1. Controller and scope
1.1 This Policy explains how Çallıoğlu İnşaat Turizm Sanayi ve Ticaret A.Ş. ("Otai") uses cookies and similar browser-storage technologies on the Otai website, web application, administration panels and embedded Otai interfaces.
1.2 Registered office: Sedir Mahallesi, 725. Sokak No: 2, Muratpaşa, Antalya, Türkiye Email: info@otai.app Website: https://otai.app/
1.3 Cookies and similar technologies store or access information on your device to support the purposes described below.
1.4 Where an Otai interface is deployed for a Customer Business and that business determines the purposes of end-user processing, the Customer Business is normally the controller and its own notice and consent interface are primary. This Policy still describes the relevant technical behaviour. Otai is controller where it determines the purpose and means for its own website, accounts, security, support or optional analytics/diagnostics.
2. Our categories
2.1 Otai does not currently use advertising or behavioural-marketing cookies under this inventory. If that changes, this Policy and the consent interface must be updated before those technologies are activated.
- Strictly necessary and functional technologies authenticate users, protect the service, maintain a requested session, complete a login or account-merging flow, continue a user-requested action, or remember a choice the user has expressly made. They are not used for advertising. Where their use is objectively necessary for the requested service or rests on another applicable legal basis, separate consent is not requested.
- Preference technologies remember interface choices such as language or menu state. They are used without separate consent only when created as a direct result of the user’s express choice and only for that requested function. Otherwise they are disabled until permission is given.
- Analytics technologies measure pages, events, sessions and product usage. They are optional and remain disabled unless the user gives the separate analytics choice described below.
- Session replay and enhanced diagnostics may capture interaction, performance and error information to reproduce a technical problem. They are optional and remain disabled unless the user gives the separate session-replay choice described below.
3. Strictly necessary and functional inventory
| Technology / provider | Storage and party | Purpose | Trigger and technical lifetime | Consent status |
|---|---|---|---|---|
__session / Otai application and Firebase Admin | Cookie; first-party | Authenticates authorised administration users and prevents unauthorised access. | Created after authorised login. Default expiry is 5 days and may be shortened or changed by the secure environment configuration. | Required for authenticated administration; no optional-cookie consent. |
otai_whatsapp_login / Otai application | Cookie; first-party | Supports secure verification when you use a WhatsApp login link. | Created when a WhatsApp login link is used; expires after 30 minutes. | Required for the user-requested secure login flow. |
__guest_merge_intent / Otai application | Cookie; first-party | Securely combines an anonymous Otai conversation with the user’s email account when the user starts that process. | Created during the requested account-merging flow; expires after 10 minutes. | Required for the requested account-merging flow. |
| Firebase Authentication storage | browser storage; first-party browser context using authentication software | Maintains login status and the authentication session. | Created on Firebase login or anonymous authentication; retained according to the selected session mode and authentication configuration. | Required for authentication and session continuity. |
otai-magic-link / Otai application | browser storage; first-party | Temporarily stores email, account context and return destination during an email magic-link login or registration flow. | Created when the user starts that flow; removed when the flow is completed, cancelled or cleared. | Required for the requested flow. |
otai_widget_guest_id / Otai widget | browser storage; first-party | Maintains the widget visitor/session identifier. | Created when a widget session begins; retained until the session is renewed or browser data is cleared. | Required for widget continuity. |
otai_widget_guest_session / Otai widget | browser storage; first-party | Authenticates chat requests. | Created when a widget session begins; retained until the session token expires or is replaced. | Required for security and widget continuity. |
otai_widget_guest_session_expires / Otai widget | browser storage; first-party | Records when the widget session token expires. | Created with the widget session; retained until the token expires or is replaced. | Required for widget session management. |
otai:deferred-chat-request:v2:<tenant> / Otai application | browser storage; first-party | Continues a user’s pending chat request after a required login. It may temporarily contain text entered by the user. | Created when a protected action redirects the user to login; removed when the browser tab closes or the flow is cleared. | Required only for the user-requested continuation flow. |
| WhatsApp bridge keys / Otai application | browser storage; first-party | Maintains short-lived state for WhatsApp-originated login and account-linking flows. | Created during the WhatsApp login flow; removed when the tab/session ends or after approximately 30 minutes. | Required for the user-requested secure flow. |
4. Preference inventory
| Technology / provider | Storage and party | Purpose | Trigger and technical lifetime | Consent status |
|---|---|---|---|---|
sidebar_state / Otai application | Cookie; first-party | Remembers whether the administration side menu is open or closed. | Created when an authorised user changes that menu preference; expires after 7 days. | Used only following the user’s express interface choice. |
NEXT_LOCALE / next-intl | Cookie; first-party | Remembers the selected interface language and supports language routing. | Created when the user selects or synchronises a language; lasts for the browser session. | Used only following the language choice. |
user-language / Otai application | browser storage; first-party | Remembers a legacy or internal language preference. | Created or updated when the language is changed; remains until replaced or browser data is cleared. | Used only following the language choice. |
otai_widget_locale / Otai widget | browser storage; first-party | Remembers the widget language. | Created or updated when the widget language is changed; remains until replaced or browser data is cleared. | Used only following the language choice. |
5. Optional analytics and diagnostic inventory
| Technology / provider | Storage and party | Purpose | Trigger and technical lifetime | Consent status |
|---|---|---|---|---|
ph_<project>_posthog or an equivalent PostHog key | Cookie and browser storage; first-party storage with disclosure to an analytics service provider | Associates page views, events, a visitor and a session for product analytics. | Must be created only after the user enables Analytics. Its technical lifetime follows the configured analytics settings and must be reconfirmed by a production scan. | Separate analytics consent required. |
otai_widget_<tenantId> or equivalent widget PostHog persistence key | Cookie and browser storage; first-party storage with disclosure to an analytics service provider | Associates embedded-widget use, events and a visitor for product analytics. | Must be created only after the user enables Analytics. Its technical lifetime follows the configured analytics settings and must be reconfirmed by a production scan. | Separate analytics consent required; a general privacy/KVKK acknowledgement is not consent. |
| Vercel Web Analytics | Cookie-free analytics request; third-party recipient when enabled | Measures aggregated traffic, page and performance information without a persistent browser cookie. | Operates only if the analytics feature is enabled and, under this Policy, only after the user enables Analytics. No persistent browser cookie is set. | Included in the separate analytics choice unless a documented assessment confirms that no personal data is processed and another legal basis applies. |
| Sentry performance and replay telemetry | diagnostic data and browser storage; disclosure to an error-monitoring service provider | Measures errors and performance and, if replay is enabled, reconstructs interactions for diagnosis. | Performance/replay collection must begin only after the user enables Session replay and enhanced diagnostics. Storage follows the configured session/provider settings. | Separate session-replay and enhanced-diagnostics consent required. |
5.6 Basic server-side security and error logs that are strictly necessary, appropriately minimised and do not include session replay may be processed separately on an applicable non-consent legal basis. Enabling optional diagnostics does not permit the collection of unnecessary personal data. Consent does not permit unnecessary collection of sensitive fields, message content or form inputs; these are masked or excluded where technically possible.
6. Conditional third-party technologies
6.1 The following technologies were not confirmed as active first-party production cookies in the source-code inventory. They may appear only when the relevant infrastructure or user-selected feature is used:
| Technology | When it may appear | Treatment |
|---|---|---|
__cf_bm or a similar Cloudflare security cookie | If bot-management or comparable security protection is enabled. | May be used without optional-cookie consent only where strictly necessary for security. Its actual name and lifetime must be added after production verification. |
_vercel_* or similar infrastructure cookies | In preview, routing or other Vercel-specific infrastructure flows. | Must not be listed as active production cookies unless confirmed. Any non-essential use must be gated appropriately. |
| Google-domain authentication cookies | When the user expressly chooses Google sign-in and the Google popup or domain is opened. | Set on or by Google-controlled domains for the requested authentication flow and governed additionally by Google’s notices. Actual names and lifetimes depend on that environment. |
7. Choice and consent controls
7.1 On first access, the website must make this Policy readily available and display equally prominent options to:
- Allow all optional technologies;
- Reject all optional technologies; and
- Manage choices.
7.2 The detailed panel must provide separate, off-by-default controls for:
- Analytics; and
- Session replay and enhanced diagnostics.
7.3 No optional technology may load, write storage, identify a user or send an event before the relevant affirmative choice. Closing the banner, scrolling, inactivity or continuing to use the service is not consent. Rejecting optional technologies must not prevent access to the website, chat or core account functions.
7.4 Where preference controls are available, you can use them to change your choice. You can also withdraw consent by contacting info@otai.app or the relevant Customer Business.
7.5 We maintain proportionate records of the consent interface version, timestamp, selected categories and a pseudonymous proof identifier for as long as needed to demonstrate and honour the choice, after which the record is securely deleted or irreversibly anonymised.
7.6 The consent manager must also remember the browser’s choice so that optional technologies remain blocked or enabled as selected. The final name, storage type and technical lifetime of that first-party choice record must be added to the inventory when the consent manager is implemented; it must not be used for analytics or advertising.
8. Data, recipients and international transfers
8.1 Depending on the technology and choice, the processed data may include a pseudonymous visitor/session identifier, page URL, referring page, event, language or interface choice, date/time, IP-derived network information, browser/device details, error and performance details, consent choice, and—in the deferred-chat flow—text entered by the user until the flow or tab ends.
8.2 Data may be disclosed, only as necessary, to authentication, analytics, hosting, security and error-monitoring service-provider categories. Optional consent to analytics or replay is consent to the stated processing purpose; it is not treated as the sole legal mechanism for continuous international transfers. Any international transfer must separately comply with KVKK Article 9 and other applicable law.
9. Retention and changes
9.1 The table lifetimes describe how long a browser identifier or device-storage item is technically configured to persist. Server-side personal data connected with those identifiers is retained only while needed for the relevant purpose, legal obligation, security requirement or proof of choice, and is then deleted, destroyed or irreversibly anonymised.
9.2 This inventory must be checked against the production domains after releases that change authentication, analytics, embedded widgets, error monitoring, hosting or security. If an actual name, provider, purpose, party or lifetime changes, this Policy and the consent interface must be updated before or when the change takes effect, as required by law.