Privacy Policy

1. Who We Are

Adapptiv is a software service operated by the company identified below.

In this policy, "Adapptiv", "we", "us" and "the platform" refer to the services provided by the above entity.

1.1. Two distinct roles

Where Adapptiv is the data controller. For account and usage data belonging to the businesses that subscribe to Adapptiv and to their panel users (owners, managers, staff), Adapptiv determines the purposes and means of processing and acts as controller.

Where Adapptiv is the data processor. For data belonging to the end customers of those businesses: customer records, appointments, message content, service history, payment records: the subscribing business is the data controller. Adapptiv processes this data solely on that business's instructions and for the purpose of delivering the service. Adapptiv does not use it for its own purposes.

This means the obligation to inform end customers, obtain consent where required, and respond to their data subject requests rests with the subscribing business. See Section 14.

2. Scope

This policy covers the Adapptiv website, web panel, and mobile applications (Android and iOS), and all services delivered through them.

Adapptiv provides appointment scheduling, customer relationship management (CRM), AI-assisted customer messaging, WhatsApp and Instagram messaging integrations, Meta advertising performance analytics, bookkeeping and cash management, staff management, campaign management and reporting for appointment-based businesses.

Adapptiv processes personal data in accordance with Turkish Law No. 6698 on the Protection of Personal Data (KVKK) and other applicable legislation.

3. Data We Process

3.1. Business and panel user data Adapptiv acts as controller

3.2. End customer data of subscribing businesses The subscribing business acts as controller; Adapptiv acts as processor

4. Purposes of Processing

• Creating, verifying and managing user accounts
• Creating, rescheduling, cancelling and reminding of appointments
• Providing CRM and customer relationship management functionality
• Receiving, answering and displaying customer messages from WhatsApp and Instagram
• Running AI-assisted automatic replies and appointment actions
• Reporting the performance (spend, impressions, clicks, return) of the Meta ad account a business connects
• Providing bookkeeping, cash and collection management
• Building campaigns and customer segments
• Reporting and analytics
• Technical support and troubleshooting
• Information security and abuse prevention
• Meeting legal obligations and resolving disputes

5. WhatsApp Integration

Adapptiv integrates with the WhatsApp Business Platform (Cloud API). The connection is established only through Meta's Embedded Signup flow and only with the subscribing business's own authorisation.

5.1. Permissions requested and data received

Data processed under these permissions: message content (text, media, location), sender and recipient phone numbers, WhatsApp profile name, message IDs, timestamps and delivery statuses.

5.2. Connecting an existing number (Coexistence) and history synchronisation

A business may connect the phone number it already uses in the WhatsApp Business app without losing it. In this connection type, if the business explicitly consents, its existing chat history and contact list are imported into Adapptiv:

• One-to-one conversations from up to 180 days before the connection
• Names and phone numbers from the contact list
• Copies of messages the business subsequently sends manually from its phone (stored so that the conversation appears complete in the panel)

When the business writes to a customer from its own phone, the AI assistant steps back from that conversation and does not reply at the same time.

Group chats are never imported or processed. The business grants history-sharing consent from within the WhatsApp Business app during connection; if consent is not granted, no historical data is transferred and only messages sent after connection are processed.

5.3. Disconnecting

A business can disconnect at any time from the WhatsApp Business app via Settings → Account → Business Platform → Disconnect. After disconnection Adapptiv can no longer send or receive messages. For deletion of previously received messages, see Section 10.

6. Instagram Integration

Adapptiv can bring a business's Instagram professional account direct messages into the panel and reply to them. Post comments are not processed.

6.1. Permissions requested and data received

Data processed under these permissions: message content, the sender's Instagram username and platform-scoped ID, profile picture, message IDs and timestamps.

6.2. Limits

Instagram data is used solely to let the business handle customer communication and create appointments. We do not collect follower lists, post content or profile data for any purpose beyond customer messaging. When a user unsends a message, that message is removed from the conversation record in Adapptiv as well.

7. Meta Advertising Data

Where the business authorises it, Adapptiv reads aggregate performance data from the business's Meta ad account: the account name and metrics such as spend, impressions, clicks and return on ad spend. No personal data about people who saw the ads is received.

We use this data only to report advertising performance to the business. Connecting an ad account is optional and can be removed from the panel at any time; the access token is stored encrypted.

8. Our Commitments Regarding Meta Platform Data

For data obtained from Meta platforms (WhatsApp, Instagram, Meta advertising services), Adapptiv commits that:

• This data is never sold, rented or otherwise transferred to third parties for commercial gain.
• This data is never used for advertising targeting and is never shared with ad networks.
• Message content is never used to train AI models; our agreements with AI service providers prohibit training on this data.
• Data is processed only to the minimum extent necessary to deliver the service to the business.
• Each business's data is isolated from every other business at the database level; no business can access another business's messages or customers.
• This data is never shared with any Adapptiv customer other than the business it belongs to.

9. AI Services

Adapptiv uses AI to interpret customer messages and generate replies: determining message intent; creating, rescheduling or cancelling appointments; suggesting campaign text; and producing business analytics from anonymous aggregate statistics.

Provider: OpenAI services are used for message interpretation and reply generation. Only the message text, the customer's name and the business details needed for the booking (services, hours) are sent to the provider. Customer notes, health information, tags, custom fields and customer files are never sent to the AI provider. Under the provider's API terms, this data is not used for model training.

If the provider changes, this policy will be updated to name the current provider.

AI-generated replies and analyses are produced automatically and are not guaranteed to be error-free or complete. A business can take over a conversation from the panel at any time and continue it manually.

10. Service Providers, Retention and Deletion

10.1. Service providers

Beyond these, personal data is disclosed only to competent public authorities where legally required.

10.2. International transfers

Because some providers are located outside Türkiye, personal data is transferred abroad to deliver the service. The main database and files are processed in Germany (EU) and emails in Ireland (EU); data is also transferred to the providers listed above as US-based. We work with these providers under data processing agreements that limit processing to delivering the service and impose confidentiality and security obligations. Only the data required for each operation is sent.

10.3. Retention periods

At the end of these periods data is deleted, destroyed or irreversibly anonymised.

10.4. Deletion requests

To request deletion of your personal data, follow the steps on the data deletion page or email info@adapptivdigital.com. Requests are completed within 30 days and the outcome is communicated to you. Data obtained through Meta accounts can be deleted through this same channel.

When a business removes its WhatsApp or Instagram connection, access tokens are revoked and deleted immediately and message flow stops. Previously received messages remain available in the panel for the retention period above unless the business requests otherwise; on request, all message history from that platform is deleted within 30 days.

You can close your account in the app via Settings → Delete my account. When the only administrator of a business deletes their account, all of that business's data is permanently deleted. Before closing, you can export your data as an Excel file via Settings → Download my data.

11. Data Security

• TLS encryption for all data in transit
• Meta and other third-party access tokens stored encrypted with AES-256-GCM
• Row-level security (RLS) at the database layer enforcing tenant isolation between businesses
• Role-based authorisation and least-privilege access
• Event logs for appointment and payment operations
• Tenant isolation verified by regular automated security tests
• Session keys stored in the operating system's secure storage on the mobile app
• Customer files kept in private, business-specific storage
• Staff bound by confidentiality obligations

12. Data Breach Notification

If personal data is unlawfully obtained by third parties, Adapptiv will notify the Turkish Personal Data Protection Board and the affected data subjects as soon as possible and in any event within 72 hours.

Where Adapptiv acts as processor (see Section 1.1), the breach is reported to the subscribing business without undue delay; the obligation to notify the Board rests with that business as controller.

13. Children's Data

Adapptiv does not offer services directly to persons under 18 and does not knowingly collect personal data from them. Where a subscribing business's customer records include minors, ensuring that such data is processed with parental or guardian consent is that business's responsibility.

14. Obligations of the Subscribing Business

The business using the platform is the data controller for its own customers' and staff data, and is responsible for:

• Informing its customers as required by Article 10 of the KVKK
• Obtaining explicit consent where required, including commercial electronic message permissions via İYS
• Ensuring data uploaded to the system was lawfully obtained
• Responding to data subject requests from its own customers
• Keeping data accurate and up to date
• Confirming it is authorised over the WhatsApp, Instagram and ad accounts it connects
• Keeping panel account credentials secure

Adapptiv is not responsible for consequences arising from a business's failure to meet these obligations.

15. Your Rights

Under Article 11 of the KVKK you have the right to: learn whether your personal data is processed; request information about such processing; learn the purpose of processing and whether the data is used accordingly; know the third parties to whom data is transferred in Türkiye or abroad; request correction of incomplete or inaccurate data; request erasure or destruction under the conditions set out in the law; request that correction, erasure and destruction be notified to third parties to whom the data was transferred; object to adverse outcomes arising from automated analysis; and claim compensation for damage arising from unlawful processing.

How to contact us

Requests are answered within 30 days.

If you are a customer of a business that uses Adapptiv, contacting that business directly will usually be faster, since it is the controller for your data. Requests of this kind received by Adapptiv are forwarded to the relevant business.

16. Cookies

No advertising, analytics or tracking cookies are used on the Adapptiv website or web panel. The web panel uses the browser's local storage only to keep you signed in; this is strictly necessary and is cleared when you sign out. If a non-essential cookie is ever added, this policy will be updated first and your preference collected.

17. Changes to This Policy

Adapptiv may update this policy in response to changes in legislation, technical infrastructure or the scope of the service. The updated policy takes effect when published on this page. Panel users are notified of material changes by email or in-app notice.

Türkçe sürüm / Turkish version: /gizlilik. In case of conflict, the Turkish text prevails.