Privacy Policy

PRIVACY POLICY Last updated: 2 October 2026 This page explains which of your personal data we process when you use the BiBasit Randevu apps or bibasitrandevu.com, why we process it, and how long we keep it. We have tried to write it plainly. If anything is unclear, write to support@bibasitrandevu.com. 1) WHO IS RESPONSIBLE Vorneka Yakuplu Mah. Hürriyet Blv. Skyport Residence No: 1 İç Kapı No: 113 Beylikdüzü / İstanbul Email: support@bibasitrandevu.com Where this page says “we”, it means the business above. ONE IMPORTANT DISTINCTION: the salon you book with is a SEPARATE data controller. The records the salon keeps in its own book, for example its private note about you, are the salon's responsibility and not ours. We provide the salon with storage for them. 2) WHAT WE PROCESS AND WHY We collect your data electronically: from what you enter in the apps and on the website (sign-up, bookings, reviews and messages), from the records the salon you book with enters for you, and from records created automatically while you use the service (device notification token, IP address, security and error records). The legal basis for each is listed below. a) IF YOU CREATE AN ACCOUNT Data: your email address, your password (stored only as an irreversible hash, never in plain text anywhere), your first and last name, and your phone number if you give one. Purpose: to create your account, identify you and let you sign in. Legal basis: performance of a contract. b) IF YOU BOOK WITHOUT AN ACCOUNT Data: your first name, last name and email address. Purpose: to create the booking, send you the confirmation and reminder, and let the salon recognise you. Legal basis: performance of a contract. We do not ask for separate consent for this data, because it is required for the booking to exist at all; consent must be withdrawable at any time, and if it were withdrawn there would be no booking. WORTH KNOWING: if you later create an account with the same email address and verify it, the bookings you made without an account are attached to that account. The app tells you this too. c) WHEN YOU BOOK Data: salon, service, staff member, date and time, price, booking status and your booking note if you write one. Purpose: to create the booking, pass it to the salon, remind you and show your history. Legal basis: performance of a contract. DO NOT PUT HEALTH INFORMATION IN YOUR NOTE: allergies, medical conditions or medication are special category personal data, and the booking note is not designed for them. If the salon needs to know something like this, tell them in person at the appointment. d) IF YOU WRITE A REVIEW Data: your rating, your review text and any photos you attach. Purpose: to publish the review on the salon page. Legal basis: performance of a contract and legitimate interest (trust on the platform). A review can only be written after a COMPLETED booking. e) IF YOU MESSAGE A SALON Data: your message text and any photos you send. Purpose: to carry the conversation between you and the salon. Legal basis: performance of a contract. MODERATION: messages pass two checks. A banned-term list is a hard rule and a matching message IS NOT SENT. An automated check also runs; a message it finds suspicious is sent but placed in a REVIEW QUEUE, which means a person may read it. We do this for safety and you should know about it. THE CHECK RUNS ON OUR OWN SERVER: we use an open-source model hosted by us. The text of your message is not sent to any outside service. The model receives only the text itself, never your name, your email or which salon you are writing to. f) FAVOURITES AND LOYALTY CARDS Data: the salons you favourite; your progress on stamp cards. Purpose: to make the feature work. Legal basis: performance of a contract. g) NOTIFICATIONS Data: your device notification token and your notification preferences. Purpose: to send booking confirmations, reminders, cancellations and message alerts. Legal basis: performance of a contract. You can turn notifications off in the app, and the unsubscribe link in our emails works too. h) LOCATION (only if you allow it) Data: the current location of your device. Purpose: in the customer app, to build the “salons near me” list; in the business app, to move the map to where you are while you choose the location of your salon. Legal basis: your consent. You can withdraw the permission at any time. We DO NOT STORE the location of your device; we use it only for that search or selection. What the business app saves is the SALON location you confirm. i) SECURITY RECORDS Data: your IP address, sign-in attempts, security events such as password changes, and technical error records. Purpose: to protect your account, detect abuse and attacks, and fix faults. Legal basis: legitimate interest and legal obligation. j) IF YOU ARE A BUSINESS USER Data: in addition to the above, your business and salon details, your subscription and payment records, your staff list, the photos you upload and, if you use stock tracking, your product catalogue, stock movements and product sales records. Purpose: to provide the service, bill you and meet statutory record-keeping duties. Legal basis: performance of a contract and legal obligation. k) IF YOU WRITE TO US ON INSTAGRAM Data: your Instagram username, profile name and profile picture; the messages, comments, photos and voice messages you send us; our replies. Purpose: to answer your question. Legal basis: legitimate interest (answering the question you sent us). ARTIFICIAL INTELLIGENCE: Reply drafts are prepared by an AI model running on our own server, hosted in Türkiye; your message is not sent to any outside AI service. Our team checks the drafts and sends them; only short standard replies such as greetings and thanks may go out without waiting for the team. Your photos and voice messages are processed on the same server only to understand your question: the transcript of a voice message is stored with the message, and we do not save the photo itself on our server. Messages arrive and leave through Meta's Instagram infrastructure; Meta also processes this data under its own privacy terms. l) IF YOU E-MAIL OUR SUPPORT ADDRESS Data: your e-mail address and display name, the subject line, the text of your e-mail, only the name and size of attachments; our replies. Purpose: to answer your question. Legal basis: legitimate interest (answering the question you sent us). ARTIFICIAL INTELLIGENCE: Reply drafts are prepared by the same model on the same server as in k); your e-mail is not sent to any outside AI service. Our team checks and sends every reply that goes out by e-mail. Attachment contents are not given to the model. Personal data requests, account deletion and complaints are never sent to the AI; they go straight to our team. A sender address is not proof of identity: actions such as deleting an account, changing an e-mail address or subscriptions are not done by e-mail but in the app. m) IF YOU BUY PRODUCTS AT A SALON Data: the product sale recorded by the salon: product name, quantity, the amount you paid, payment method (if the salon enters it), date and salon. If the sale is matched to your account or e-mail address, it appears in the app under “My purchases”. Purpose: the salon's sales and stock records; showing you your purchase history. We do not take the payment; you pay the salon. Legal basis: performance of the contract between you and the salon and the salon's legal obligation. The salon keeps this record under its own responsibility; we store it on the salon's behalf. 3) WHO WE SHARE IT WITH - THE SALON YOU BOOK WITH: your name, contact details and booking details are passed to the salon, which processes them under its own responsibility. - GOOGLE: notification delivery (Firebase Cloud Messaging), in-app purchases (Google Play) and the map screen in the business app (Maps SDK). When the map screen opens, Google sees the IP address and the area being viewed. - PAYMENT PROVIDER: iyzico, for subscription payments made on the website. Your card details NEVER REACH US; they go straight to the payment provider. - EMAIL DELIVERY PROVIDER: for confirmations, reminders and notices. Our provider is IN TÜRKİYE, and these emails are processed there as well. - HOSTING PROVIDER: our servers are IN TÜRKİYE. See section 4 for what that means if you are in the European Union. - PUBLIC AUTHORITIES: where legally required and where the request has a legal basis. We do not use any outside service for review and message moderation: it runs on our own server with an open-source model. We DO NOT SELL your data and we DO NOT SHARE it with third parties for marketing. 4) WHERE YOUR DATA IS PROCESSED WE ARE BASED IN TÜRKİYE AND OUR SERVERS ARE IN TÜRKİYE. Hosting, email delivery and content moderation all happen there. We have no servers anywhere else. IF YOU ARE IN THE EUROPEAN UNION, YOU SHOULD KNOW WHAT THAT MEANS: your data is processed in Türkiye, which is outside the EEA, and the European Commission has not issued an adequacy decision for Türkiye. You are giving your data to us directly, and we are established in Türkiye. Nothing about that is hidden from you: it is written here so that you can decide. We do not transfer personal data abroad from our own servers. Notifications (Firebase Cloud Messaging), in-app purchases (Google Play) and the map screen in the business app (Maps SDK) run on Google infrastructure; when you use these features, the related data (notification token and notification text, subscription payment, IP address and the area viewed on the map) passes through the servers of Google. Write to support@bibasitrandevu.com with any question about this. 5) HOW LONG WE KEEP IT - Account and profile details: until you delete your account. - Booking records: the salon record remains even after you delete your account, but your name and contact details are removed (see below). - Conversations with salons: 730 days (two years). PHOTOS attached to a conversation are deleted after 30 days; a photo usually belongs to a question being asked right then, so its life is deliberately shorter. - Security event records: 2 years. - Technical error records: the link to the user is deleted after 30 days; the type, message and technical details of the error are kept so faults can be tracked (daily summaries 90 days). Email addresses, phone numbers and similar data are masked before an error is recorded. - Notification tokens: deleted when you delete your account. - Instagram conversations: 180 days. - Support e-mails: 180 days. - Records of products you bought at a salon: the salon's sales record remains even after you delete your account, but its link to you (your account and e-mail address) is removed. Records are deleted automatically when the period ends; nothing waits for a manual step. 6) WHAT HAPPENS IF YOU DELETE YOUR ACCOUNT When you choose “Delete my account”: - You are asked for your password again. This prevents a hijacked session from destroying your account in a single tap. - YOUR UPCOMING BOOKINGS ARE CANCELLED. Otherwise the salon would be waiting for you at 2 pm with no way to reach you. - Your account is ANONYMISED: your name, email and phone number are erased. Past booking and review rows remain but can no longer be linked to you. The salon has a legitimate interest in those records (its turnover, its history, its accounts); it has none in your name and contact details. - YOUR CONVERSATIONS WITH SALONS ARE DELETED IN FULL, not anonymised. Free text can contain an address, a date or a complaint, and it would not be right for those to stay readable on the salon screen. The replies from the salon go too: deleting only your side would leave a one-sided record with no context. - Your favourites, sessions and device tokens are deleted. - The email address stored on your loyalty card is cleared as well. ONE EXCEPTION: if you own a business that still exists, you cannot delete your account. Otherwise the subscription, invoices and staff of that salon would be left without an owner, and customers with bookings there would be affected. Transfer or close the business first. 7) YOUR RIGHTS Under Turkish data protection law and, if you live in the European Union, under the GDPR, you have the right to: - know whether your personal data is being processed, and to obtain information about it, - learn the purpose of processing and whether it is used accordingly, - know the third parties to whom it is transferred, whether in Türkiye or in other countries, - have inaccurate or incomplete data corrected, - have your data erased, - have corrections and erasures notified to the third parties it was transferred to, - object to a decision produced solely by automated analysis that has an adverse effect on you, - claim compensation if you suffer loss from unlawful processing. If you are in the EU you also have the right to data portability and the right to restrict processing. TWO OF THESE YOU CAN EXERCISE DIRECTLY IN THE APP: - “Download my data” gives you your profile, bookings and reviews as a file. - “Delete my account” starts the deletion described above. For anything else, write to support@bibasitrandevu.com. We answer within 30 days. If you live in the EU, you also have the right to lodge a complaint with the data protection supervisory authority of your country. 8) CHILDREN You must be 18 or older to create an account. A parent or guardian who wants to book for a child can do so from their own account. If we learn that an account belongs to someone under 18, we close it and delete the data. 9) SECURITY Passwords are stored only as irreversible hashes. All traffic travels over an encrypted connection. Unauthorised access attempts are recorded and rate-limited. No system is perfect, though: if you notice something suspicious, write to support@bibasitrandevu.com. 10) IF THIS PAGE CHANGES When we update this policy you will see the new version in the app, and for a significant change you will be asked to accept it. Published versions are never edited; which version you accepted and when is recorded.