Privacy notice
This notice explains in general terms how personal data is processed on the websites and API service of the 2X product family (Reach2X, Mail2X, Relay2X, TXT2X, OTP2X, WA2X, NOTI2X, PUSH2X). It addresses the information duty under the Turkish Personal Data Protection Law No. 6698 (KVKK) and similar laws; it is not legal advice.
Roles
For recipients and content of messages our customers send through the API, the customer is the data controller and 2X processes that data on the customer’s instructions to provide the service. For account, billing and security records, 2X is the data controller.
The controller’s legal name and contact details are stated in the service agreement and in the console.
What we process
- Account data: name, email address, organization name, role and membership.
- Message data: recipient phone number or email address, message content, sending and delivery events.
- Technical data: request id, IP address, timestamp, the id of the API key used (never its secret).
- This website uses no cookies and no third-party tracking scripts; only your theme preference is stored locally in your browser.
How we protect it
- Phone numbers and email addresses are stored encrypted and masked in API responses.
- Message bodies are kept for the organization’s retention period (default 30 days) and cannot be read back through the API; verification code (otp) content is never stored, only a keyed hash.
- Only a hash of each API key is stored; each organization’s data is isolated from the others.
- Administrative actions are written to an audit log.
Purpose and legal basis
Data is processed to enter into and perform the contract, secure the service, prevent abuse and meet legal obligations, on the corresponding legal grounds.
Commercial electronic messages
For commercial SMS, the customer’s İYS (Turkish message management system) brand code and the recipient’s consent are required; recipients without consent do not receive commercial messages. Obtaining and managing consent is the sender’s responsibility.
Transfers
Data is shared only with the infrastructure and communication service providers needed to deliver the service, and only as far as needed. Lawful requests of competent authorities are reserved.
Retention
Data is kept as long as the purpose and legal retention periods require, then deleted or anonymized.
Your rights
You may ask whether your data is processed, request information, correction, deletion and object. For a message sent by one of our customers, please contact the sending organization first. Requests about your 2X account can be submitted through the console.
Changes
This notice may be updated; the current version is always on this page. Last updated: 14 November 2026.