Privacy Policy
Morsapp Bilişim Teknolojileri Yaz. Don. Bilg. Tic. A.Ş. ("MorsApp", "we", "us") is a software-as-a-service platform that lets businesses run their online store, B2B dealer portal, marketplace connections and customer conversations from a single dashboard. This policy explains how we process the data of visitors to morsapp.io, of businesses that open a MorsApp account, and of the people those businesses communicate with through MorsApp, in line with the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where applicable, the EU General Data Protection Regulation (GDPR).
1. Scope and our role
- As data controller: we process the data of morsapp.io visitors, people who sign up for a trial or request a call, and the authorized users of businesses that hold a MorsApp account.
- As data processor: businesses using MorsApp ("Merchants") process their own customers' order, contact and message data in our dashboard. The Merchant is the controller of that data; we process it only on the Merchant's instructions and to provide the service. If you messaged a Merchant on Facebook, Instagram, Messenger or WhatsApp, please address your request to that Merchant first; if you contact us, we will forward it and help the Merchant fulfil it.
2. Information we collect
Website visitors and applications
- Trial sign-up: first and last name, company or brand name, email, phone number, chosen store address, industry, B2B preference and a login password (stored only as a one-way hash and never emailed).
- Call requests: name, email, phone number, package of interest and preferred channel (phone / Zoom / Google Meet).
- Technical records: IP address, browser information and request time, and the result of a bot-protection check, used to prevent abuse.
Businesses using a MorsApp account
- Authorized user details (name, email, phone, role and permissions), session and activity logs.
- Business details: legal name, tax details, address, domain, payment, shipping, marketplace and ERP connection settings.
- Content the Merchant uploads: products, images, prices, orders, customer and dealer records.
Data from Meta platforms (Facebook, Instagram, Messenger, WhatsApp)
When a Merchant connects its own Facebook Page or Instagram professional account to MorsApp using the "Connect with Facebook" or "Connect with Instagram" button, we receive the following, only within the permissions the Merchant explicitly grants:
- Account connection: Facebook Page ID and name, Instagram account ID and username, the connection date, and the access tokens issued by Meta to act on behalf of those accounts.
- Messages: for people who message the Page on Messenger or the Instagram account by direct message — the page-scoped ID issued by Meta (PSID / IGSID), public name and profile picture, message content, attachments and timestamps, and the Merchant's replies.
- Posts and comments: posts on the Page and the Instagram account, comments on those posts and the public names of commenters. This data is read live from Meta each time the dashboard is opened and is not stored on our servers.
- WhatsApp: when a Merchant connects its WhatsApp Business account, messages and phone numbers exchanged between the Merchant and its customers are processed to provide customer conversations and notifications.
Permissions requested for the Meta connection: pages_show_list, pages_messaging, pages_manage_metadata, pages_read_engagement, pages_read_user_content, pages_manage_posts, pages_manage_engagement, business_management, instagram_business_basic, instagram_business_manage_messages, instagram_business_manage_comments, instagram_business_content_publish. Each permission is used only for the purpose described below.
3. How we use Meta platform data
- To show Messenger and Instagram messages in the Merchant's shared inbox and deliver the Merchant's replies on the same channel.
- If the Merchant enables it, to generate AI-assisted reply drafts or automatic replies to incoming messages (for example, answering product, stock and order questions).
- To list posts on the Merchant's own Page and Instagram account, reply to comments on the Merchant's behalf, and publish posts the Merchant prepares.
- To verify that the connection works and to troubleshoot errors.
We do not sell data received from Meta platforms, we do not use it for advertising, targeting, profiling or data brokering, we do not share it with any business other than the Merchant that connected the account, and we process it in accordance with the Meta Platform Terms and Developer Policies. Data from a connected account is shown only to that Merchant's authorized users.
4. Purposes and legal bases
- Creating accounts, setting up stores and providing the service — performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
- Answering support requests and sending account and security notices — performance of a contract and legitimate interest.
- Invoicing, tax and commercial record-keeping — legal obligation.
- Preventing abuse, fraud and unauthorized access — legitimate interest.
- Product news and campaign emails — only with your consent, which you can withdraw at any time.
5. AI features
When a Merchant uses features such as product copy, SEO, image generation or customer reply suggestions, the relevant content is sent to AI model providers (for example, Google Gemini) solely to produce the requested result, with the minimum information needed. Merchants should review AI output before using it.
6. Who we share data with
We share data only as needed to provide the service, with the following service providers bound by confidentiality obligations:
- Hosting, database, CDN and security services (e.g. Hostinger, Cloudflare).
- Email, SMS and WhatsApp messaging infrastructure.
- AI model providers (see section 5).
- Services the Merchant itself connects: Meta (Facebook, Instagram, WhatsApp), marketplaces, payment institutions, carriers and ERP systems. These connections run on the Merchant's instructions and are also subject to each provider's own terms.
- Competent authorities, where required by law.
Some of these providers may store data outside Türkiye. Such transfers are made in accordance with Article 9 of the KVKK and, where applicable, with appropriate safeguards under the GDPR.
7. Retention
- Meta access tokens and account connections: until the Merchant disconnects the account, revokes the app's permission in Meta, or closes its MorsApp account.
- Messenger, Instagram and WhatsApp messages: until the Merchant deletes them or closes its account; deleted no later than 30 days after account closure.
- Post and comment data: not stored, displayed live only.
- Trial sign-ups and call requests: up to 2 years after the request is resolved.
- Invoices and commercial records: for the period required by law (up to 10 years under Turkish commercial and tax law).
8. Security
Only authorized staff can access data; connections are encrypted with HTTPS, passwords are stored as one-way hashes, webhook events from Meta are processed only after their signature is verified, and each Merchant's data is kept separate from other Merchants. In the event of a data breach, we notify affected people and the relevant authority as required by law.
9. Your rights
You may ask whether we process your personal data, request access to it, learn the purpose of processing and the recipients it was shared with, request correction or deletion, object to processing or to decisions based solely on automated processing, request data portability where applicable, and claim compensation for unlawful processing. Send requests to info@morsapp.io; we respond free of charge within 30 days and may need to verify your identity. To delete data received from Facebook, Instagram or Messenger, follow the Data Deletion Instructions.
10. Cookies and browser storage
morsapp.io does not use advertising or tracking cookies. To prevent duplicate form submissions, a random request ID is kept in your browser's session storage; your name, email, phone or password are never stored there. The dashboard uses strictly necessary session cookies to keep you signed in.
11. Children
MorsApp is a service for businesses. We do not knowingly collect personal data from anyone under 18.
12. Changes
We may update this policy. The current version is always available on this page, and we announce material changes by email or in the dashboard.