Privacy Policy

This policy explains what data is processed when you use HeppChat (the “Service”), why it is processed and how long it is retained. HeppChat is customer communication software that lets businesses manage messages arriving over WhatsApp, Instagram and Messenger from a single panel.

1. Our roles

The business using the Service (the “Store”) is the data controller of the message and contact data belonging to its own customers. HeppChat is the data processor, processing that data solely on behalf of and under the instructions of the Store. For the Store's own account data (panel users, billing), HeppChat is the data controller.

2. Data we process

HeppChat does not store payment instrument data such as card numbers; payments are handled by licensed payment institutions.

3. Data received from Meta platforms

When a Store connects its WhatsApp Business account, Facebook Page or Instagram account to HeppChat, data transferred to us by Meta Platforms is used only for the following purposes:

• allowing the Store to converse with its own customers and view message history,
• generating automated replies to incoming messages and handing over to a human agent when needed,
• showing the Store reports about its own account.

We do not use data received from Meta for advertising, do not sell it, do not transfer it to data brokers and do not disclose it to third parties other than the Store. This data is kept within the relevant Store's own space; no other Store can access it.

4. Use of artificial intelligence

To generate automated replies, message content, product information and store settings may be sent to AI providers (OpenAI, Google) over their APIs. Enterprise API terms apply with these providers and it is a requirement that the data is not used to train provider models. A Store can turn AI features off from the panel settings.

5. Conversations with the HeppChat Assistant

When you write through the chat window on heppchat.com or in the HeppChat panel, or to HeppChat's own social media accounts, you are talking to the HeppChat Assistant. For these conversations HeppChat is the data controller.

• Data processed: your messages, the page address where the chat started and your language preference; if you ask our team to get back to you, the name, e-mail and phone you provide. If you write from the panel, your account's and store's plan, usage and connected-channel information is read to answer your question and is never changed. IP address and browser information are not stored in raw form; they are kept as an irreversible hash to prevent abuse.
• Our social media accounts: when you write to us on Instagram or Messenger, Meta passes us your display name and username together with your message. Voice messages you send are transcribed so they can be answered, and photos are shown to the AI to produce a reply; copies of voice messages and photos are deleted after 90 days. When our team takes over the conversation, they reply in the same thread.
• Purpose: answering your questions, handing over to our team when needed and getting back to you, preventing abuse.
• Artificial intelligence: replies are generated with AI; your messages are sent to AI providers for this purpose (see Section 4). The assistant can make mistakes; for prices and terms, the relevant pages on the site and the agreements prevail. You can ask to talk to a team member at any time.
• Browser: after your first message, a chat identifier is saved in your browser so you can continue the conversation (Cookie Policy).
• Retention: conversations and the contact details you provide are deleted automatically 12 months after the last message in the chat. A conversation linked to an open support ticket is kept until the ticket is closed.

6. Transfers and infrastructure

• Supabase (PostgreSQL database and file storage) — hosting
• Meta Platforms — WhatsApp / Instagram / Messenger message delivery
• OpenAI, Google — AI reply generation
• Server hosting provider — application servers

Some of these providers are located outside Türkiye, so data is transferred abroad in order to provide the service.

7. Retention periods

• Message and conversation data is kept for as long as the Store's subscription continues.
• When a channel connection is removed, that channel's data immediately becomes inaccessible in the panel and is permanently deleted after 30 days. This window exists so an accidental disconnection can be undone.
• When an account is closed, account and content data is deleted within 30 days at the latest; removal from backups does not exceed 90 days.
• HeppChat Assistant conversations are deleted 12 months after the last message in the chat (Section 5).
• Records that must be kept by law (e.g. invoices) are retained for their statutory periods.

8. Security

All traffic is encrypted with TLS. Passwords are stored irreversibly (bcrypt). Panel access is role and permission based; each Store's data is separated server-side by a tenant boundary. Access records are kept.

9. Your rights

Under KVKK art. 11 and the GDPR you have the right to access your data, request its correction, deletion or restriction of processing, and to receive your data in a portable format. See the Data Deletion Request page or write to us directly.

If you are an end customer (someone who messaged a store on WhatsApp), please address your request to the store you were messaging first; we fulfil such requests when the store refers them to us.

10. Children's data

The Service is not intended for anyone under 18 and we do not knowingly collect data about children.

11. Changes

When this policy is updated it is published on this page and the “last updated” date is changed. Material changes are announced to Stores through the panel.