Privacy Policy

Who is responsible

For the data of people who sign up for the Service (account holders), ⁨Tryplio⁩ is the data controller.

For the messages and comments that customers send to a business’s WhatsApp, Instagram or Facebook accounts connected to the Service, the business that connected the account is the controller. We process that data on its behalf and on its instructions, as a processor.

What we collect

• Account data: name, email address, password (stored only as a salted hash), preferred language and two-step verification settings.
• Workspace data: workspace name, team members and roles, subscription and payment details you provide, including bank transfer receipts you upload.
• Connected channels: the name and ID of connected Pages, Instagram and WhatsApp business accounts, and the access tokens that let us act on them (stored encrypted).
• Conversations: comments and direct messages that people send to connected accounts, the sender’s name or username, platform ID and, on WhatsApp, phone number, and the replies sent back.
• Leads: details a customer shares or the assistant notes during a conversation, such as name, phone, product, quantity and city.
• Technical data: IP address, browser type and security logs, used to protect accounts and keep an audit trail.

How we use it

• To provide the Service: connect your accounts, send automatic and assistant replies, show conversations to your team and send alerts.
• To run analytics, subscriptions, invoices and support.
• To keep the Service secure, prevent abuse and comply with the law.

We do not sell personal data and we do not use it for advertising.

AI assistant

If an owner turns on the AI assistant, the recent messages of the conversation and the business information the owner wrote (including the product catalog and the recent posts) are sent to Anthropic, PBC, our AI provider, to generate a reply. According to Anthropic’s commercial terms, data sent through its API is not used to train its models.

If the owner connects their own AI service instead (their own Anthropic key or an OpenAI-compatible provider), that content is sent to that provider, under the owner’s own account and terms, and not to Anthropic through our account.

The assistant can be turned off at any time in the workspace settings, and a team member can take over any conversation.

Who we share data with

We share data only with providers that help us run the Service, and only as needed:

• Meta (WhatsApp, Instagram, Facebook), to receive and send the messages and comments of connected accounts through its official APIs.
• Anthropic, to generate assistant replies (see above).
• Telegram, when an owner connects a team group: lead alerts with the customer’s name, phone number, order details and a link to the conversation are posted there.
• Hosting, database and email delivery providers.
• Authorities, when the law requires it.

Each platform’s own privacy policy applies to how it handles data on its side.

International transfers

Our providers may process data outside your country, including in the United States and the European Union. Where the law requires safeguards for such transfers, we put them in place.

How long we keep data

We keep account and workspace data while the account is active. Conversations and leads are kept for as long as the workspace uses the Service, unless the owner or the person concerned asks for deletion earlier.

After a deletion request we delete or anonymise the data without undue delay. Some records, such as invoices, are kept as long as the law requires; copies in backups disappear when the backups expire.

Your rights

Under applicable data-protection law, including the Turkish Personal Data Protection Law (KVKK, No. 6698) and, where it applies, the GDPR, you can ask whether we process your data, get a copy, have it corrected or deleted, object to its processing and complain to the data-protection authority.

To use these rights, write to us (see Contact). If you messaged a business, you can also ask that business directly. We answer within 30 days. The Data deletion page explains how to request deletion.

Security

Passwords are hashed, access tokens and two-step verification secrets are encrypted, each workspace’s data is isolated in the database, connections use HTTPS and administrative actions are logged. No system is perfectly secure, so we also ask you to use a strong password and two-step verification.

Children

The Service is for businesses and is not directed to people under 18. We do not knowingly collect data from children.

Changes

We may update this policy. The date at the top shows the latest version, and we will tell account holders about significant changes.

Contact

Questions or requests about personal data: privacy@tryplio.com