Data Processing Addendum

Application

This Data Processing Addendum ("DPA") applies automatically to every business customer that uses Chatterbox for its team or organization and accepts the Terms of Service. Under it, the customer is the data controller and Dört Yazılım Danışmanlık Ltd. Şti., a company registered in the Republic of Türkiye, is the data processor of the workspace data it handles on the customer's behalf. It is structured on Article 28 GDPR / UK GDPR and the processor obligations of Turkish Law No. 6698 on the Protection of Personal Data (KVKK).

Subject matter, duration, nature and purpose

• Subject matter: Processing of data within Chatterbox spaces you create.
• Duration: For as long as your workspace account is active, and for a reasonable period thereafter for legal compliance and audit purposes.
• Nature: Hosting, storage, retrieval, analysis for abuse prevention, and delivery of services.
• Purpose: To operate the Service as described in the Terms of Service and Privacy Policy.

Data categories and data subjects

• Chat messages: Text, media attachments, reactions, and metadata (timestamps, authorship).
• Space metadata: Space names, descriptions, settings, and room configurations.
• Member data: Email addresses, display names, profile pictures of space members and guests.
• Operational logs: Request traces, IP addresses, user agents for debugging and security.
• Data subjects: Space members, invited users, and any individuals whose data your organization processes within a space (e.g., subjects of discussion).

Processor obligations

• Instructions: We process data only when and how you instruct us. If an instruction violates the GDPR, KVKK, or other applicable law, we will notify you before processing.
• Confidentiality: Our personnel who access personal data are bound by confidentiality.
• Security: We implement and maintain technical and organizational measures to protect data, as detailed in the Security Measures section below.
• Assistance with rights requests: We will, without undue delay, assist you in responding to requests from data subjects exercising their rights under the GDPR, KVKK, and similar laws (access, rectification, erasure, portability, objection, and restriction).
• Breach notification: If we become aware of a personal data breach, we will notify you without undue delay so you can meet your own notification obligations.
• Deletion at the end of the service: what is removed depends on the action taken.
  • When a space owner deletes a space, the space and everything stored under it (rooms, chat messages, memberships, invites and other space data) is deleted from the live database.
  • When a user deletes their own account, their space and group memberships, notifications, read state and favorites are deleted, every session is revoked, and their profile is anonymized (email, name and picture are removed). Thirty days after deletion, the messages, direct messages and uploads they wrote are permanently deleted, along with the earlier revisions of those messages. Messages in audited rooms, and their uploads, are kept under that room's audit retention. Their anonymized account record is kept with no personal data attached, so other people's conversations and spaces stay intact. A user who is the sole owner of a space must transfer ownership first.
  • Earlier revisions of a message (for example earlier versions of an edited message, kept in audit tables) are removed together with the message, by the 90-day sweep and by account erasure. Messages in audited rooms keep their revisions with the message.

Sub-processors

We use the following sub-processors to deliver the Service. Unless explicitly authorized in your subscription agreement, we will not add or replace a sub-processor without at least 30 days' advance notice published on this page. You have the right to object by emailing [email protected].

• Railway — Application, backend and database hosting (region europe-west4).
• Resend — Transactional email for invitations and notifications. Email data is stored in the United States.
• LiveKit Cloud — Real-time audio and video transport for calls. Call media may be routed through servers in different regions depending on participant location.
• Gravatar — Avatar lookup: when a member has not uploaded a profile picture, our server queries Gravatar with a hash of their email address.
• GitLab — Optional GitLab account link for the Issues board: when you link a GitLab account we store your GitLab access token encrypted, with read-only API access, and read the issues you can see there.
• Keycloak — Sign-in service at auth.chatterbox.123dort.com, run on Railway (region europe-west4). It holds your sign-in identity.

Annex: Security measures

We only list measures that are in place in the current code and deployment:

• Encryption in transit: the app is served over HTTPS with a Strict-Transport-Security (HSTS) header.
• Content Security Policy: a nonce-based CSP is enforced; origins outside the policy are blocked, and violations are reported for review.
• Session cookies: HttpOnly, SameSite=Lax and, over HTTPS, Secure. Deleting an account revokes all of its sessions immediately.
• Rate limiting: sign-in link requests are limited per IP address and per email address, and message, reaction, upload and scheduling writes are limited per user.
• Role-based access control: space data is available only to members, and administrative actions are restricted to space owners and admins.
• Audit tables: changes to core records (spaces, rooms, memberships, chat messages and others) are versioned in database audit tables.

We do not currently hold any security certification.

Audits

On request, we will provide documentation that shows how we meet the obligations in this DPA, including a description of the measures above. Send requests to [email protected].

International transfers

Data is hosted in europe-west4. Some sub-processors operate outside Türkiye and the EEA: Resend stores email data in the United States, LiveKit Cloud does not pin call transport to a single region, and Gravatar lookups go to its servers. The Privacy Policy describes these transfers.

Contact

Questions about this DPA, objections to sub-processor changes and audit requests: [email protected]. Data protection requests: [email protected].