Politika e privatësisë
Ky dokument është i disponueshëm në turqisht dhe anglisht; po shfaqet versioni anglisht.
Müsaitmi respects your privacy. This policy summarises what data we collect when you use the Platform, why, whom we share it with, how long we keep it and what your rights are. For our statutory information duty, please also read the Data Protection Notice.
1. Our roles: who is the controller?
- Müsaitmi is the controller for your account (sign-in, security), search/listing, delivery of notifications and Platform security.
- The Business you book with is the controller for its customer file, bookings, checkout/payment, loyalty, survey and marketing records. For those records we act as a processor on the Business’s behalf.
2. What data we collect
| Data | When / from where | What for |
|---|---|---|
| Phone number, email, name, language preference | When you sign in or update your profile | Account, one-time-code sign-in, booking notifications |
| Booking details (business, service, staff, date/time, your note) | When you book | Creating, managing and notifying about the booking |
| Verification records (code hash, IP address, time) | During sign-in attempts | Authentication, preventing abuse |
| Session and device data (session token hash, browser/device info; push token in the app) | When you sign in | Keeping you signed in, security, app notifications |
| Delivery records (SMS/email/notification content and time) | When notifications are sent | Reminders and information, troubleshooting |
| Reviews and survey answers | When you write a review / answer a survey | Feedback, business quality |
| Marketing consent record | When a Business records your consent | Campaign messages (only with consent) |
| Approximate country (from the connection) | When you open the site | Language/region suggestion; your precise location is not collected |
We do not ask for location permission; search uses the city/area you choose. Please do not put special-category data such as health information in booking notes.
3. Legal bases
- Performance of a contract (booking service, account) — KVKK Art. 5/2-c; GDPR Art. 6(1)(b),
- Compliance with legal obligations (e.g. retention periods, requests from authorities) — KVKK Art. 5/2-ç; GDPR Art. 6(1)(c),
- Establishment, exercise or defence of legal claims (disputes, abuse) — KVKK Art. 5/2-e; GDPR Art. 6(1)(f),
- Legitimate interests (Platform security, service improvement, without harming your rights) — KVKK Art. 5/2-f; GDPR Art. 6(1)(f),
- Explicit consent (marketing messages, WhatsApp notifications) — KVKK Art. 5/1; GDPR Art. 6(1)(a). You can withdraw consent at any time.
4. Who we share data with
- The Business you book with: your name, contact details, service/time and note (as needed for the booking).
- Our service providers (processors): hosting and network security/CDN (Cloudflare), email delivery (Hostinger), SMS delivery (an SMS communications provider), mobile notifications (the Expo notification service and Apple/Google push infrastructure) and, optionally, WhatsApp (Meta; only with your explicit consent). They process data only on our instructions and as needed for the service.
- Competent public authorities: only for mandatory legal requests.
- A successor in case of merger or transfer of the business, under the same level of protection.
- Calendars: if a staff member chooses to add their calendar link (ICS) to Google/Apple/Outlook, the customer name and service name in that staff member’s appointments flow to that calendar service (the phone number does not).
We do not sell personal data. We do not share it with advertising networks or third-party analytics, and the Platform has no advertising or third-party tracking cookies.
5. International transfers
Some of our providers (e.g. Cloudflare, Expo, Meta) may process data outside Türkiye. Transfers follow KVKK Art. 9 and — for EU/EEA users — Chapter V of the GDPR (adequacy decisions, standard contractual clauses or other appropriate safeguards, or other routes permitted by law).
6. How long we keep data
We keep data for as long as the purpose requires and as law prescribes, then delete, destroy or anonymise it. See the Data Retention and Deletion Policy for details. In short: verification records 90 days, session tokens 30 days after expiry, delivery records 12 months; your account until you delete it.
7. Security
- All connections are encrypted (HTTPS/TLS).
- Passwords are stored only as irreversible hashes (argon2); verification codes and session tokens are kept as hashes.
- Businesses’ data is isolated at database level (row-level security); authorisation is enforced on the server.
- Rate limits, brute-force protection, regular backups and access control are applied; two-factor authentication is offered for business accounts.
- In case of a personal data breach we comply with notification duties (to the authority and affected persons) under applicable law.
8. Your rights
Under KVKK Art. 11 and the GDPR you have the rights of access, rectification, erasure, restriction, objection, data portability and withdrawal of consent. See the Data Subject Requests page for how to apply.
You can also act yourself: after signing in, download your data and delete your account from the privacy section on the "My bookings" page, or delete it from Account in the mobile app.
9. Marketing messages
Commercial electronic messages (campaign SMS/email) are sent only after the relevant Business obtains your consent and in line with Law No. 6563 and the Regulation on Commercial Communication and Commercial Electronic Messages. Every campaign message has a one-click unsubscribe link; booking confirmations and reminders are service messages, not marketing.
10. Children
The Platform is not directed at persons under 18. If we learn that a person under 18 has provided data, we will delete it within a reasonable time. Parents/guardians can write to us.
11. Changes
We may update this policy and will announce material changes on the Platform; the current version is always on this page.
Contact
For questions or requests about this document, contact us:
- Operator: Müsaitmi (musaitmi.net)
- Email: [email protected]
- Phone: 0552 280 51 28