Privacy Policy

1. Introduction

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Kuafor Osso mobile application ("App") and the online booking services on the kuafor-osso website ("Web Booking").

This document is a privacy notice; it does not replace explicit consent by itself. For general terms of use, see our Terms of Use.

2. Data Controller

Under Turkish Personal Data Protection Law No. 6698 ("KVKK"), the data controller is:

3. Scope

This policy applies to:

• Customers who book appointments, create profiles, or use Web Booking
• Staff members of the salon
• Administrators (salon owners or authorized managers)

"Services" include appointment management, POS/payment recording, CRM, inventory, payroll, reporting, and notifications.

4. Personal Data We Collect

4.1 Identity and Contact

• Name, phone number (required for login), country/dial code
• Optional email and date of birth, profile photo

4.2 Account Data

• User ID, role, account status, salon ID
• Creation/last login dates, deletion reason (if applicable)

4.3 Appointment Data

• Date, time, duration, status, services, staff, notes
• Completion photos, cancellation/no-show records, booking channel (app or web)

4.4 Financial Data

• Payment method records (cash, card POS record, store credit, bank transfer, gift card)
• Amounts, discounts, customer debt ledger, staff payroll and bank details (IBAN)

Important: We do not collect or process credit card numbers, CVV, or similar payment credentials. Card payments are processed in-person; we only record the payment method.

4.5 Customer Profile and Behavioral Data

• Appointment statistics, favorite staff/services, booking patterns
• Lifetime spend, referral codes, ratings, salon notes and tags, segmentation labels

4.6 Staff Profile Data

• Work schedules, bio, specializations, holiday preferences, gallery images
• Booking policies, WhatsApp message templates

4.7 Device and Technical Data

• OS type, app version, device model (staff registration)
• FCM push tokens, staff device ID, hardware fingerprint, local UI preferences

4.8 Notifications

• In-app and push notification content (appointments, confirmations, campaigns, security)
• Linked appointment/campaign/salon IDs, campaign delivery status

4.9 Feedback

• Service ratings and private staff feedback

4.10 Salon/Business Data

• Salon name, contact details, address, map coordinates, service/product images

4.11 Contacts — Temporary Access

With explicit permission, staff may read name and phone from your device contacts to create a customer record. We do not upload all contacts automatically; only the contact details that staff explicitly chooses to add as a customer record are stored on our servers.

4.12 Analytics

• Firebase Analytics: app opens, screen views, user ID, role, limited custom events

4.13 SMS and Transactional Messages

• Verification SMS: Login, registration, and phone changes use SMS OTP via Firebase Authentication.
• Transactional SMS (NetGSM): For Web Booking appointments, confirmation and reminder messages are sent via NetGSM and may include your name, appointment date/time, service, and staff information.
• A phone number is required for Web Booking; receiving SMS is necessary to provide the service.
• For app bookings, reminders are primarily delivered via push notifications.

4.14 WhatsApp Communication

• Manual communication: Tapping "Contact via WhatsApp" redirects you to the WhatsApp app. Your phone number is shared with WhatsApp (Meta); messaging is subject to WhatsApp's privacy policy.
• Message templates: Staff may use pre-defined WhatsApp templates stored in the salon system.
• Laser appointments: WhatsApp communication is recommended for requests, cancellations, or rescheduling.
• Automated WhatsApp notifications: Not currently active. If introduced in the future, this policy will be updated and explicit consent will be obtained where required.

4.15 Campaign Notification Data

• Campaign name, description, validity period, target audience (segments, tags, rules)
• Notification channel and status (push, in-app inbox)
• Associated phone number (if WhatsApp channel is enabled in the future)

5. How We Collect Data

• Information you enter in the App or Web Booking
• SMS OTP verification via Firebase Authentication
• Web booking confirmation and reminder SMS via NetGSM
• Automatically generated records from appointments, payments, and profiles
• Images uploaded via camera or gallery
• Push notification infrastructure (FCM, with your permission)
• Contact import (with your permission, staff only)
• Redirect to WhatsApp when you tap a WhatsApp link
• Server-side logs and security records

6. Purposes of Processing

7. Legal Bases (KVKK Art. 5 & 6)

• Performance of a contract (including web booking SMS)
• Legal obligation (accounting/tax records)
• Legitimate interests (security, fraud prevention, service quality)
• Explicit consent (cross-border transfers under KVKK Art. 9, contacts access, camera/gallery permissions, and separate marketing/campaign opt-ins)
• Establishment or protection of legal claims

We do not intentionally collect special categories of personal data under KVKK Art. 6.

8. Sharing and Third Parties

Firebase: firebase.google.com/support/privacy
NetGSM: netgsm.com.tr
WhatsApp: whatsapp.com/legal/privacy-policy

Salon staff and administrators may access customer data as needed for operations. Data may be disclosed to authorities when required by law. Data may be processed abroad via Google Firebase. For this transfer, we collect a separate explicit "cross-border data transfer consent" during registration/sign-in. If you do not provide this consent, we cannot provide digital membership and online services that rely on Firebase infrastructure.

9. Retention

Account deletion (Profile → Delete My Account): Identity is anonymized, auth account deleted, FCM tokens removed, completion photos removed. Debt records may be retained for accounting integrity.

10. Security

• Firestore/Storage security rules, server-side validation
• Phone OTP authentication, staff device registration
• Rate limiting, HTTPS/TLS, secure local storage
• Role-based access control

11. Device Permissions

Location permission is not requested. Salon address is set manually on the map.

12. Cookies and Analytics

Web Booking may use essential session cookies and browser storage. The App uses Firebase Analytics for usage statistics, not for third-party ad profiling.

13. Children's Privacy

Services are not directed at individuals under 18. We do not knowingly collect data from minors.

14. Your Rights (KVKK Art. 11)

You have the right to:

1. Learn whether data is processed
2. Request information about processing
3. Learn purposes and whether data is used accordingly
4. Learn about domestic and international recipients
5. Request correction of incomplete or inaccurate data
6. Request deletion under KVKK Art. 7
7. Request notification of correction/deletion to third parties
8. Object to adverse outcomes from automated processing
9. Claim compensation for unlawful processing

Delete account: Profile → Delete My Account in the App.
Requests: kuaforossobusiness@gmail.com — we respond within 30 days.

15. Notifications and Marketing Communications

Reading/accepting the Privacy Policy is not the same as marketing consent. Campaign and promotional communications use a separate opt-in mechanism in the app.

15.1 Service Notifications (Transactional)

The following are sent to provide the service and do not require separate consent:

• Login and phone change SMS verification codes
• Web booking confirmation and reminder SMS (NetGSM)
• Appointment reminder, confirmation, cancellation, and security push notifications
• In-app service notifications (inbox)

15.2 Campaign and Promotional Communications

Campaign announcements may be delivered via:

• Push notifications (FCM): To customers with the app installed and notification permission granted
• In-app notification inbox: To all eligible customer accounts

Target audiences are determined by customer segments, tags, and campaign rules. Campaign/marketing notifications are sent only to users who provide explicit consent for the relevant channel. WhatsApp campaign messages are not currently sent automatically. If this channel is enabled in the future, explicit consent will be obtained and this policy will be updated.

15.3 Notification Preferences

• You can disable push notifications in your device settings.
• To opt out of marketing/campaign notifications, use in-app notification settings or contact kuaforossobusiness@gmail.com.
• SMS reminders may continue while you use Web Booking as part of the service.

16. Changes

We may update this policy. Material changes will be communicated via the App or Web Booking. Current version: kuafor-osso.web.app/en/privacy-policy

17. Language and Prevailing Version

The original and legally binding version of this notice is the Turkish text. This English version is provided for convenience only. In case of conflict, the Turkish version prevails.

18. Contact

• Email: kuaforossobusiness@gmail.com
• General contact: kuaforossobusiness@gmail.com
• Address: Köprübaşı Mahallesi Konya Caddesi No: 132/A, Cihanbeyli, 42850 Konya, Turkey
• Phone: +90 507 095 74 92

This document is not legal advice. Consult a qualified attorney before publication. Turkish version