1. Identity of the Data Controller
Your personal data is processed by Farvex Labs LLC ("Dentexa AI") as data controller within the scope described below.
- Legal name
- Farvex Labs LLC
- Address
- 30 N Gould St #57914, Sheridan, WY 82801, Sheridan, Wyoming, United States
- support@dentexa.co
- Phone
- +1 (210) 996-5020
Who is this notice for?
This notice addresses clinic representatives subscribing to Dentexa AI, their team members, website visitors, job applicants and persons submitting support requests. For patients contacting a clinic's WhatsApp line, the controller is that clinic; see our Consent and Patient Notice page for the applicable text.
2. Categories of Personal Data Processed
| Category | Data processed |
|---|---|
| Identity | Name, surname; authorised representative for legal entities |
| Contact | Email address, phone number, clinic name and address |
| Customer transaction | Subscription plan, order and invoice records, payment status, support requests |
| Transaction security | IP address, session records, password hash, sign-in times, audit logs, cookie data |
| Financial | Invoice details, payment reference numbers (no card data is processed) |
| Professional experience | CV and education details where a job application is made |
| Marketing | Newsletter preferences, campaign communication permissions |
3. Purposes of Processing
- Creating a membership record and managing the account,
- Providing the Service and monitoring subscription and usage limits,
- Managing contractual processes, invoicing and collection,
- Handling requests and complaints and providing support,
- Ensuring information security and preventing unauthorised access and abuse,
- Measuring and improving service quality and statistical analysis,
- Fulfilling legal obligations under tax, commercial and e-commerce legislation,
- Exercising the right of defence in disputes and responding to requests from public authorities,
- Sending commercial electronic messages and marketing where you have given explicit consent.
4. Method of Collection and Legal Basis
Your personal data is collected electronically, by wholly or partly automated means, through forms on the website and dashboard, email correspondence, cookies, notifications from the payment provider and system logs.
| Legal basis (Art. 5 KVKK) | Related processing |
|---|---|
| Art. 5(2)(a) — expressly provided for by law | Records under tax, commercial and e-commerce legislation |
| Art. 5(2)(c) — necessary for conclusion or performance of a contract | Membership, subscription management, provision of the Service, support |
| Art. 5(2)(ç) — compliance with a legal obligation | Issuing invoices, responding to official requests |
| Art. 5(2)(e) — establishment, exercise or protection of a right | Evidence in disputes, audit logs |
| Art. 5(2)(f) — legitimate interest | Information security, fraud prevention, service improvement |
| Art. 5(1) — explicit consent | Commercial electronic messages, non-essential cookies, consent-based international transfers |
5. Transfer of Personal Data
Limited to the purposes above, your data may be transferred to our service providers, to legally authorised public authorities, and to our legal and financial advisers. Your data is not sold to third parties for marketing purposes.
International transfers: some of our providers are established abroad. Transfers are made under Article 9 KVKK on the basis of the standard contracts or undertakings published by the Board and, where unavailable, on your explicit consent.
| Recipient group | Purpose of transfer | Location |
|---|---|---|
| Supabase Inc. | Database, authentication and file storage | UK (London) |
| Meta Platforms, Inc. (WhatsApp Business Platform) | Message delivery over WhatsApp | USA / EU |
| OpenRouter, Inc. ve bağlı model sağlayıcıları | Generation of AI (LLM) responses | USA |
| Google LLC (Google Calendar API) | Appointment calendar synchronization | EU / USA |
| Open Dental Software, Inc. (yalnızca bu PMS'i bağlayan klinikler için) | Writing the approved appointment into the practice management software | USA |
| Dentally Ltd. (yalnızca bu PMS'i bağlayan klinikler için) | Writing the approved appointment into the practice management software | United Kingdom / EU |
| DodoPayments Ltd. | Payment processing and subscription management | United Kingdom |
| Railway Inc. | Application hosting and infrastructure | USA / EU |
6. Retention Period
Your data is retained for as long as the processing purpose requires and for the statutory limitation periods. Once these expire, data is deleted, destroyed or anonymised under our Retention and Destruction Policy. See section 8 of the Privacy Policy for the detailed schedule.
7. Your Rights under Article 11 KVKK
By applying to the data controller you have the right to:
- Learn whether your personal data is processed,
- Request information if it has been processed,
- Learn the purpose of processing and whether it is used accordingly,
- Know the third parties to whom data is transferred at home or abroad,
- Request rectification of incomplete or inaccurate data,
- Request erasure or destruction under Article 7 KVKK,
- Request that such operations be notified to third-party recipients,
- Object to an adverse result arising exclusively from automated analysis,
- Claim compensation for damage arising from unlawful processing.
8. How to Apply
You may submit your requests in the following ways:
- In person or via notary with a signed petition: 30 N Gould St #57914, Sheridan, WY 82801, Sheridan, Wyoming
- By email with a secure electronic or mobile signature: support@dentexa.co
- From the email address registered in our system to support@dentexa.co
Your application must state your full name and, for written applications, your signature; your Turkish ID number (or nationality, passport or identity number for foreign nationals); your address for service; your email and phone where applicable; and the subject of your request, together with any relevant supporting documents.
We conclude applications as soon as possible and within 30 days at the latest. Where the operation entails an additional cost, a fee under the tariff set by the Board may be charged. If your application is refused, the response is unsatisfactory or no reply is given in time, you may complain to the Turkish Data Protection Board within 30 days of becoming aware and in any case within 60 days of the application.
Identity verification
Applications made on behalf of another person require a power of attorney containing specific authority. We may request additional information to verify that the request comes from the genuine data subject; this is a security measure to protect your personal data.