Privacy policy

1. Controller and contact

The controller under the GDPR is MerhabaTech UG (haftungsbeschränkt) i. G., Borchener Str. 2, 33098 Paderborn, Germany, represented by Managing Director Erdem Oflu.

Privacy contact: Erdem Oflu, email datenschutz@merhabaone.com. A formally appointed data protection officer is not currently appointed.

Supervisory authority for the registered seat in North Rhine-Westphalia: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, phone +49 211 38424-0, poststelle@ldi.nrw.de, https://www.ldi.nrw.de.

2. This website (merhabaone.com)

The site provides product information and privacy, terms, imprint, and deletion guidance. MerhabaOne does not place marketing cookies or analytics/ad trackers on this website.

Hosting is provided by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (Vercel Pro). Necessary connection data may be processed (including IP address, time, requested URL, user agent, transfer size). Purpose: delivery, operation, and security. Legal basis: Art. 6(1)(f) GDPR.

Transfers to the USA may occur. Vercel publishes a privacy policy and DPA and states EU-US Data Privacy Framework certification. See https://vercel.com/legal/privacy-policy and https://vercel.com/legal/dpa.

DNS and proxy may use Cloudflare once the domain is connected in production. Cloudflare may then process connection data as CDN/DNS provider. Until domain go-live, Cloudflare is not assumed as the active content host for this preview.

Vercel may apply Authentication and optional toolbar/feedback scripts on preview deployments for access control—not MerhabaOne marketing tracking.

3. MerhabaOne app – account and profile

The app requires a user account. Authentication uses Supabase Auth (email OTP plus Apple and Google sign-in). MerhabaOne does not use a phone number as the account login.

Supabase stores account identities (including user id, email, and provider identities) in Auth system tables. An optional app profile (display name, avatar URL, locale, time zone) is provided for in the schema.

Legal bases: Art. 6(1)(b) GDPR (contract / app use) and, where needed, Art. 6(1)(f) GDPR (operation and security).

4. Devices, connections, and push

Devices may be registered to the account (including platform, install identifiers, non-secret metadata). Sources may be bound to devices.

For remote push, device identifiers and push tokens (APNs/FCM) plus per-source consent states may be stored when you enable push. Push may be piloted or disabled; OS and in-app permission are required.

Legal basis for push: Art. 6(1)(a) GDPR (consent), withdrawable via system/app settings and by signing out / deactivating the device.

5. Messaging sources – what is actually processed

WhatsApp and Telegram: connections are device-bound. Chat content and session secrets remain on the device / local client storage. For these sources, the MerhabaOne backend receives only opaque connection metadata under the implemented design—not chat content or session secrets.

Facebook Messenger (Page inbox): when you connect a Facebook Page, MerhabaOne stores OAuth/page tokens encrypted server-side (AES-GCM envelope) and may process and store Page messages and conversation metadata via Meta’s official path. Personal Messenger inboxes are unsupported. This integration exists technically but is not a generally released production feature.

Instagram Professional: when you connect a Professional/Business/Creator account, MerhabaOne stores OAuth tokens encrypted server-side and may process messaging events for allowlisted accounts. Personal consumer DMs are unsupported. This integration is prepared and not generally released.

Activity is product planning / UI preparation and does not create production processing merely because of catalog entries or logos.

6. Recipients and processors

Supabase (Auth, database, Edge Functions) – documented cloud region for the current project: EU (eu-west-1).

Meta Platforms Ireland Ltd. / Meta services when Facebook Pages or Instagram Professional accounts are connected.

Apple (APNs) and Google (Firebase Cloud Messaging) when push is enabled.

Telegram and WhatsApp as the respective providers’ networks; MerhabaOne does not operate those services.

Vercel for this website (section 2).

7. Encryption and international transfers

Meta/Instagram access tokens are stored encrypted server-side. Relay message bodies for Meta/Instagram are stored as plaintext in the database in the current design. End-to-end encryption of relay content between MerhabaOne users is not claimed.

WhatsApp chats may use WhatsApp’s known transport protections on device; that is not MerhabaOne cloud E2EE for relay data.

Processors with seats or infrastructure outside the EEA (including Meta, Apple, Google, Vercel) may transfer data to third countries. Where applicable, transfers rely on adequacy decisions / the EU-US Data Privacy Framework, standard contractual clauses, or comparable safeguards of those providers.

8. Retention and deletion

Account and connection data are processed while the account or connection exists and are then deleted or restricted unless legal retention applies.

Website host logs follow the providers’ operational retention.

Fully automatic self-service account deletion is not currently implemented. You can disconnect sources in the app and request deletion at datenschutz@merhabaone.com (see Data deletion). Disconnecting Meta/Instagram removes bindings and tokens as designed; complete erasure of historical relay messages is not automatically proven and is reviewed on request.

9. Your rights

Under the GDPR you may have rights of access, rectification, erasure, restriction, portability, and objection to processing based on Art. 6(1)(f). You may withdraw consent without affecting prior lawful processing.

Requests: datenschutz@merhabaone.com. We verify identity appropriately and normally respond within one month (Art. 12(3) GDPR); the period may be extended by up to two further months for complex requests, with notice to you.

Complaints: LDI NRW (section 1) or another competent authority.

No solely automated decision-making with legal effects under Art. 22 GDPR takes place.