Privacy policy

1. Scope

This policy covers two groups of people. For end customers' data the business is the controller and Webgrup acts as processor on the business's behalf. For the account data of business users, Webgrup is the controller.

• Business customers: companies and their staff who open an account and connect a WhatsApp Business account.
• End customers: people who exchange WhatsApp messages with a business that uses 24msg.

2. Data we process

• Account data: name, email, company name and role of signed-in users; billing and subscription details (card data is handled by the payment provider and not stored by us); usage logs, security logs and support requests.
• WhatsApp Business Platform data, obtained with the business's consent through Meta's Embedded Signup and the Cloud API: WhatsApp Business Account ID, phone number ID, display name and message templates; the access tokens Meta issues (stored encrypted and used only to call the WhatsApp Business Platform on the business's behalf); delivery and read status, quality rating and messaging limits.
• End-customer data, processed only on the business's instructions: WhatsApp phone number and profile name; message content and media; opt-in and opt-out records for each message type; order, cart, shipping or booking details from the business's connected shop or POS system.

3. Purposes

• Providing the service: sending and receiving WhatsApp messages, showing conversations in the inbox, running the automations a business sets up.
• Account security, abuse prevention and compliance with messaging policies, including the WhatsApp Business Messaging Policy.
• Subscription billing and support; meeting legal obligations.

We do not sell personal data, we do not use end-customer data for our own marketing, and we do not use message content to train AI models.

4. AI assistant

If a business turns the AI assistant on, incoming messages and the business's own catalogue or menu data are sent to our AI model provider to prepare or send replies. The provider processes this data only to produce replies, under a data processing agreement, and does not use it to train its models. End customers can always ask to speak to a person.

5. Meta and WhatsApp

Messages are delivered through Meta's WhatsApp Business Platform. Meta processes message data as described in the WhatsApp Business Terms and Meta's policies: https://www.whatsapp.com/legal/business-policy and https://www.facebook.com/privacy/policy. 24msg only uses Meta's official APIs.

6. Storage and transfers abroad

Service data is stored on servers operated by Webgrup. Meta and our AI model provider may process data outside Türkiye, including in the United States. Such transfers are made under the safeguards required by Turkish Personal Data Protection Law No. 6698 (KVKK), Article 9, and, where it applies, the GDPR.

7. Retention

• Conversations and contact records: while the business account is open, unless the business deletes them earlier.
• When a business closes its account: all data, including conversations and access tokens, is deleted within 30 days.
• Security logs: 90 days. Invoice records: as long as tax law requires.

8. Security

Access tokens and secrets are stored encrypted, all traffic is protected with TLS, staff access is limited by role and written to an audit log, and each business's data is kept separate from other businesses.

9. Your rights (KVKK and GDPR)

Under Article 11 of the KVKK and, where it applies, the GDPR, you can access, correct, delete and port your personal data, object to processing and withdraw consent. End customers should first contact the business they wrote to; we help the business respond. You can also write to us directly at destek@24msg.com.

10. Data deletion

• Businesses: delete your account in Account settings or write from your account email to destek@24msg.com. Disconnecting your WhatsApp Business account from 24msg, or removing the app in Meta Business settings, stops all access immediately.
• End customers: reply STOP to leave a business's messages, or ask the business to delete your data. You can also write to destek@24msg.com with your phone number and the business name; we pass the request to the business and complete it within 30 days.

11. Children

The service is for businesses and is not directed at children under 16.

12. Changes

We may update this policy. The date above shows the latest version; important changes are announced in the service or by email.