Privacy Policy
Last updated: 2026-02-14
This Privacy Policy explains how your personal data is collected, used, stored and protected when you use the Rezask platform ("Rezask", "Platform", "we"). By using Rezask you acknowledge that you have read this policy. For detailed disclosure under Turkish data protection law (KVKK), please also see our KVKK Notice.
Beta period notice
Rezask is currently in a pre-incorporation free beta/test phase and is not yet operated by a registered company. During the beta, your data is processed solely to run the service; booking data is shared only with the specific business you book with (e.g. your salon) and the infrastructure providers strictly required to operate the service. No data is used for marketing or sold. When the beta ends, personal data collected during this period will be deleted or irreversibly anonymised; users who wish to continue will be informed separately before the transition. Once the company is incorporated, this policy will be updated with the data controller's registered title and address.
Controller and processor roles
For account data of business owners and their staff, Rezask is the data controller. For data belonging to a business's own customers (end users who book appointments), the business is the data controller and Rezask acts solely as a data processor on its behalf. Questions about how a business uses your data should first be directed to that business.
Data we collect
When creating an account: full name, e-mail, phone number, password (stored only as an irreversible hash) and business details. When booking: full name, phone number, optional e-mail, booking details and any extra form fields defined by the business. Automatically: IP address, device/browser information, session and security logs. Once paid plans launch, payments are processed by iyzico; your card details are never stored on Rezask servers.
How we use data
We use your data to provide the service and manage your account, run booking/reminder/cancellation flows, keep the platform secure and prevent abuse, meet legal obligations, improve the product and answer support requests. We never send marketing e-mail/SMS without your explicit consent.
Where data is stored
Your data is stored with our infrastructure providers in data centres located in the European Union. Due to the nature of application hosting and content delivery, some processing records may be handled in providers' other locations.
Third-party service providers
We use a limited set of sub-processors to run the service: application hosting (Vercel), database and authentication (Supabase), transactional e-mail (Resend), error monitoring (Sentry), rate limiting (Upstash) and bot protection (Cloudflare Turnstile). These providers may access your data only to the extent required and under contractual confidentiality obligations. We never sell your data.
International transfers
Some of the providers listed above are established abroad. Your personal data may be transferred to servers abroad in accordance with Article 9 of the KVKK, based on the explicit consent collected during sign-up/booking. All transfers use encrypted connections.
Data security
Data is encrypted in transit with TLS; passwords are stored using irreversible algorithms; access is restricted through role-based permissions and row-level security (RLS). Granular staff permissions and audit logs cover all critical operations. No system is 100% secure — please use a strong, unique password.
Cookies
Rezask uses only strictly necessary cookies (session, security, language/theme preference); we use no advertising or tracking cookies. See our Cookie Policy for details.
Your rights
Under Article 11 of the KVKK you may learn whether your data is processed, request information, correction or deletion, learn the third parties it is transferred to, object to results produced solely by automated analysis, and claim compensation for damages. You can export your data or delete your account from the panel.
Retention
Account data is kept while your account is active. Upon deletion, personal data is erased or irreversibly anonymised; only records required by tax and commercial law (e.g. 10 years for invoice records) are retained for the statutory period. Audit logs are archived and purged periodically.
Changes to this policy
We may update this policy from time to time. For material changes we will notify you in-app or by e-mail, and the current version will always be published on this page.
Contact
For all privacy questions and requests: kvkk@rezask.com