Privacy Policy

1. Who We Are

Adapptiv is a software service operated by the sole proprietorship identified below.

In this policy, "Adapptiv", "we", "us" and "the platform" refer to the services provided by the above entity.

1.1. Two distinct roles

Where Adapptiv is the data controller. For account and usage data belonging to the businesses that subscribe to Adapptiv and to their panel users (owners, managers, staff), Adapptiv determines the purposes and means of processing and acts as controller.

Where Adapptiv is the data processor. For data belonging to the end customers of those businesses — customer records, appointments, message content, service history, payment records — the subscribing business is the data controller. Adapptiv processes this data solely on that business's instructions and for the purpose of delivering the service. Adapptiv does not use it for its own purposes.

This means the obligation to inform end customers, obtain consent where required, and respond to their data subject requests rests with the subscribing business. See Section 14.

2. Scope

This policy covers the Adapptiv website, web panel, and mobile applications (Android and iOS), and all services delivered through them.

Adapptiv provides appointment scheduling, customer relationship management (CRM), AI-assisted customer messaging, WhatsApp and Instagram messaging integrations, Meta advertising performance analytics, bookkeeping and cash management, staff management, campaign management and reporting for appointment-based businesses.

Adapptiv processes personal data in accordance with Turkish Law No. 6698 on the Protection of Personal Data (KVKK) and other applicable legislation.

3. Data We Process

3.1. Business and panel user data Adapptiv acts as controller

3.2. End customer data of subscribing businesses The subscribing business acts as controller; Adapptiv acts as processor

4. Purposes of Processing

• Creating, verifying and managing user accounts
• Creating, rescheduling, cancelling and reminding of appointments
• Providing CRM and customer relationship management functionality
• Receiving, answering and displaying customer messages from WhatsApp and Instagram
• Running AI-assisted automatic replies and appointment actions
• Correlating Meta advertising performance with appointment and revenue data
• Providing bookkeeping, cash and collection management
• Building campaigns and customer segments
• Reporting and analytics
• Technical support and troubleshooting
• Information security and abuse prevention
• Meeting legal obligations and resolving disputes

5. WhatsApp Integration

Adapptiv integrates with the WhatsApp Business Platform (Cloud API). The connection is established only through Meta's Embedded Signup flow and only with the subscribing business's own authorisation.

5.1. Permissions requested and data received

Data processed under these permissions: message content (text, media, location), sender and recipient phone numbers, WhatsApp profile name, message IDs, timestamps and delivery statuses.

5.2. Connecting an existing number (Coexistence) and history synchronisation

A business may connect the phone number it already uses in the WhatsApp Business app without losing it. In this connection type, if the business explicitly consents, its existing chat history and contact list are imported into Adapptiv:

• One-to-one conversations from up to 180 days before the connection
• Names and phone numbers from the contact list
• Copies of messages the business subsequently sends manually from its phone (stored so that the conversation appears complete in the panel)

Group chats are never imported or processed. The business grants history-sharing consent from within the WhatsApp Business app during connection; if consent is not granted, no historical data is transferred and only messages sent after connection are processed.

5.3. Disconnecting

A business can disconnect at any time from the WhatsApp Business app via Settings → Account → Business Platform → Disconnect. After disconnection Adapptiv can no longer send or receive messages. For deletion of previously received messages, see Section 10.

6. Instagram Integration

Adapptiv can bring a business's Instagram professional account direct messages and comments into the panel and reply to them.

6.1. Permissions requested and data received

Data processed under these permissions: message and comment content, the sender's Instagram username and platform-scoped ID, profile picture, message IDs and timestamps.

6.2. Limits

Instagram data is used solely to let the business handle customer communication and create appointments. We do not collect follower lists, post content or profile data for any purpose beyond customer messaging. When a user unsends a message, that message is removed from the conversation record in Adapptiv as well.

7. Meta Advertising Data

Where the business authorises it, Adapptiv reads performance data from the business's Meta ad accounts: campaign, ad set and ad details; spend, impressions, reach and click metrics; lead and conversion records.

We use this data to correlate advertising with the resulting appointments and collected revenue, so the business can see the real return on its ad spend. Connecting an ad account is optional and can be removed from the panel at any time.

8. Our Commitments Regarding Meta Platform Data

For data obtained from Meta platforms (WhatsApp, Instagram, Meta advertising services), Adapptiv commits that:

• This data is never sold, rented or otherwise transferred to third parties for commercial gain.
• This data is never used for advertising targeting and is never shared with ad networks.
• Message content is never used to train AI models; our agreements with AI service providers prohibit training on this data.
• Data is processed only to the minimum extent necessary to deliver the service to the business.
• Each business's data is isolated from every other business at the database level; no business can access another business's messages or customers.
• This data is never shared with any Adapptiv customer other than the business it belongs to.

9. AI Services

Adapptiv uses AI to interpret customer messages and generate replies — determining message intent, creating, rescheduling or cancelling appointments, evaluating customer history, building segments and producing analytics for the business.

Provider: OpenAI services are used for message interpretation and reply generation. Only the message text and the minimum context required for the appointment action are sent to the provider. Under our agreement with the provider, this data is not used for model training.

If the provider changes, this policy will be updated to name the current provider.

AI-generated replies and analyses are produced automatically and are not guaranteed to be error-free or complete. A business can take over a conversation from the panel at any time and continue it manually.

10. Service Providers, Retention and Deletion

10.1. Service providers

Beyond these, personal data is disclosed only to competent public authorities where legally required.

10.2. International transfers

Because some providers are located outside Türkiye, personal data is transferred abroad to deliver the service. Such transfers are carried out under Article 9 of the KVKK on the basis of standard contractual clauses signed with the relevant providers. Where no such clauses are in place, transfer occurs only with the data subject's explicit consent or under another statutory exception.

10.3. Retention periods

At the end of these periods data is deleted, destroyed or irreversibly anonymised.

10.4. Deletion requests

To request deletion of your personal data, follow the steps at /data-deletion or email info@adapptivdigital.com. Requests are completed within 30 days and the outcome is communicated to you. Data obtained through Meta accounts can be deleted through this same channel.

When a business removes its WhatsApp or Instagram connection, access tokens are revoked and deleted immediately and message flow stops. Previously received messages remain available in the panel for the retention period above unless the business requests otherwise; on request, all message history from that platform is deleted within 30 days.

11. Data Security

• TLS encryption for all data in transit
• Meta and other third-party access tokens stored encrypted with AES-256-GCM
• Row-level security (RLS) at the database layer enforcing tenant isolation between businesses
• Role-based authorisation and least-privilege access
• Access and activity logging
• Regular backups
• Multi-factor authentication on administrator accounts
• Staff bound by confidentiality obligations

12. Data Breach Notification

If personal data is unlawfully obtained by third parties, Adapptiv will notify the Turkish Personal Data Protection Board and the affected data subjects as soon as possible and in any event within 72 hours.

Where Adapptiv acts as processor (see Section 1.1), the breach is reported to the subscribing business without undue delay; the obligation to notify the Board rests with that business as controller.

13. Children's Data

Adapptiv does not offer services directly to persons under 18 and does not knowingly collect personal data from them. Where a subscribing business's customer records include minors, ensuring that such data is processed with parental or guardian consent is that business's responsibility.

14. Obligations of the Subscribing Business

The business using the platform is the data controller for its own customers' and staff data, and is responsible for:

• Informing its customers as required by Article 10 of the KVKK
• Obtaining explicit consent where required, including commercial electronic message permissions via İYS
• Ensuring data uploaded to the system was lawfully obtained
• Responding to data subject requests from its own customers
• Keeping data accurate and up to date
• Confirming it is authorised over the WhatsApp, Instagram and ad accounts it connects
• Keeping panel account credentials secure

Adapptiv is not responsible for consequences arising from a business's failure to meet these obligations.

15. Your Rights

Under Article 11 of the KVKK you have the right to: learn whether your personal data is processed; request information about such processing; learn the purpose of processing and whether the data is used accordingly; know the third parties to whom data is transferred in Türkiye or abroad; request correction of incomplete or inaccurate data; request erasure or destruction under the conditions set out in the law; request that correction, erasure and destruction be notified to third parties to whom the data was transferred; object to adverse outcomes arising from automated analysis; and claim compensation for damage arising from unlawful processing.

How to contact us

Requests are answered within 30 days.

If you are a customer of a business that uses Adapptiv, contacting that business directly will usually be faster, since it is the controller for your data. Requests of this kind received by Adapptiv are forwarded to the relevant business.

16. Cookies

Cookies and similar technologies are used on the Adapptiv website and web panel to maintain sessions, ensure security, measure performance and improve the user experience. Strictly necessary cookies cannot be disabled. For non-essential cookies, user preference is collected and can be changed at any time.

17. Changes to This Policy

Adapptiv may update this policy in response to changes in legislation, technical infrastructure or the scope of the service. The updated policy takes effect when published on this page. Panel users are notified of material changes by email or in-app notice.

Türkçe sürüm / Turkish version: /gizlilik. In case of conflict, the Turkish text prevails.