Privacy policy

Who this policy covers

This Privacy Policy explains how we process the personal data of the representatives and employees of businesses using İşlemde and of visitors to the islemde.app website.

We process the data of businesses' own customers (job records, customer name, phone number, device information, signature) on behalf of the business; the data controller for this data is the relevant business. Processing within this scope is governed by the Data Processing Agreement.

What data we process

• Account data: first name, last name, e-mail, a one-way hash of the password, role and business information.
• Billing data: trade name or full name, TCKN/VKN (Turkish ID or tax number), tax office, address, billing e-mail.
• Payment data: your card number never reaches us; the last four digits of the card, the card family and the storage keys returned by iyzico are kept.
• Usage data: sign-in times, IP address, browser information, session records and security logs.
• Communication data: e-mails you send us, support requests and live support chats on the site (with your e-mail address, if you left it), and any images, videos and PDF files you attach to them. Every attached file is scanned for malware on our own servers before it is opened; a file found to be malicious is deleted immediately.
• Message records: the recipient, time and delivery status of e-mail, SMS and WhatsApp messages sent from İşlemde to your customers; for WhatsApp notifications, the permission given by the customer and the time the permission was withdrawn.

For what purposes

• To provide the service and to manage your account and your team,
• to receive payments and issue statutory invoices,
• to ensure security and prevent misuse,
• to send mandatory notifications about the service,
• to fulfill legal obligations.

We do not sell your data for advertising purposes, and we do not use it for marketing communications without obtaining separate permission.

Who we share it with

In order to provide the service, we share data with the following service providers, only to the extent necessary:

• Vercel (application hosting; abroad, US-based): the servers on which the application runs, and therefore all data entered into the application.
• Railway (database and live update server; abroad, US-based): account, business and job records.
• Cloudflare R2 (file storage; abroad, US-based): job photos, documents, logos and invoice PDFs.
• Plunk (e-mail delivery; abroad): the address of the person to whom the e-mail is sent and the content of the e-mail. Account holders receive marketing e-mails only if they have given permission; businesses' customers are never added to marketing lists.
• iyzico (payment service; Türkiye): payment amount, billing details and card details (the card number is entered directly into iyzico).
• Paraşüt (issuing e-Fatura and e-Arşiv invoices; Türkiye): billing details and the invoice amount.
• Vercel AI Gateway and the artificial intelligence model providers behind it (classifying support requests, drafting replies and the replies of our AI assistant Tiki in live support; abroad, mainly the USA): the text of the support request or chat. E-mail addresses and phone numbers are masked before being sent; only providers that do not use prompts for model training are selected.
• Google Web Risk (abroad, US-based): only the address of a link you share in live support, in order to check whether it is a malicious or phishing site; the rest of the message is not sent.
• SMS providers (Netgsm, İleti Merkezi, Verimor, Mutlucell; Türkiye): businesses send SMS messages with their own provider accounts. The recipient's phone number and the message text are passed to the provider chosen by the business.
• Meta Platforms (WhatsApp Business Platform; abroad, USA and EU): if the business has connected its WhatsApp number and the customer has agreed to receive notifications via WhatsApp, the customer's phone number and the information in the message (name, device, job number, amount, appointment date, tracking link) are passed to Meta. Messages are sent from the business's own WhatsApp Business account; the customer can opt out at any time with the “Bildirimleri durdur” (Stop notifications) button in the message.

Transfers abroad: The servers of the providers marked "abroad" above are located outside Türkiye (USA and European Union). These transfers are made in accordance with Article 9 of Law No. 6698, with appropriate safeguards such as the standard contracts published by the Personal Data Protection Board. Data may also be shared in response to lawful requests from competent public authorities.

How long we keep it

• Account data (name, e-mail, sign-in details): for as long as your account is open. You can delete your account at any time from the “Delete my account” section on the My account → Profile page; your name, e-mail address, sessions and sign-in details are deleted immediately. Accounts that are not linked to any business and have not been signed in to for 12 months are deleted in the same way.
• Invoice and payment records: 10 years, as required by the Tax Procedure Law and the Turkish Commercial Code.
• Security logs and records of sent SMS messages: 1 year.
• When a business account is closed, job records, customers and photos are deleted within 90 days.
• For accounts whose trial has ended without a plan being chosen, or which have been restricted due to non-payment, job records, customers and photos are deleted 12 months after the end of the trial or after the day the payment became overdue. If you choose a plan within this period, nothing is deleted.

Security

Connections are encrypted (TLS). Passwords are stored as one-way hashes; two-step verification is supported. Photos and documents can be accessed only through time-limited, signed links. Customer tracking pages show only an abbreviated name and device information.

Your rights

For your rights under Article 11 of Law No. 6698 and how to apply, see the KVKK Privacy Notice page.

Cookies

Our site uses only strictly necessary cookies. Details are set out in the Cookie Policy.

Contact

Asaf Efe Bağ · ÇİLE MAH. 7454 SK. No: 9 MENDERES/İZMİR · destek@islemde.app