competent authority (the KVKK Board or the relevant data protection authority).

To exercise your rights, contact us: info@maham.team

If you are a customer of an organization on the platform, please first direct your request to that organization, which is responsible for your data.

11. Changes and contact

We may update this policy and will notify users of material changes before they take effect. Contact: info@maham.team

Governing law: [Governing law and competent courts — to be completed by the lawyer]