Privacy Policy

This section does not replace the full policy; it is intended to give you the general picture before you read the sections below.

• Your Instagram and Facebook accounts are connected through Meta’s official API and Meta’s own login screen. We never see, ask for, or store your social media password.
• We access only the data in your account that the service needs in order to work: the messages and comments to be replied to, and basic information about the connected Page.
• We do not sell or rent your personal data, and we do not disclose it to third parties for advertising purposes.
• We do not use your data to train artificial intelligence models.
• For WhatsApp line monitoring, the connection is not made through an official API; it is established with a QR code, as with WhatsApp Web. We do not send WhatsApp conversations to artificial intelligence; the business that connects the line is the controller of this data.
• You can remove the connection at any time and request the deletion of your data by following the steps on the Data Deletion page.

DManagers is a software service that enables businesses to reply, using artificial intelligence, to messages and comments received on their Instagram and Facebook accounts, and to monitor the conversations and calls of their WhatsApp lines by connecting those lines to the dashboard. This policy applies to the dmanagers.com website and the DManagers dashboard.

Service provider

DManagers

Website

dmanagers.com

Contact

support@dmanagers.com

We have two different roles

DManagers is the data controller for your data as the business owner who signs up for the service. For the messages your customers send to you, on the other hand, you are the data controller; we handle that data only as the party that processes it on your instructions (the data processor).

The same distinction applies to WhatsApp line monitoring: for the conversations and calls of the lines you connect — including the data of your staff who use the line and of the people they message or speak with — you are the data controller, and we are your data processor.

a) Your account and contact data

Your full name, email address, business name, an irreversible cryptographic hash of your password (the password itself is not stored), and your correspondence with us. If you log in with Google or Facebook, this also includes the name, email address, account ID on that service, and profile photo URL that the provider shares with us. The photo is displayed so that your account can be recognized in the dashboard; if you logged in with Google, it is also visible on our support team’s admin screen. We do not store a copy of the photo; we keep only the URL provided by the provider.

b) Meta account connection

The ID, name, and profile image of the Instagram account and Facebook Page you connect, the scope of the permissions you grant, and the access token that enables us to take actions on your behalf. Access tokens are stored in encrypted form.

c) Message, comment, and conversation content

• The content and timestamps of incoming and outgoing direct messages (DMs);
• The text of comments on posts and Reels, and the replies given to them;
• Voice messages and their transcriptions;
• Post and Reels images and captions that are reviewed to determine which product a reply relates to;
• The username of the person who sends the message and the user ID assigned by Meta.

d) Data specific to your setup

• The product list you upload in the e-commerce setup (fields such as product name, description, price, stock, and link);
• The fields you define in the lead collection setup (e.g., first name, last name, country, phone, email) and the answers the bot collects in conversations;
• Your settings that determine the bot’s tone and behavior.

e) Usage and technical data

IP address, browser and device information, session records, actions you take in the dashboard, error logs, and message counters that show your plan usage.

f) Payment data

Subscription amount, your billing information, and payment status. We do not see or store your card number; payments are processed on the infrastructure of a licensed payment institution.

g) WhatsApp line monitoring

If you chose to import past conversations when adding the line, then each time the line is (re)paired with a QR code, the one-to-one conversations from the last 30 days that WhatsApp transfers to the linked device (excluding media files), and the calls from the same period in the phone’s call history, are also imported into the dashboard; in other words, messages written and calls made before the connection — including the period when the line was not connected — are also processed. If you did not choose this, only conversations and calls that take place after the connection are recorded in the dashboard; messages written and calls made before the connection are not imported into the dashboard and are not stored. Even in that case, the initial sync data that WhatsApp sends to the linked device during pairing (which may also include recent conversations from before the connection and the phone’s call history) is read for the technical setup of the connection; the old calls and messages it contains are discarded without being recorded, and only the technical mapping information needed for the connection to work (such as the mapping between the WhatsApp IDs and phone numbers of the people the line has conversations with) and contact names used to show names in conversations (see below) are stored. When you connect a WhatsApp line to the dashboard with a QR code, the following data is processed for as long as the line remains connected:

• The line’s phone number, WhatsApp profile name and picture, connection status, and connection history;
• Incoming and outgoing messages in one-to-one conversations — including those written from the line’s own phone — and the original version of deleted and edited messages;
• Images, voice recordings, videos, documents, locations, and contact cards sent and received in conversations;
• The phone number, WhatsApp name, and WhatsApp profile photo of the people the line has conversations with (if the person’s WhatsApp privacy settings allow it);
• Names saved in the line’s phone contacts — solely to show each person in conversations under the name saved on the phone; WhatsApp sends the full contact list when the line is paired with a QR code and then sends any changes (even if history import is not selected), and only the names of the people the line has conversations with are visible in the dashboard;
• Call history (direction, other party, time, duration, outcome) and, if recording is enabled, the audio recording of the call and the recording announcement.

Group chats, status updates, and story posts are not processed. This data may belong to your staff who use the line, to the people who message or speak with them, and to the people saved in the line’s phone contacts; as the data controller, you are obliged to inform these people — your staff in advance and in writing.

• To create your account, verify your identity, and give you access to the dashboard;
• To generate replies to messages and comments on your behalf — this is the core of the service;
• To match each reply with the right product and preserve the context of the conversation;
• To show conversations in the dashboard, translate them into Turkish if you wish, and enable you to export the information collected;
• For WhatsApp line monitoring, to show conversations and calls in the dashboard, enable you to send messages and make calls from the dashboard, and notify you by email when a line’s connection drops;
• To track your subscription and message limit usage and to bill you;
• To prevent abuse, spam, and fraud, and to keep our systems secure;
• To improve the service, fix errors, and respond to your support requests;
• To fulfill our legal obligations and exercise our right of defense against legal claims.

Where we need to send you commercial electronic messages, we obtain your separate consent; you can withdraw this consent through the link included in each message.

When a message, comment, or voice recording comes in, the message text, the relevant conversation history, and, where needed, product information selected from your catalog are sent to artificial intelligence model providers so that a reply can be generated.

• We select model providers that commit not to use your data for model training, and we bind them to this commitment by contract.
• We send only the data needed for the reply; we do not transfer the data of your entire account in bulk.
• In the e-commerce setup, the bot is restricted to answering price and stock questions only with information from the catalog you uploaded.

Artificial intelligence is not used in WhatsApp line monitoring: WhatsApp conversations, media, and call recordings are not sent to any artificial intelligence provider, and are not summarized or scored.

The data we access through Instagram and Facebook is subject to Meta’s Platform Terms and Developer Policies. With respect to this data, we:

• use it only to operate the service we provide to you;
• do not sell or rent it, or transfer it to data brokers;
• do not use it for ad targeting or profiling;
• stop our access when you revoke your permissions or close your account, and delete stored copies within the periods set out in this policy.

Step-by-step instructions on how to remove the app’s permissions in Meta’s own settings are on the Data Deletion page.

We do not sell your data. We share it only to the extent necessary for the service to work, and only with parties bound by confidentiality obligations:

• Meta Platforms — to send and receive messages and comments (required).
• Cloud infrastructure and hosting providers — to store data and run the application.
• Artificial intelligence model providers — to generate replies, transcribe audio, and analyze images.
• Payment institution — for subscription payments and billing.
• Email delivery and support tools — for notifications and support correspondence.
• Error monitoring and analytics tools — for fault detection and service quality.
• Accountants, legal counsel, and auditors — in connection with our legal obligations.
• Authorized public authorities and institutions — where required by law.

International transfers

Some of the cloud and artificial intelligence providers we use are located outside Turkey; as a result, your data may be transferred abroad. We carry out these transfers in accordance with the conditions of Article 9 of the Turkish Personal Data Protection Law No. 6698, on the basis of appropriate safeguards such as standard contracts or written undertakings or, where required, your explicit consent.

In the event of a transfer of our business, a merger, or an acquisition, data may be transferred to the acquiring party; in that case, we will require that the same level of protection be maintained and will inform you in advance.

WhatsApp line monitoring data

This data is stored and processed on Supabase infrastructure for the database and file storage, and on Railway infrastructure for the application servers. It is not shared with artificial intelligence providers or with advertising and analytics tools. By their nature, messages are sent and received over WhatsApp (Meta) infrastructure. The email sent when a line’s connection drops contains only the line’s name and the last four digits of its number.

Our website and dashboard use strictly necessary cookies for functions such as keeping your session active and security; the service does not work without them.

We do not use third-party cookies for advertising or profiling. If we add analytics cookies in the future, they will run only with your explicit consent, and this policy will be updated.

We do not keep personal data longer than necessary for the purpose for which it is processed. Our general approach is as follows:

Account and profile data

For as long as your account is open; deleted within 30 days after it is closed.

Conversations, comments, and collected customer information

For as long as your account is open, so that you can access them in the dashboard; deleted when the account is closed or at your request.

Product catalog and bot settings

Until you delete them or your account is closed.

Meta access tokens

Immediately invalidated and deleted when permission is revoked or the connection is removed.

Technical records and security logs

Up to 12 months.

Invoices and accounting records

10 years, as required by tax and commercial legislation.

WhatsApp messages and call history

As long as the account is open, with no time limit; deleted when the account is closed or on request. If “also delete all its data” is selected when deleting a line from the dashboard, that line’s conversations and call history are deleted immediately; otherwise they are kept.

WhatsApp media files

12 months; at the end of this period the file is deleted and the message record is kept.

WhatsApp call recordings

90 days; at the end of this period the audio file is deleted and the call history is kept.

WhatsApp connection history

180 days (except the line-adding consent and the line deletion record; see below); deleted immediately when the line is deleted with “also delete all its data” selected.

WhatsApp line-adding consent

The date of the consent you gave when adding the line (that the line belongs to your company and that staff were informed in advance) and of the line’s deletion record, together with the user who confirmed it: kept as long as the account is open, even if the line is deleted from the dashboard; not subject to the 180-day period of the connection history. Deleted when the account is closed.

WhatsApp session keys

Deleted when the line is deleted or logged out; no later than 2 days after the line is deleted.

The line’s WhatsApp profile photo and recording announcement

As long as the line is in use; usually deleted within one day when the line is deleted from the dashboard with “also delete all its data” selected, or when the account is closed.

Names in the line’s phone contacts

As long as the line’s session is active. When the line is logged out (from the Dashboard or from the phone) or the line is reconnected with a new QR code, the contact names and the contact names shown in conversations are deleted. When the line is deleted, its contacts are deleted (no later than 2 days after the line is deleted); only the names of people you have chatted with, as shown in conversations, stay with the conversation, and these are also deleted if the line is deleted with “also delete all its data” selected. Deleted immediately when the account is closed.

WhatsApp profile photos of people you chat with

As long as the conversation is kept; when there is a new message in the conversation, the photo is rechecked at most once every 7 days. If the person removes or hides their photo, it is deleted at the next check. Usually deleted within one day when the line is deleted from the dashboard with “also delete all its data” selected, or when the account is closed; conversations of a line deleted without this option selected are kept with their photos.

WhatsApp files when the account is closed or a line is deleted with all its data

After the account or the line is deleted (with “also delete all its data” selected), media files, call recordings, announcements and profile photos are deleted from storage during daily maintenance (usually within one day).

Copies in backup systems are deleted as the backup cycle completes, within 90 days at the latest. Data whose retention period has expired is deleted, destroyed, or irreversibly anonymized.

• All traffic is encrypted with TLS; access tokens and sensitive fields are stored encrypted in the database.
• Passwords are hashed with irreversible algorithms; no one, including our employees, can see your password.
• Access to data is limited to staff who need it to do their jobs, and such access is logged.
• We sign confidentiality and data processing agreements with our service providers.
• WhatsApp session keys are kept only on the server side and cannot be accessed from the dashboard or the browser. Media and call recordings are kept in non-public storage; they can be opened only through a short-lived link, after it has been verified that they belong to your account.

No system is 100% secure. If a breach affecting your data occurs, we will notify you and the competent authorities within the period required by law. If you discover a security vulnerability, please report it to support@dmanagers.com.

With respect to your personal data, you have the right to learn whether it is processed; to request information about it; to learn whether it is used in line with its purpose; to request that it be corrected, deleted, or destroyed; to request that third parties to whom it has been transferred be notified of these actions; to object to an outcome against you that results from analysis by automated systems; and to claim compensation for damages.

The scope of these rights, how to submit a request, and response times are explained in detail on the KVKK Privacy Notice page.

The steps to follow when you want your account and data deleted, which data is deleted, and the timeframes are set out on the Data Deletion page.

DManagers is a service for businesses and is not intended for anyone under 18 years of age. We do not knowingly collect children’s data; if we become aware that such data has been processed, we will delete it without delay.

We may update this policy as the service evolves. The current version is always published on this page, and the “Last updated” date at the top changes accordingly. For significant changes, we will also notify you separately by email or through a notification in the dashboard.

For any questions about this policy or your data, you can write to support@dmanagers.com.

1. Send your request by email; use the address registered to your account so that we can verify your identity.
2. We will resolve your request within 30 days at the latest and respond to you in writing.
3. If you find our response insufficient, you retain the right to file a complaint with the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).