Privacy Policy

⚠️ This text is not yet complete: the fields in square brackets will be filled in before release.

1. About this policy

1.1. This Privacy Policy explains, in plain language, how your personal data is collected, what it is used for, who it is shared with, how long it is kept and what choices you have over it when you use the Randevi (customer app) and Randevi Business (business app) mobile apps and the website and web apps at randevi.org (together, the "Platform").

1.2. The Platform is operated by Nihat Basmacı (sole proprietorship), referred to in this policy as the "Platform Operator" or "we". Our address: Mimar Sinan Mahallesi, 194. Sokak, Güzelbahçe Sitesi, No: 7-9, Atakum / Samsun. You can reach us on any privacy matter at destek@randevi.org.

1.3. In this policy, "Customer" means a person who discovers businesses and books appointments through the Platform; "Business" means a business that registers on the Platform through Randevi Business and accepts appointments; and "Business user" means a person who uses Randevi Business as the owner, manager or specialist of a Business.

1.4. This policy does not replace the KVKK Disclosure prepared under Law No. 6698 on the Protection of Personal Data ("KVKK"); it complements it. The identity of the data controller, the legal ground for each processing purpose, the basis for transfers abroad and the details of the application procedure are set out in the KVKK Disclosure. Retention periods, the data kept on your device and the records that remain when you delete your account are explained in this policy. You can find all legal texts under Profile → Legal in Randevi and Settings → Legal in Randevi Business.

1.5. The English translation of this policy is provided for convenience. The Turkish text is authoritative; in case of any conflict between the two texts, the Turkish text prevails.

2. In brief

2.1. We collect the information needed to create your account, pass your appointment on to the Business and keep you informed about your appointment: full name, email address, phone number and appointment details.

2.2. The Business you book with sees your name, your phone number, the appointment details and the note you write for the appointment. We do not share your email address with Businesses.

2.3. We do not show ads, we do not sell your personal data and we do not track you across other companies' apps or websites. We do not use third-party advertising or analytics tools; we keep usage measurement records in our own database.

2.4. We do not take payments from Customers; we do not collect card or bank details on the Platform.

2.5. Your data is hosted and processed on the servers of service providers located abroad (sections 10 and 11).

2.6. You can delete your account at any time from within the app (section 14).

3. Data we collect from Customers and what we use it for

3.1. Account information. We process your full name, email address, phone number and language preference in order to create your account, identify you, pass your appointment on to the Business and communicate with you. Full name and phone number are required; we ask for your phone number so that the Business you book with can reach you in cases such as a time change, a delay or a cancellation. Your email address is obtained when you sign up with email or sign in with your Google or Apple account; it is used as your sign-in identifier, to send verification codes and to deliver emails about your appointment.

3.2. Sign-in and security information. Your password (only as an irreversible hash), verification and password reset codes, your session records and, together with these records, your IP address and device or browser information are processed in order to verify your identity, manage your session and protect your account against misuse.

3.3. Profile photo (optional). The photo you choose or take is resized, stored and shown on your profile. The photo file is kept at a publicly accessible web address; that is, anyone who knows the address can view it. We do not show your photo to Businesses. You can remove it at any time from the Profile screen.

3.4. Appointment information. The Business, services and specialist you choose, the date and time, the total price and duration, the appointment code, the channel through which the appointment was created, its status and its history (request, confirmation, decline, cancellation, rescheduling, "No-show" or "Completed" marks and their times) are processed in order to create your appointment, pass it on to the Business and manage it.

3.5. Appointment note and cancellation reason (optional). The note you write for your specialist when booking and the reason you give when cancelling are shown to the Business. These are free-text fields. Please do not write special categories of personal data, such as information about your health, or personal information that is not needed for your appointment in these fields.

3.6. Favorites. The Businesses you add to your favorites are stored in your account so that you can reach your list from different devices. Only you can see your favorites.

3.7. Reviews. The rating you give and the comment you write for a completed appointment are published publicly on the Business's page. Your name is shown in shortened form (for example "Ayşe K."); the date and the name of the service you received appear next to the review. Even though your name is shortened, the Business may be able to tell who wrote the review from its date and the service information. You can edit or delete your review at any time, except for reviews that have been removed from publication for breaching the rules. Because your review is published publicly, please do not include in it special categories of personal data, such as information about your health, or information that identifies you or other people.

3.8. Review reports. When you report a review as inappropriate, the reason you select and the note you add are recorded for examination, together with the rating and text of the review at that moment. Who made the report is not shown to the author of the review or to the Business.

3.9. Notifications and your preferences. The history of the notifications we send you (the type of notification, the code and time of the related appointment, the names of the Business and the specialist and, if any, the reason written by the Business), your notification preferences and, if you have allowed notifications, your device's push notification token and which platform (iOS, Android or web) you use are processed in order to deliver developments about your appointment to you and to remind you to review your completed appointment.

3.10. Declaration and preference records. When you sign up with email, your declarations that you accept the Terms of Use and that you have read the KVKK Disclosure, and your campaign permission preference, are recorded together with the screen on which and the time at which they were made and the version of the text shown to you. Where the app offers sign-in with Google, Apple or a phone number and you sign in that way, your continuing after the notice on the sign-in screen (that by continuing you accept the Terms of Use and confirm that you have read the KVKK Disclosure) is recorded in the same way, unless these declarations are already recorded on your account; on these routes campaign permission is neither asked for nor recorded. Each later change to your campaign permission preference is recorded in the same way, whichever method you sign in with. The declaration regarding the KVKK Disclosure only shows that the text has been read; it is not an approval or a consent, and the processing of your personal data is not based on this declaration.

3.11. Location (optional). If you allow it, we use your device's current location to find the province and district nearest to you and to sort Businesses by distance. Your location is sent to our server only to answer that query; it is not saved to our database and no location history is kept. The province and district you select are stored only on your device. If you do not allow location access, you can continue to use the Platform by selecting your city manually.

3.12. Support correspondence. When you write to us by email, the content of your message and the technical information the app automatically adds to it (app name and version, operating system version, language) are processed in order to answer your request.

3.13. Abuse prevention records. To limit excessive requests and keep email sending secure, we keep short-lived technical records; for example request counters linked to your account and a hash of your email address instead of the address itself. We may keep, on a suppression list, the hash of addresses to which a message could not be delivered or which marked a message as unwanted, in order to prevent sending to the same address again.

3.14. Use without an account. Without an account you can discover Businesses, search and see available times; an account is required to send an appointment request. When you use the Platform without an account, no profile is created for you on our servers; only the location query, if you have allowed it, and the usage measurement described in section 6 are carried out without being linked to an account, and your preferences are kept on your device.

4. Additional data we collect from Business users

4.1. Randevi Business accounts use the same infrastructure as Randevi accounts; the account, sign-in and security, notification, support and abuse prevention data described in section 3 and the usage measurement in section 6 also apply to Business users. In addition, the following data is processed.

4.2. The Business's legal identity. At application, the legal name, tax office, tax identification number (for sole proprietorships, the Turkish national identity number) and an image of the tax certificate are collected. This information is used to verify the applying Business, to form the contract between the Business and us and to support our financial records; it is not public. Legal identity information can be seen only by the owner and managers of the Business and by the Platform Operator's officers who review applications; the uploaded tax certificate file can be opened only by the officers reviewing the application.

4.3. Business profile. The Business name, categories, description, address, map location, phone, email, Instagram and website links, opening hours, services and prices and photos are shown publicly, including to visitors without an account, on the Platform and on the Business page at randevi.org once the Business is published. For sole proprietorships, some of this information (for example phone and address) may be personal data of the business owner.

4.4. Team and specialist information. The name and title of the specialists added by the Business are shown publicly on the Business page and appear in appointment notifications. Team membership and role information (owner, manager, specialist), shift and time-off records and specialist-level appointment and revenue reports are visible only within the Business's team and according to role permissions. When adding a time-off record, the Business can select one of the labels "Annual leave", "Sick", "Training" or "Personal". Because the "Sick" label may indicate the employee's state of health, it may be considered a special category of personal data; whether to use this label, informing the employee and, where required, obtaining the employee's explicit consent are the responsibility of the Business. A Business can also add an employee who has no account on the Platform as a specialist; in that case informing the employee is the responsibility of the Business.

4.5. Team invitations. When you invite someone to the team, the contact detail you enter for the invitation (phone or email) and the role, status and validity period of the invitation are recorded. We do not send the invitation link; you share the link yourself.

4.6. Application, decision and transaction records. The date of your application, the version and time of your acceptance of the Terms of Use, including the provisions for Businesses, the outcome of the application, the decision date and, in case of rejection, the reason are recorded. If you entered a representative referral code in your application, that code and the related representative record are linked to your Business record. The account that closes a Business or transfers its ownership, the time of the transaction and the reason written are also recorded.

4.7. Subscription information. The Business's subscription plan, period and status, the trial and period end dates and the channel through which the subscription is provided (App Store, Google Play or a period granted by our support team) are recorded. Your card or bank details do not reach us and are not stored by us. Once in-app purchases are enabled, your payment is taken by the Apple App Store or Google Play under their own terms; to verify subscription status, a randomly generated identifier belonging to your account, the product purchased and subscription events are processed through a service provider called RevenueCat, and the record of subscription events received from the store is kept by us.

4.8. Review replies and complaints. The replies you write to Customer reviews are published publicly; the name of the person who wrote the reply is not shown. When you report a review, the reason you select and your note are recorded for examination together with a copy of the review at that moment.

5. Data we do not obtain directly from you

5.1. Sign in with Google or Apple. If you choose to sign in with one of these methods where offered in the app, we receive from the relevant provider, together with a token that verifies your identity, the following information: from Google, your name, email address, the address of your profile photo and your Google account identifier; from Apple, your email address (or, if you chose Apple's "Hide My Email" feature, the relay address Apple created for you), your Apple account identifier and, only at your first sign-in, your first and last name. Your Google profile photo stays on Google's servers and is displayed from there. Your password with these providers is not passed to us.

5.2. Information the Business enters about you. A Business you book with can create an appointment record on your behalf, mark your appointment as "No-show" or "Completed", write a reason that is passed on to you when declining or cancelling the appointment, and keep an internal note about you that only its own team can see. You cannot see this internal note in the app; for requests concerning the note, see section 15.

5.3. People who are not members of the Platform. Businesses can also add customers who have no account on the Platform to their own customer lists, with a name and optionally a phone number, and create manual appointment records for them. These records are created by the Business and are seen only by that Business's team. We store these records only as part of the service we provide to the Business and on behalf of the Business; we do not send notifications to these people and we do not use these records for our own purposes. Who is responsible for these records is explained in the KVKK Disclosure; you can send your requests concerning these records directly to the relevant Business, and we also forward requests that reach us to the relevant Business.

6. Usage measurement and error records

6.1. To understand how the Platform is used and to improve it, we record usage events; for example the screen viewed, the search made, the Business viewed, appointment steps and sign-in and sign-up steps. These records are not sent to a third-party analytics service; they are kept in our own database.

6.2. Each event is recorded together with the name and details of the event, the app and platform it came from, a session identifier generated at random each time the app is opened and, if you are signed in, a shortened hash derived from your account identifier. This hash does not contain your name or contact details; however, because it can be matched back to your account, these records are not considered anonymous and are protected as personal data.

6.3. We apply a filter that prevents information such as name, email, phone, address, location and password from entering these records. The text you type into the search box and the reason you write when cancelling an appointment do not enter these records either: for a search only the number of results is recorded, and for a cancellation only whether a reason was written. Values in the form of an email address or phone number are removed.

6.4. This measurement also covers use without an account, and at present there is no setting in the app that turns this measurement off. You can send us your objection on this matter through the channels in section 19. When you sign out and when you delete your account, the measurement identifier on your device is reset. Usage measurement records are deleted after 180 days; when you delete your account, the records that can be linked to your account are deleted without waiting for that period (paragraph 14.3).

6.5. Web error records. In the web version only, when an error occurs, the error text, its technical trace, the context in which it occurred and your browser information are sent to the error log at our web hosting provider (at most 10 records per session). Security policy violation reports produced by your browser are also written to the same log, together with the address of the page concerned. Error texts and page addresses may, in rare cases, contain personal information; for example an appointment code or a search query. The mobile apps do not send error or crash reports.

7. What we do not collect and do not do

7.1. We do not show ads; we do not use advertising or tracking software; we do not track you across other companies' apps and websites.

7.2. We do not sell or rent your personal data.

7.3. We do not take payments from Customers; we do not collect card or bank details on the Platform. You pay the service fee directly to the Business.

7.4. We do not ask Customers for their date of birth or identity number; nor do we request special categories of personal data such as health data.

7.5. We do not collect location in the background. We do not upload your contacts, the other events in your calendar or photos you did not select to our servers.

7.6. We do not use third-party analytics, crash reporting or advertising network services.

8. Device permissions and notification preferences

8.1. The apps request the permissions below only when you use the related feature. If you do not grant a permission, only that feature does not work; you can continue to use the rest of the Platform.

8.2. Location. In Randevi, it is used only while the app is open, to sort Businesses near you by distance. In Randevi Business, it can be used to set your business's place on the map; the point you mark is saved as the Business's public location. Without granting location access you can still select your city in Randevi and mark your business's place by tapping the map in Randevi Business.

8.3. Notifications. Requested so that we can deliver appointment confirmations, changes and reminders to you instantly. If you do not grant permission, you continue to see notifications in the in-app notification center; some developments that change the status of your appointment are also sent by email.

8.4. Camera and photos. In Randevi, used to choose or take a profile photo; in Randevi Business, used to add photos to the business gallery, upload the tax certificate and save your business's QR code to your photos. Only the image you choose or take is uploaded.

8.5. Calendar. In Randevi, used when you choose to add your appointment to your device's calendar. The event is written only to the calendar on your device; the other events in your calendar are not read. On some iOS versions, because the add-to-calendar screen can suggest addresses from your contacts for the location field, the system may additionally ask for contacts permission; your contacts are not recorded by us and are not uploaded to our servers.

8.6. Turning permissions off. You can withdraw the permissions you have granted at any time: on iOS, Settings → Randevi or Randevi Business; on Android, Settings → Apps → Randevi or Randevi Business → Permissions; on the web, your browser's site permissions section.

8.7. Notification preferences. You can turn reminders and reminder emails on or off under Profile → Notification Preferences in Randevi, and cancellation notifications and the daily digest in the notification preferences under Settings in Randevi Business. After a completed appointment, a notification reminding you to write a review may be sent to you; this notification is not sent by email and is not sent if you turn reminders off. Notifications that change the status of an appointment, such as its confirmation, decline, cancellation or time change, are part of the service; they are always shown in the notification center, and emails about them are sent to Customers regardless of their preferences.

8.8. Campaigns and announcements. Campaign messages are off by default; under Law No. 6563 on the Regulation of Electronic Commerce they can be sent to Customers only with their prior permission. You can turn your permission on or off at any time with the "Campaigns & suggestions" option under Profile → Notification Preferences in Randevi. No campaign messages are sent to you unless you give permission. Details of this permission are set out in the Explicit Consent Text.

9. Who sees your data

9.1. The Business you book with. The Business sees your first and last name, your phone number, the details of your appointment, the note you wrote for the appointment, your cancellation reason and your appointment history at that Business (your total number of appointments, the number of appointments you did not attend and the date of your last visit). The owner and managers of the Business see all appointments at that Business, while specialists see only their own appointments and their own customers. This information appears in the Business's customer list for as long as you have an appointment history at that Business and your account is open. When using this information passed on to it for its own activities, the Business is a separate data controller independent of the Platform Operator; the details are in the KVKK Disclosure.

9.2. What Businesses do not see. Your email address, profile photo, favorites, notifications, preferences and your appointments at other Businesses are not shared with Businesses. Your "No-show" record appears only in the relevant Business's own customer list; it is not shared with other Businesses and the Platform does not apply any automatic restriction to you on the basis of this record.

9.3. The Business's communication with you outside the Platform. The Business may call you by phone or write to you on WhatsApp. In that case your number is passed to the phone or WhatsApp app on the Business user's device. This transfer is initiated by the Business; communication on these channels is the responsibility of the Business and is subject to the privacy terms of the app concerned.

9.4. Public content. Your reviews (with your shortened name), Business profiles, the names and titles of specialists and the replies Businesses write to reviews can be seen by everyone, including visitors without an account.

9.5. Access within the Platform Operator's organization. Our officers who review applications and review complaints access only the records needed for that work; the review tools do not give access to Customer accounts, appointments or Businesses' customer lists. System-administrator-level access is used only for technical maintenance, security and support, by authorized persons who need it for their duties. The hosting account of our website is managed on our behalf by a third person; that person can also access the web error records described in paragraph 6.5, solely in order to keep the site online.

9.6. Service providers. The service providers we use to run the Platform are listed in section 10.

9.7. Competent authorities. Where public bodies and judicial authorities empowered by law make a duly submitted request, we may share information to the extent our legal obligation requires.

10. Third-party services we use

10.1. Supabase (database, authentication, file storage and server functions). All of the data on the Platform is hosted on Supabase infrastructure. The place where the database, authentication records and files are kept: currently South Korea (Seoul).

10.2. Resend (email delivery; United States of America). To send verification code, password reset and appointment emails, your email address and the content of the email are transmitted; the content may include the verification code or link, the Business name, the appointment date and time, the specialist's name, the appointment code and, if any, the reason written by the Business. Account, subscription and daily digest emails sent to Business users are also delivered with this service.

10.3. Google Firebase Cloud Messaging and Apple Push Notification service (push notifications). In the mobile apps, your device's push notification token, the title and text of the notification (Business name, appointment time, specialist's name and, if any, the reason written by the Business) and the technical information that determines which screen the notification opens (notification type and appointment code) are transmitted. Notifications do not contain your name or phone number. Delivery to iOS devices is carried out by Apple. The notification infrastructure may create an installation identifier for your device when the app is opened. We do not use Firebase's analytics and advertising features. There are no push notifications on the web; push notifications may not be available on every device and in every version.

10.4. Sign in with Google and Sign in with Apple (identity providers). Used only when you choose to sign in with these methods; the information received is described in paragraph 5.1. These providers carry out the sign-in process under their own privacy policies.

10.5. Vercel (web hosting; United States of America). The website and web apps at randevi.org are hosted on Vercel. When you visit the site, your IP address and browser information reach Vercel by the nature of the hosting service; the web error records described in paragraph 6.5 are also kept there.

10.6. OpenStreetMap (map images). When you open a map, the map images are loaded directly from OpenStreetMap servers; in the process your IP address, the app's identifier and the map area you are viewing reach these servers. Your account identifier and your device's location are not sent.

10.7. App stores and subscription infrastructure (Business owners only). Once in-app subscription purchases are enabled, payment is taken by the Apple App Store or Google Play; RevenueCat (United States of America) is used to verify subscription status. Details are in paragraph 4.7.

10.8. External links you initiate. Actions such as directions (Apple Maps, Google Maps, Yandex Maps), phone calls, WhatsApp, the Business's Instagram account or website, sharing and adding to calendar open the relevant app on your device. For directions, the Business's location and name are passed to the relevant app; we do not pass on your location. These apps are subject to their own privacy terms.

10.9. Externally hosted images. If you signed in with Google, the profile photo in your Google account is loaded from Google's servers. If a Business photo is hosted at an address outside the Platform, it is loaded from that address. In the process, the server hosting the image may see your IP address and your device or browser information.

10.10. Our email inbox ([EMAIL INBOX PROVIDER]). The support and application emails you write to us (paragraph 3.12) are kept in this provider's mailbox.

10.11. We do not sell your data to these service providers; we pass on to each of them only the data that the service concerned requires. With the providers that process data on our behalf (10.1 hosting, 10.2 email delivery, 10.3 push notifications, 10.5 web hosting, 10.10 our email inbox and, once enabled, the subscription infrastructure in 10.7), we enter into agreements requiring them to protect your data at least at the level described in this policy. Identity providers (10.4), the map provider (10.6), app stores (10.7), the apps behind the external links you initiate (10.8) and the servers hosting external images (10.9) operate under their own privacy terms. When we start using a new service provider, this list is updated.

11. Transfers abroad

11.1. The service providers we use for hosting, email delivery, push notifications and web hosting are established abroad and process your data on servers abroad; your personal data is therefore transferred abroad. The place where your data is kept for the database, authentication and file storage: currently South Korea (Seoul). For email delivery and web hosting, data is processed in the United States of America; for push notifications, on the servers of Google and Apple abroad. The place where the email inbox that holds the emails you write to us is hosted: [EMAIL INBOX HOSTING LOCATION]. When you sign in with Google or Apple and when you open a map, the relevant providers' servers abroad may also be used. Once in-app purchases are enabled, the subscription infrastructure provider (United States of America) will be added to this list.

11.2. Because these transfers are made continuously for the Platform to operate, they are not based on your explicit consent. Transfers to the providers that process data on our behalf (hosting, email delivery, push notifications, web hosting and our email inbox) are made under [CROSS-BORDER TRANSFER BASIS], in accordance with the fourth paragraph of Article 9 of the KVKK. The data transferred and the recipients are set out in section 10, and the legal ground for each processing activity is set out in the KVKK Disclosure. You can find out to whom your data has been transferred through the channels in section 15.

11.3. Your sign-in request, when you choose to sign in with Google or Apple, and the information listed in paragraph 10.6, when you open a map, are transmitted directly from your device to these providers. In these two cases, the basis under Article 9 of the KVKK is: [IDENTITY AND MAP PROVIDERS TRANSFER BASIS].

12. Cookies, local storage and data kept on your device

12.1. Cookies. We do not use advertising, tracking or analytics cookies on our website and web apps; our apps do not write cookies to your browser. For this reason we do not show a cookie consent window. Your session and preferences are kept in your browser's local storage instead of cookies.

12.2. What is kept in your browser on the web. When you sign in, your session keys and a copy of your account information (such as name, phone and language) are kept in your browser's local storage and deleted when you sign out; if you turn off the "Stay signed in on this device" option on the sign-in screen, the session is kept only in memory while the page is open. Your language and theme preference, the province and district you selected, your recent searches and your notification preferences are also stored in local storage. Your unfinished appointment cart (including the note you wrote), the Business you wanted to add to favorites without signing in and the page you will return to after signing in are kept only until the tab is closed.

12.3. What is kept on your device in the mobile apps. Your session keys are kept in the device's secure storage (Keychain on iOS, encrypted storage on Android) and are not included in cloud backups. In addition, your language and theme preference, the province and district you selected, your recent searches, your notification preferences, a copy of your upcoming appointments so that you can see them offline (excluding your appointment note) and a record of the appointments you added to your calendar are stored on your device. In Randevi Business, the draft of the information you enter during business setup (including the legal name and the tax or identity number) is also kept on your device.

12.4. Clearing. When you sign out or delete your account, session information, recent searches, the appointment copy, the calendar record and notification preferences are deleted from your device; preferences such as language, theme and city remain. The setup draft in Randevi Business stays on your device when you sign out and is loaded only when the same account signs in again; it is deleted from your device when you delete your account. You can delete all the data kept on your device by clearing your browser's site data or uninstalling the app.

13. Retention periods

13.1. Account information, favorites and notification preferences: kept for as long as your account is open; deleted when you delete your account. Declaration and preference records (your declarations regarding the Terms of Use and the KVKK Disclosure, and the moments at which you gave and withdrew campaign permission): kept for as long as your account is open; deleted when you delete your account.

13.2. Reviews: remain published until you delete them or delete your account. Reviews removed from publication for breaching the rules are not deleted but hidden; a hidden review can be seen only by its author.

13.3. Appointment records (including the history of the appointment and the decline or cancellation reasons written by the Business): kept linked to your account for as long as your account is open, because they are part of the Business's appointment history. When you delete your account, the records are not deleted; their link to your identity is severed: the link to your account, the appointment note you wrote and any cancellation, withdrawal or decline reason you wrote are deleted. The appointment code, the Business, the specialist, the date and time, the services, the price, the status and the transaction history, together with the reasons written by the Business, remain as the Business's record; the Business can no longer reach your name and phone number through these records. The remaining record is nevertheless not considered anonymous: the Business may remember the appointment from its date, the appointment code appears in emails previously sent to you, and a reason written by the Business may contain your name; these records continue to be protected as personal data. No separate deletion period applies to the remaining records; you can send your requests regarding them through the means in section 15.

13.4. Notification history: 90 days. Technical queue records of notifications whose delivery has been completed: 30 days.

13.5. Usage measurement records: 180 days; when you delete your account, the records that can be linked to your account are deleted without waiting for that period.

13.6. Rate limit records and records that prevent the same transaction from being carried out twice: 24 hours. Verification email sending counters (a hash of your email address instead of the address itself): deleted, once the counting period has passed, at the next sending to the same address. Records of blocked sending attempts: records older than 30 days are deleted when a new record is written. Email suppression list records (the hash of an address to which a message could not be delivered or at which it was marked as unwanted): kept without a time limit. When you delete your account, these three kinds of record belonging to the verified email address of your account are also deleted; records belonging to an unverified address remain as that address's records.

13.7. Push notification token: deleted when you sign out, when you sign out of all devices, when the token becomes invalid or when you delete your account.

13.8. Records of review reports: kept together with a copy of the review text at the time of the report, in order to be able to show the basis of the decision made. When the author of a review deletes their account, the text copies taken from the reviews they had not deleted by then are deleted; when a person who made a report as a Customer deletes their account, the note they wrote and the link to their account are deleted, while the note of a report made on behalf of a Business remains as the Business's record. The rest of the record (reason type, rating, decision and date) remains with its links to accounts removed. If you deleted your review yourself before deleting your account, the text copy in the record relating to that review is not deleted by the account deletion process, because it is no longer linked to the review; you can ask for it to be deleted at the email address in section 19.

13.9. Session and security logs: your session records are deleted when your account is deleted. The audit log records that the authentication service keeps in our database, which contain your account identifier, your email address and your IP address, are kept for as long as your account is open; when you delete your account they are deleted together with the deletion or, where that is not possible, at the following daily clean-up at the latest. The access, delivery and error logs that our hosting, email delivery, push notification and web hosting providers keep in their own systems, however, are not deleted by our deletion process: their period is not under our control, and they are deleted when the relevant provider's log retention cycle expires.

13.10. Support correspondence: the emails you write to us are kept in our inbox and are not deleted automatically when you delete your account. When you ask for them to be deleted through the channels in section 19, we delete them unless they are a record we are obliged to keep.

13.11. Backups: database backups are taken by our hosting provider. Deleted data may remain in backup copies until the provider's backup cycle expires; this period is not under our control. Backups are kept solely for restoring data in the event of data loss.

13.12. The Business's legal identity information (legal name, tax office, tax identification number or Turkish ID number) and the tax certificate: kept for as long as at least one user account is linked to the Business's record; deleted when the last user of a closed Business also deletes their account. The application and decision records (the application and decision dates, the reason in the event of rejection and the representative referral code entered in the application) and the version and time of the acceptance of the Terms of Use are not deleted in that case either; they remain together with the Business's record (paragraph 14.8). Subscription records: when its owner deletes their account, the record showing the current status of the subscription is transferred to another owner of the Business if there is one, and deleted if there is none; the history of subscription events remains together with the Business's record, with the account identifier removed.

13.13. Records entered by the Business (team invitations, specialist records, working hours and time off, manually added customer records and internal Business notes): kept for as long as the Business uses the Platform; after the Business is closed or the agreement ends, they continue to be kept for as long as a user account is linked to the Business's record. When the last user of a closed Business deletes their account, the manually added customer records, the internal Business notes and the contact details in invitations are deleted; the specialist records, working hours and time-off records remain together with the Business's record (paragraph 14.8). An internal Business note is also deleted automatically when the Customer concerned deletes their account.

13.14. When a Business is closed, it is removed from search and discovery, can no longer receive online appointments, and the access of users other than its owner ends. The Business's record, its public profile and past appointments continue to be kept so that Customers can see their own appointment history; the profile may still be viewed by anyone who has its link. When the last user of a closed Business also deletes their account, the profile is taken down and is no longer shown to anyone other than our authorised staff. Customers' appointment records at that Business (date, time, services, amount and status) remain in their own appointment history; the Business's name and profile are no longer shown in those records. A Customer can still see and delete the review they wrote for that Business; the review is not shown to others (paragraph 14.8).

13.15. In the event of a legal dispute or an official request, the relevant data may be kept until the dispute is resolved. If there is a record we are obliged to keep despite your deletion request, we will inform you of the reason and the period.

14. Deleting your account and your data

14.1. How to delete. Follow Profile → Security → Delete My Account in Randevi, or Settings → Account → Delete Your Account in Randevi Business, and type "DELETE" to confirm. If the app is not installed on your device, you can also sign in at randevi.org and use the Delete Account option in the Profile section. Deletion starts upon your confirmation and cannot be undone; you can sign up again later if you wish. These steps are also described on the page at randevi.org/account-deletion; that page is for information only, and deletion itself is carried out from within the app or through the email request described below. If you cannot access the app, you can also request deletion by writing to the email address in section 19 from the email address registered to your account. We complete deletion requests sent by email within 30 days at the latest and inform you.

14.2. What you should know before deleting. Your upcoming confirmed appointments are cancelled, your pending requests are withdrawn and the Business concerned is informed. The Business sees that the appointment was closed because your account was deleted. If you are the sole owner of a Business (including an unfinished setup draft), you must first transfer ownership or close the Business before you can delete your account. If you have a subscription purchased through an app store, deleting your account does not cancel the subscription; you need to cancel the subscription separately from your App Store or Google Play account.

14.3. What is deleted. Your profile (name, email address, phone number, language preference and profile photo), your sign-in information and sessions, your declaration and preference records (your declarations regarding the Terms of Use and the KVKK Disclosure, and your campaign permission records), your favorites, your notifications and notification preferences, your devices' push notification tokens, the reviews you wrote and the replies Businesses wrote to them, the notes you wrote for your appointments and the cancellation, withdrawal or decline reasons you wrote, the internal notes Businesses keep about you, your memberships in Business teams, the usage measurement records that can be linked to your account (all records kept with the hash of your account identifier, and the records created before you signed in during the same app sessions), rate limit records, records that prevent the same transaction from being carried out twice, and the email suppression and sending counter records belonging to the verified email address of your account are deleted. The records relating to your account in the audit log that the authentication service keeps in our database (account identifier, email address and IP address) are deleted together with the deletion or, where that is not possible, at the following daily clean-up at the latest. The app deletes your profile photo file before your account; if a file could not be deleted, it is deleted at the daily clean-up.

14.4. What remains with its link to your identity severed. Your appointment records (appointment code, Business, specialist, date and time, services, price, status and transaction history) remain in the Business's records; these records no longer contain the link to your account, the note you wrote or any reason you wrote, and the Business can no longer reach your name and phone number through them. These records are nevertheless not considered anonymous and continue to be protected as personal data (paragraph 13.3). Appointment notifications that had already been sent to members of the Business remain; the copy of the reason you wrote is deleted from them, and a notification about a review of yours is deleted entirely. Records of review reports remain as described in paragraph 13.8. The record of a team invitation you accepted remains; your contact details in it are deleted. The record of subscription events remains; your account identifier in it is deleted.

14.5. What remains as the Business's own record. The following are the Business's records; they are not deleted when you delete your account, only their link to your account is removed, and some of them may continue to contain your name or contact details: the decline and cancellation reasons written by the Business; if a Business added you as a specialist, the specialist record entered by the Business (name, title and photo; it continues to be shown on the Business's page, and removing it is up to the Business) together with the working hours and time-off records the Business entered for you (including the type of time off; these are visible only to the Business's team); the reasons, review replies and review report notes you wrote on behalf of a Business; the contact details in team invitations you sent on behalf of a Business; a customer record that a Business created for you manually; and your contact details in a team invitation that a Business sent to you but you did not accept. You can send your requests regarding these records to the Business concerned or to us through the channels in section 19.

14.6. What is not deleted by the account deletion process. The access, delivery and error logs that our hosting, email delivery, push notification and web hosting providers keep in their own systems, and database backups, are not deleted by the account deletion process; they are deleted when the relevant provider's log and backup cycle expires, and we do not determine that period (paragraphs 13.9 and 13.11). In the technical records of the infrastructure that delivers in-app notifications instantly, your account identifier may remain, without any notification content; these records are deleted by the infrastructure's own retention cycle, and we do not determine that period. The emails you wrote to us remain in our inbox (paragraph 13.10). Hashed email records belonging to an unverified email address (for example an address change you did not confirm) remain as that address's records (paragraph 13.6).

14.7. What you can do without deleting your account. You can remove your favorites, edit or delete your review, remove your profile photo, update your name, email and phone details and turn off campaign permission. For other deletion requests, you can write to us.

14.8. If you are a Business owner. For as long as you are the sole owner of a Business that has not been closed (including an unfinished setup draft), your account is not deleted and none of your data changes; you must first transfer ownership or close the Business. If the Business has another owner, your account is deleted, the Business's records (legal identity information, tax certificate, contact details, customer records and notes) are left untouched, and the subscription record is transferred to the remaining owner. If you are the last user of a closed Business, the following records of the Business are deleted together with your account: the legal name, the tax office, the tax identification number or Turkish ID number, the tax certificate (the file itself at the following daily clean-up at the latest), the phone number, the email address, the Instagram and website links, the manually added customer records, the internal Business notes, the contact details in team invitations that were sent, and the subscription record. The Business's profile is taken down and is no longer shown to anyone other than our authorised staff; its photo files are deleted at the following daily clean-up at the latest. The following remain: the Business's profile information (name, address, map location, description, services and specialist records; in sole proprietorships this information may be your own personal data; it is no longer shown to anyone other than our authorised staff), working hours and time-off records, the application and decision records (including the representative referral code you entered in the application), the version and time of the acceptance of the Terms of Use, the closure record and the closure reason you wrote, appointment records (Customers see these records in their own appointment history without the Business's name), the reviews written for the Business (seen only by their author), and subscription event records with the account identifier removed. Because they are tied to Customers' appointment history, these remaining records are kept together with the Business's record; for information you want deleted, you can write to us through the channels in section 19. The setup draft that Randevi Business keeps on your device is also deleted from your device when your account is deleted.

15. Your rights

15.1. Under Article 11 of the KVKK, you have the right to learn whether your personal data is processed; to request information if it has been processed; to learn the purpose of the processing and whether the data is used in line with that purpose; to know the third parties to whom it is transferred in Turkey or abroad; to request rectification if it has been processed incompletely or inaccurately; to request its erasure or destruction within the conditions set out in Article 7 of the KVKK; to request that rectification and erasure be notified to the third parties to whom the data has been transferred; to object to a result arising to your detriment through analysis of your data exclusively by automated systems; and to claim compensation if you suffer damage because of unlawful processing.

15.2. What you can do from within the app. In Randevi, you can update your name, email and phone details under Profile → Personal Info; change your notification and campaign preferences under Profile → Notification Preferences; and sign out of your sessions on all devices and delete your account under Profile → Security.

15.3. Applications. You can send your requests by email to destek@randevi.org from the email address registered to your account, or in writing to the following address: Mimar Sinan Mahallesi, 194. Sokak, Güzelbahçe Sitesi, No: 7-9, Atakum / Samsun. Under Article 13 of the KVKK we answer your application as soon as possible and within 30 days at the latest, as a rule free of charge, in writing or electronically. The details of the application procedure are set out in the KVKK Disclosure.

15.4. A copy of your data. At present there is no tool in the app for downloading your data; you can request a copy of your data through the channels above.

15.5. Records kept by Businesses. For an internal note a Business keeps about you or a customer record it created manually, the data controller is the Business concerned; you can send your requests concerning these records directly to the relevant Business. We also forward requests that reach us to the relevant Business.

15.6. Right to complain. If your application is rejected, if you find our answer insufficient or if you do not receive an answer in time, you can lodge a complaint with the Personal Data Protection Board under Article 14 of the KVKK.

16. Security

16.1. The main measures we take to protect your data are as follows: communication between the apps and our servers takes place over an encrypted connection; your password is stored only as a hash; access rules in the database ensure that each user reaches only their own records, each Business only its own customers and appointments, and specialists only their own appointments; administrator-level access keys are not included in the apps and are used only on the server side; documents such as the tax certificate are kept in a storage area closed to the public; session keys are stored in secure storage on mobile devices and are not included in cloud backups; information such as email addresses is not written in clear form to the logs of the server functions we write ourselves (the authentication service's and our service providers' own records fall outside this rule; paragraph 13.9); request limits are applied against misuse.

16.2. No system is entirely free of risk. To protect your account, do not share your password with anyone and turn off the "Stay signed in on this device" option on devices you share with others. In a suspicious situation, sign out of all devices under Profile → Security and change your password.

16.3. If a data breach affecting your personal data occurs, we will inform the Personal Data Protection Board and the persons affected as soon as possible in accordance with Article 12 of the KVKK.

17. Children

17.1. The Platform is not directed at children. No age or date of birth is asked when an account is opened; we therefore cannot know the age of our users. The Platform is intended for use by persons who have reached the age of 18.

17.2. If we learn that a child under this age has given us personal data, we delete the account and the related data. If, as a parent or guardian, you believe your child has given us personal data, you can reach us through the channels in section 19.

18. Changes to this policy

18.1. We update this policy when we add a new feature to the Platform, start using a new service provider or when legislation changes. Where a new processing purpose, a new recipient group or a new service provider is involved, we publish the updated text on the Platform before the change is applied and renew the date and version information at the end of the text.

18.2. We additionally announce changes that significantly affect the use of your data within the app or through your registered email address; where your permission is required, we ask for your permission separately.

18.3. The text in the mobile apps is renewed with an app update; the most up-to-date version of the policy is available at randevi.org/yasal/en/privacy.

19. Contact

19.1. You can reach us with any question, request or complaint about this policy and your personal data. Platform Operator: Nihat Basmacı (sole proprietorship). Address: Mimar Sinan Mahallesi, 194. Sokak, Güzelbahçe Sitesi, No: 7-9, Atakum / Samsun. Email: destek@randevi.org.

19.2. You can also write to us with the "Write to Us" option on the Support screen in the Profile section of Randevi, and with the Support row in the Settings section of Randevi Business; neither is a separate channel: both open, in the email app on your device, a draft addressed to the email address in paragraph 19.1.

Last updated: [EFFECTIVE DATE]

Version: 1.0