Security and privacy
Where your clients' data lives, and who can see it.
Everything on this page is backed by the app's code or by the legal texts we publish. It doesn't claim any certification or independent audit.
Data location
The database, authentication and file storage are hosted inside the European Union, in the Frankfurt, Germany region. The provider is headquartered in the United States; our legal texts state that hosting in Germany also counts as a transfer abroad under Turkish data protection law (KVKK).
Our privacy commitment
Your data is encrypted, never sold and never shared for advertising; it is processed only by the contracted infrastructure that provides the service.
TLS protects data in transit and the infrastructure provider’s disk encryption protects stored data; verifying the storage-encryption setting in production is still an open pre-release step.
In-product tools for KVKK and GDPR
These tools are verified in the application source. Applying database changes to the live environment needs a separate approval, and this page is not a penetration test of the live environment.
Consent record
KVKK and health-data consents are recorded with their version; a new text version asks for consent again.
Data export
From the Data and account rights screen in the app you can share a copy of your own data.
Account deletion
You delete your account yourself in the app with a two-step confirmation; your access ends immediately. Retention obligations are explained separately.
Steps in the app
- Clients: Profile, then “Veri haklarım” (My data rights). Specialists: Profile, then “Verilerim ve hesabım” (My data and account). Admins and owners: Settings, then “Veri ve hesap hakları” (Data and account rights). Labels appear in your app language.
- On the Data and account rights screen, tap the delete-account button.
- In the confirmation card, tap the confirm button to finish the second step.
A store subscription is not cancelled automatically; cancel it separately in the App Store or Google Play. If you cannot reach the app, you can write your deletion request to the support address on the page below.
Account deletion pageAudit log
Sensitive actions are written to an audit log, minimised so that it does not carry the health data itself.
Financial access separation
For the admin role, access to financial information is off by default and opens only through a per-person read permission granted by the owner.
Device binding
An account is bound to a limited number of devices per role; the My sessions screen lists devices and lets you revoke them.
Two-step verification
Owner and admin accounts can optionally use an authenticator app (TOTP).
Inactivity timeout
Staff sessions end after 30 days without use and other users’ sessions after 90 days.
Biometric app lock
The mobile app can optionally lock behind the biometrics enrolled on the device; the preference stays on that device only.
GDPR statement
Your rights, the bases for processing and the sub-processors are published in a separate statement.
Read the GDPR statement
Sub-processors
The current list of providers that process data to deliver the service, with each one’s role and region, is kept in a separate document.
Subscription terms
- There is no commitment; you cancel at any time in the subscription settings of the store where you subscribed (App Store or Google Play).
- You keep access until the end of the period you cancelled; no refund is given.
- Prices are in Turkish lira and include VAT; the binding amount is the one the store shows at purchase.
- A feature that is free today is not moved to a paid plan later.
When you're ready
Give it a real week.
Download the app, set up your studio and run it with real bookings for two weeks. We won't ask for a card. If you stay, you subscribe through your app store.