Privacy Policy

BiHesap (operated by Taylan Karaman) — Inbox integration with Messenger, Instagram & WhatsApp
Last updated: September 14, 2026

This Privacy Policy explains how BiHesap ("we", "us") collects, uses, and protects information when a business uses BiHesap's Inbox to communicate with its customers over Facebook Messenger, Instagram Direct, and/or WhatsApp, using Meta's Messenger Platform, Instagram Platform, and WhatsApp Business Platform as a Tech Provider.

1. Who we are

BiHesap is a business/accounting software product built by Taylan Karaman. Its Inbox feature connects a business's own Facebook Page, Instagram professional account, and/or WhatsApp Business Account (WABA) to send and receive customer messages, and shows delivery/read status where the platform provides it, on that business's behalf.

2. Information we collect

Facebook Messenger

• The connected Facebook Page's ID and Page access token.
• Message content — text, attachments, and postbacks sent to, or received from, a customer over Messenger.
• The customer's Page-scoped ID (PSID) and, where available via the Graph API, their name and profile picture, used to identify who a business is talking to.

Instagram

• The connected Instagram professional account's ID and access token.
• Message content — text and attachments sent to, or received from, a customer over Instagram Direct.
• The customer's Instagram-scoped ID (IGSID) and, where available, their username and profile picture.

WhatsApp

• The connected business's WABA ID, phone number ID, and message template configuration.
• Recipient phone numbers — in E.164 format, used to address messages.
• Message content — text messages and message template content sent to, or received from, a customer over WhatsApp.
• Message metadata — timestamps, delivery status (sent/delivered/read), and message IDs, received via webhook events from Meta.

We do not collect this data by scraping or through any means other than the official Messenger Platform, Instagram Platform, and WhatsApp Business Platform (Cloud API) APIs and their webhooks.

3. How we use this information

• To show incoming Messenger, Instagram, and WhatsApp conversations in one inbox, and to let the business reply from there.
• To display the sender's name/username and profile picture next to their messages, so the business knows who they're talking to.
• To show delivery/read status back to the business where the platform provides it.
• To create and manage WhatsApp message templates on the business's behalf.
• To detect and prevent abuse, and to comply with Meta's Platform Terms and messaging policies.

We do not sell this information, and we do not use message content or profile data for advertising.

4. How information is shared

Because the Service runs on Meta's Messenger, Instagram, and WhatsApp Business Platforms, message data necessarily passes through Meta's infrastructure and is subject to Meta's own terms, including WhatsApp's Business Data Processing Terms. Data is shared only with:

• Meta, as the operator of the platform used to transmit the message;
• the business that owns the connected Page, Instagram account, or WhatsApp Business Account (they see conversations with their own customers);
• service providers strictly necessary to run BiHesap's infrastructure (e.g. hosting), bound by confidentiality obligations.

We do not share this data with third parties for their own marketing purposes.

5. Data retention

Message content, metadata, and cached sender profile info are retained only as long as needed to provide the Service and meet the connected business's own record-keeping needs, after which they are deleted or anonymized. A business can request deletion of its conversation data at any time — see our Data Deletion Instructions.

6. Security

Inbound webhook requests from Meta are verified using HMAC signature checks (X-Hub-Signature-256) before being processed. Access tokens and app secrets used to call the Messenger, Instagram, and WhatsApp Business APIs are encrypted at rest, stored outside the public web root, and are never exposed to end users or client-side code.

7. Your rights

Depending on your location (including under GDPR and Turkey's KVKK), you may have the right to access, correct, or request deletion of your data. A WhatsApp end-user can opt out of messages at any time by replying STOP; a Messenger or Instagram user can block or report the business's account directly through those apps. To exercise these rights with respect to BiHesap's own processing, contact us at info@bihesap.org.

8. Children's privacy

The Service is intended for business use and is not directed at children. We do not knowingly process data from children through this integration.

9. Changes to this policy

We may update this policy as the Service evolves. Material changes will be reflected by updating the "Last updated" date above.

10. Contact

Questions about this policy or the Service can be sent to info@bihesap.org.