Privacy Policy

1. Who we are and what this policy covers

HopperLine (“we”, “us”, “HopperLine”) operates an AI-powered receptionist and booking assistant that works over WhatsApp and Instagram for beauty salons, hair salons, nail studios, aesthetic centers, and dental clinics. This Privacy Policy explains what personal data we collect when you use the hopperline.com marketing site and the product dashboard at app.hopperline.com (together, the “Service”), why we collect it, who we share it with, and how we protect it.

2. What data we collect

We collect data both from our direct customers — the businesses (salons, clinics, and their staff) that sign up for HopperLine — and from those businesses' own customers who message them on WhatsApp or Instagram. The categories of data we collect include:

• Business records: business name, contact details, address, and working hours.
• Staff accounts: names, email addresses, and roles of employees who access the dashboard.
• Service and pricing catalogs: the services a business offers, their duration, and pricing.
• Customer records: name, phone number, age, notes, and visit history belonging to the business's own customers. Most of this data is generated automatically as customers message the business on WhatsApp or Instagram.
• Appointment records: appointment date, time, requested service, and status.
• Full WhatsApp and Instagram message content: our AI reads and responds to the full conversation between a business and its customers in order to answer questions and book appointments.
• Campaign data: content and target audience information for marketing or reminder campaigns a business creates.
• Integration credentials: access tokens for a business's WhatsApp Business API and Instagram Messaging API connections, stored securely under that business's `business_integrations` record.

3. Why we collect it and our legal basis

We process this data to operate the core of HopperLine: reading and responding to incoming WhatsApp and Instagram messages with AI, answering customer questions, booking appointments, maintaining an up-to-date CRM, and giving the business a dashboard to manage all of it. HopperLine's direct customer is the business itself (the salon, kuaför, or clinic); data sent by a business's end customers over WhatsApp or Instagram is processed on that business's behalf and under its instructions.

4. Who we share data with

To run the Service, we share data with the following service providers (subprocessors), limited to what each needs to perform its function:

• Meta Platforms, Inc. — required to send and receive messages via the WhatsApp Business API and Instagram Messaging API.
• OpenAI — processes message content to generate AI responses.
• Supabase — database hosting.
• Stripe — billing and payment processing.
• Resend — transactional email delivery.
• Sentry — error monitoring and application stability.
• Vercel — application hosting infrastructure.

HopperLine does not sell personal data. We share data with the providers above only as needed to operate the Service, and with authorities when required by law.

5. Security

Our database uses Postgres Row Level Security to enforce tenant isolation, so each business can only access its own data, scoped by `business_id`. Incoming webhook events from Meta are verified using HMAC-based signature verification (`x-hub-signature-256`) to confirm they genuinely originate from Meta. These measures are intended to reduce risk; no system can be guaranteed to be completely secure.

6. Data retention

We retain data for as long as the associated business account remains active. For details on how to request deletion of your data, see our Data Deletion page — we don't duplicate that process here.

7. Your rights

You have the right to access, correct, or request deletion of your personal data. To exercise these rights, contact us at info@hopperline.com.

8. Children's data

HopperLine is a B2B tool built for businesses and is not directed at children. We expect our business customers not to knowingly submit a child's personal data as a “customer” record without appropriate parental context.

9. International transfers and KVKK

HopperLine's primary market is Turkey. This policy is intended to align with the core principles of Turkey's Law on the Protection of Personal Data (KVKK, Law No. 6698), while also following general good-practice and GDPR-style principles. Some of the service providers we use may process data on servers located outside Turkey. Formal legal review of this policy is still pending, and it will be updated as needed.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected on this page along with an updated date. Continued use of the Service after an update means you accept the revised policy.

11. Contact

If you have questions about this policy or how your personal data is processed, reach us at info@hopperline.com.

12. A note on this draft

This policy was prepared by the HopperLine team as a first draft ahead of formal legal review. It is not legal advice, and we expect to revise it as that review progresses.