Privacy policy

2. Information we collect

2.1 Account information

• Name, email address, company name and your role and permissions in the workspace
• Password, stored only as a one-way hash that cannot be turned back into the password
• Language preference and the time you accepted the terms of service

2.2 Billing information

• Billing name, tax office and tax number, billing address and billing email, entered by a company admin
• Plan, billing period and plan history

2.3 Channel and integration data

• Identifiers of the accounts you connect: WhatsApp Business phone number and account ID, Instagram account, Facebook Page, Telegram bot
• Access tokens and API credentials for these accounts and for Bitrix24, stored encrypted
• Bitrix24 portal address and Open Lines settings
• Webhook endpoints and automation settings you configure

2.4 Conversation data

• Messages, attachments and their delivery and read status
• Contact details received from the messaging platforms, such as name, phone number or username
• Notes, tags and assignments your team adds to conversations
• Message bodies are encrypted in our database

2.5 Sales inquiries

• Name, work email, company, team size and the message you send through our contact form, with the time of your consent
• Your IP address is stored only as a one-way hash, to limit abuse of the form

2.6 Technical data

• IP address, browser type and access times in server logs
• Error logs that help us diagnose failures
• Daily message counts per channel, which power the reports in your account

3. How we use your information

• Providing the service: creating your workspace, delivering messages through the messaging platforms and showing them in your inbox
• Integrations: synchronising conversations with Bitrix24 and sending events to the webhook endpoints you configure
• Security: signing you in, protecting accounts, recording privileged actions in an audit log and preventing abuse
• Support and service messages: answering your requests and sending account, security and billing emails
• Billing: issuing invoices and keeping the records the law requires
• Legal obligations: responding to lawful requests from authorities

We do not use conversation data for advertising, and we do not sell personal data.

4. Sharing and service providers

We share personal data only as far as needed to run the service:

• Messaging platforms: Meta Platforms (WhatsApp, Instagram and, where enabled, Messenger) and Telegram receive and deliver the messages you send and receive. Their own terms and policies apply, including the WhatsApp Business Policy and the Meta Platform Terms.
• Bitrix24: when you connect a portal, conversations and contacts are synchronised with it according to your settings.
• Infrastructure providers: hosting, network and email delivery providers that store or transmit data on our behalf under confidentiality obligations.
• Services you connect: AI providers you configure in automations with your own API key, and your own webhook endpoints, receive the data your configuration sends them.
• Authorities: when the law, a court order or a binding request from an authority requires it.

The current list of service providers is on our security page.

5. Data security

• Encryption: access tokens, API credentials and message bodies are encrypted at rest with AES-256; all traffic uses HTTPS
• Passwords: stored only as one-way hashes
• Access control: role-based permissions decide what each team member can see and do; privileged actions are recorded in an audit log
• Verified webhooks: incoming platform webhooks are signature-checked, and the webhooks we send you are signed

More detail is on our security page. No method of transmission or storage is completely secure; you are responsible for keeping your sign-in details confidential.

6. Data retention

• Active accounts: we keep account and conversation data while your account is active, until you delete it
• Account deletion: a deletion request is carried out after a 3-day cooling-off period, during which you can cancel it
• Suspended accounts: we send a warning 30 days after suspension and delete the account 7 days after the warning
• Logs and records: operational logs are deleted automatically after fixed periods, listed in the retention table
• Legal records: invoices and records we must keep by law are kept for the period the law requires
• Backups: deleted data can remain in encrypted backups until those backups are replaced

7. Separation of customer data

Each customer's workspace is kept separate from every other workspace. When someone opens a page or calls our API, we check that the data requested belongs to their workspace, and team members only see the channels and conversations their role allows. A phone number, Instagram account or Telegram bot can be connected to one workspace at a time.

8. Your rights

Depending on the law that applies to you, including the GDPR for users in the European Economic Area and the United Kingdom, you can:

• Access your personal data and receive a copy
• Correct inaccurate data, most of it directly in your account settings
• Delete your data; company admins can request deletion of the account from the account settings
• Restrict or object to certain processing
• Take your data with you: company admins can export conversations and contacts as a ZIP archive of CSV files or as JSON
• Withdraw consent where processing is based on consent, for example by disconnecting a channel or integration

Send requests to [email protected]. We verify your identity before acting and reply within one month. If you connected WhatsApp or Instagram through Meta, you can also request deletion from Meta; Meta then sends us a signed deletion request, and you can follow its status on the page we link in our answer.

You can also complain to the data protection authority where you live or work. Section 9 explains the KVKK rights and the Turkish authority.

9. Notice under Turkish data protection law (KVKK)

This notice is provided under article 10 of Law No. 6698 on the Protection of Personal Data (KVKK).

9.1 Data controller

9.2 Purposes

We process personal data to set up and run your account, deliver messages, provide integrations and support, keep the service secure, issue invoices, answer sales inquiries and meet our legal obligations, as described in sections 2 and 3.

9.3 Legal grounds and collection method

We collect personal data electronically through our website, the application, our contact form and the platforms you connect. We process it because it is necessary to set up and perform our contract with you (KVKK article 5/2-c), to meet our legal obligations (5/2-ç), to establish, exercise or defend a right (5/2-e) and for our legitimate interests, provided your fundamental rights are not harmed (5/2-f). Where none of these applies, we ask for your explicit consent.

9.4 Transfers

We transfer personal data to the service providers described in section 4 and to authorities when the law requires it. Some providers, including the messaging platforms and parts of our infrastructure, process data outside Türkiye. Such transfers are made under the safeguards in KVKK article 9, such as standard contracts notified to the Personal Data Protection Authority, or with your explicit consent where the law requires it.

9.5 Your rights under article 11

• Learn whether your personal data is processed
• Request information about the processing
• Learn the purpose of the processing and whether the data is used for that purpose
• Know the third parties in Türkiye or abroad to whom the data is transferred
• Request correction of incomplete or inaccurate data
• Request deletion or destruction of the data under the conditions in article 7
• Request that third parties who received the data are notified of a correction, deletion or destruction
• Object to a result against you that arises solely from automated analysis of the data
• Claim compensation for damage caused by unlawful processing

9.6 How to apply

Send your request in writing to our address above, through registered electronic mail (KEP) if a KEP address is listed, or by email from the address registered with us to [email protected], as set out in the Communiqué on the Procedures and Principles of Application to the Data Controller. We answer free of charge within 30 days at the latest.

9.7 Complaint to the Authority

If your request is refused, the answer is insufficient or we do not answer in time, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurumu) under article 14 of the KVKK.

10. International transfers

Our service providers may process personal data in countries other than yours. Where the law requires a safeguard for such transfers, we use the mechanisms it provides, such as standard contractual clauses, and data is encrypted in transit.

11. Cookies

We use only the cookies that the website and the application need to work. We do not use analytics, advertising or third-party tracking cookies, so we do not show a cookie consent banner.

Your browser settings let you delete cookies at any time. Without these cookies you cannot sign in.

12. Children

Wappline is a business tool and is not intended for people under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact [email protected] and we will delete it.

13. Changes to this policy

When we change this policy we publish the new version on this page with a new version number and date. For material changes we also notify account owners by email before the change takes effect.

14. Contact

For questions or requests about this policy or your personal data, write to [email protected].