Privacy Policy

This policy explains what data is processed when you use HeppChat (the “Service”), why it is processed and how long it is retained. HeppChat is customer communication software that lets businesses manage messages arriving over WhatsApp, Instagram and Messenger from a single panel.

1. Our roles

The business using the Service (the “Store”) is the data controller of the message and contact data belonging to its own customers. HeppChat is the data processor, processing that data solely on behalf of and under the instructions of the Store. For the Store's own account data (panel users, billing), HeppChat is the data controller.

2. Data we process

HeppChat does not store payment instrument data such as card numbers; payments are handled by licensed payment institutions.

3. Data received from Meta platforms

When a Store connects its WhatsApp Business account, Facebook Page or Instagram account to HeppChat, data transferred to us by Meta Platforms is used only for the following purposes:

• allowing the Store to converse with its own customers and view message history,
• generating automated replies to incoming messages and handing over to a human agent when needed,
• showing the Store reports about its own account.

We do not use data received from Meta for advertising, do not sell it, do not transfer it to data brokers and do not disclose it to third parties other than the Store. This data is kept within the relevant Store's own space; no other Store can access it.

4. Use of artificial intelligence

To generate automated replies, message content, product information and store settings may be sent to AI providers (OpenAI, Google) over their APIs. Enterprise API terms apply with these providers and it is a requirement that the data is not used to train provider models. A Store can turn AI features off from the panel settings.

5. Transfers and infrastructure

• Supabase (PostgreSQL database and file storage) — hosting
• Meta Platforms — WhatsApp / Instagram / Messenger message delivery
• OpenAI, Google — AI reply generation
• Server hosting provider — application servers

Some of these providers are located outside Türkiye, so data is transferred abroad in order to provide the service.

6. Retention periods

• Message and conversation data is kept for as long as the Store's subscription continues.
• When a channel connection is removed, that channel's data immediately becomes inaccessible in the panel and is permanently deleted after 30 days. This window exists so an accidental disconnection can be undone.
• When an account is closed, account and content data is deleted within 30 days at the latest; removal from backups does not exceed 90 days.
• Records that must be kept by law (e.g. invoices) are retained for their statutory periods.

7. Security

All traffic is encrypted with TLS. Passwords are stored irreversibly (bcrypt). Panel access is role and permission based; each Store's data is separated server-side by a tenant boundary. Access records are kept.

8. Your rights

Under KVKK art. 11 and the GDPR you have the right to access your data, request its correction, deletion or restriction of processing, and to receive your data in a portable format. See the Data Deletion Request page or write to us directly.

If you are an end customer (someone who messaged a store on WhatsApp), please address your request to the store you were messaging first; we fulfil such requests when the store refers them to us.

9. Children's data

The Service is not intended for anyone under 18 and we do not knowingly collect data about children.

10. Changes

When this policy is updated it is published on this page and the “last updated” date is changed. Material changes are announced to Stores through the panel.