Last updated: 25 Oct 2026 · Draft pending legal review.
The service is operated by Yakup Şehremin (sole proprietor), trading as Alpiko and Estemol Saç Vitamini Merkezi, Merkez Mah. Eski Edirne Asfaltı Cad. No: 42 A, Gaziosmanpaşa / Istanbul, Türkiye · Tax No: 8010577534 · +90 543 215 05 42 (WhatsApp).
The business that uses Alpiko is the data controller for the personal data of its own customers. Alpiko acts as a data processor, processing that data only on the business's instructions to provide the service. For account and billing data of our own customers, Alpiko is the controller.
Account and billing details of the business; message content and contact details (such as name and phone number) from the business's Instagram and WhatsApp channels.
To answer messages, pass on appointment requests, prepare daily reports and operate the service securely.
Our website is hosted on Netlify (no message data). Payments are processed by our payment provider, which acts as merchant of record; card details are never stored by us. For the phone channel, a telephony provider will carry calls; voice and AI providers will be added to this list when they are enabled. Some providers may process data outside your country; where required we rely on appropriate safeguards (such as standard contractual clauses). We do not sell personal data or use it for advertising.
Data is kept as long as needed for the service and legal obligations, then deleted or anonymised. You may request access, correction, deletion or objection by contacting us (+90 543 215 05 42). See also our data deletion instructions (Turkish page; we will serve requests in English).
Data received from Instagram and WhatsApp is used only for the service of the connected business; it is not sold or shared for advertising.
A business may connect its YouTube channel to Alpiko. Alpiko uses YouTube API Services. By connecting your channel you agree to be bound by the YouTube Terms of Service, and Google's Privacy Policy applies to data handled through YouTube. We request one permission: see, edit and permanently delete your YouTube videos, ratings, comments and captions (youtube.force-ssl). We use it only to (1) read new comments posted on the connected channel's videos after the connection is made, and (2) publish a reply to a comment, written by the business's assistant, after the channel owner approves it or when the owner has turned on automatic publishing. We do not edit or delete videos, ratings, captions or other people's comments, and we do not upload videos. Comment text, the commenter's public channel name and the replies are stored in the business's inbox only, and are visible only to that business's team. Access credentials are stored encrypted and are never shown. You can disconnect at any time in the panel (Services → YouTube → Close connection), which also revokes the permission, or revoke access in your Google security settings. Alpiko's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This data is not used for advertising, is not sold, is not used to develop or train generalized AI models, and is not read by humans except for security, legal requirements, or with your explicit consent. Stored YouTube data is deleted when the business account is deleted or on request via the contact page.
A business may connect its calendar to Alpiko. When connecting with Google we request one permission: see, create, change and delete events on Google calendars you own (calendar.events.owned). We chose this narrower scope instead of the broader calendar.events because Alpiko only uses the connected account's own primary calendar; we cannot use a read-only or free/busy-only scope because we must also write confirmed appointments into the calendar and remove them when they are cancelled. We use it only to (1) write confirmed appointments taken by the agent or bot into the business's calendar as events, and (2) read busy time slots so that the same slot is not offered twice. Event titles and details are not stored on our servers; only the time range is used at the moment availability is calculated. Access credentials are stored encrypted.
How we protect Google user data. (1) In transit: all traffic between your browser, our servers and Google uses HTTPS (TLS 1.2 or higher). (2) At rest: the OAuth refresh credential is encrypted with AES-256-GCM before it is stored; the encryption key lives only in our server-side secret store, never in the database, in the web app or in logs, and the credential is never shown again after connecting. The database itself is encrypted at rest by our hosting provider. (3) Access control: every record is isolated per business with row-level security; only that business's owner/administrators can connect or disconnect the calendar, and our staff have no routine access to the credential or to calendar data. (4) Data minimisation: event titles and details are not stored; only start/end times are read to calculate availability, and an identifier of the event we created is kept so we can cancel it. (5) Least privilege: one calendar scope only, used by server-side code with no third-party SDKs receiving the data. (6) Monitoring: connect/disconnect and administrative actions are written to an audit log; unusual failures raise an alert. (7) Retention and deletion: disconnecting in the panel deletes the credential immediately and we revoke it with Google; deleting the business account removes the stored data; you can also write to us to request deletion. (8) Incidents: if a security incident affects Google user data we will investigate immediately, revoke affected credentials and notify affected businesses and Google as required by law.
Alpiko's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This data is not used for advertising, is not sold, is not used to develop or train AI models, and is not read by humans (except for security, legal requirements, or with your explicit consent). You can disconnect at any time in the panel or revoke access in your Google Account permissions. For Apple Calendar (app-specific password) and Microsoft Outlook (Microsoft account consent) the same purposes and principles apply.