Privacy notice on the processing of personal data

1. Data controller

The data controller for your personal data is V3CODERS SOFTWARE SOLUTIONS - FZCO (IFZA Properties, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates). This notice covers the data you provide in the pre-registration and "notify me" forms on hepp.app. It is prepared under the Northern Cyprus (KKTC) Personal Data Protection Law no. 89/2007, and is also written to meet the information duty in Article 10 of Turkey's Personal Data Protection Law no. 6698 (KVKK) for people applying from Turkey. This notice also applies to the hepp app and the business panel.

Contact: [email protected]

2. Personal data we process

Which data we process depends on the form you fill in.

• Business pre-registration: business name, category, region, contact person's name, phone number and, optionally, email address, staff count range and a note.
• Notify me form: phone number and/or email address, region and the categories you are interested in. A vote on a coming soon category card is also a notify me sign-up, and the category you vote for is kept with that sign-up.
• Consent records: which checkboxes you ticked, when, and the version of the text you accepted.
• Technical data: to limit abuse we keep only salted hashes (pseudonymised data) of your IP address, phone number and email address for about 24 hours; our application and database do not store the IP address itself. When a form is submitted and when a sign-in, password reset or account deletion code is requested, Cloudflare Turnstile bot verification runs, its verification data is processed, and for verification our server or our sign-in infrastructure (Supabase) also passes your IP address to Cloudflare (see the Privacy Policy for how Turnstile works).

3. Purposes

We process your data only to:

• Evaluate your pre-registration and contact you,
• Let you know when the app launches,
• Decide which coming soon category opens first and show category votes on the site only as aggregate figures (percentage share); your personal data is not part of this display,
• Prevent abuse of the forms by bots and keep the system secure.

Optional gender (app)

In the hepp app you can optionally add a gender (woman or man) to your account and to your saved family members. It can be left blank, and leaving it blank does not stop you from using the service.

Purpose: to put businesses that suit you first in business categories that serve by gender, and to show a warning for a business that may not fit. Legal basis: you give it voluntarily (explicit consent); you can withdraw consent at any time by deleting it.

It is not shared with businesses and business accounts cannot see it. Information entered for family members is protected the same way; entering it on behalf of a family member is the account holder's responsibility. It is kept until your account is deleted or you delete it.

You can change or delete it in the app, or contact [email protected].

Data processed when you use the app and panel

This notice also applies to the hepp app, the business panel and booking pages. For these uses the following data is processed:

• Identity and contact: name, phone number for sign-in, optional email address, language preference.
• Appointment data: business, service, staff member, time, notes, status, cancellation and no-show records, waiting list entries; optionally family member, pet and address details.
• Review data: rating, review text and your shortened name shown publicly with the review (e.g. "Ayşe K.").
• Transaction and device data: the device notification token (push token), notification and Live Activity preferences, login code request records and salted digests used to limit abuse.
• For business accounts: business and staff details, subscription status, plan and invoice records (card details are processed only by Stripe).

Purposes and legal bases for the app and panel

We process this data for the following purposes and on the following legal bases:

• Providing the appointment service, matching appointments with businesses, sending reminders and status updates: establishing and performing the contract.
• Delivering the login code and securing accounts, preventing abuse and bots: legitimate interest and performance of the contract.
• Publishing reviews and enforcing review rules: performance of the contract and legitimate interest.
• Collecting business subscriptions and keeping invoice records: performance of the contract and legal obligation.
• Showing businesses near you if you grant location permission, and sending notifications if you grant notification permission: your explicit consent; you can withdraw these permissions in iOS settings at any time.

Retention of app data and account deletion

We keep your app and panel data while your account is open. You can delete your account in the app under Profile > Settings > Delete account, or on the web through the account deletion page; a new login code is required when deleting. Deletion removes your name, phone, email, address and pet details; appointment and review records remain without your name as "Deleted user". Subscription and invoice records may be kept for as long as the law requires. For the terms of use, see the terms of use.

4. Legal bases

We process your data on these bases:

• Pre-contractual step: to evaluate your pre-registration and contact you, at your request.
• Legitimate interest: bot protection and system security (Turnstile verification and the salted IP hash). This is limited to the minimum data needed and does not override your fundamental rights.
• Legitimate interest (for evidence): your consent records (time and the version of the text you accepted) are kept so that we can prove your consent when needed.
• Explicit consent: to notify you at launch (the required checkbox on the notify me form) and, if you tick it on the business form, to send you hepp campaigns and announcements (optional commercial communication consent). Not giving commercial consent does not affect your pre-registration.

5. Recipients and transfers abroad

To provide the service we use the following providers, who process your data on our behalf and under our instructions:

• Supabase: database. Data is stored in the European Union, in the Frankfurt region.
• Railway: website hosting.
• Email delivery (Supabase and the email delivery service Resend): the notification email sent to our team when a new business pre-registration arrives, and login code emails for the web business panel.
• Cloudflare: Turnstile bot protection (forms and sign-in), domain and DNS.
• Meta (WhatsApp): delivering login codes and appointment messages.
• MasGSM: delivering login codes by SMS to +905 mobile numbers when WhatsApp delivery fails.
• Apple (APNs): app notifications and Live Activity updates.
• Google (Maps, Places, Geocoding): maps and address search.
• Stripe: business subscription payments; card details are processed only by Stripe.
• Proton (Switzerland): email mailbox provider. It receives requests sent to [email protected] and the pre-registration notification emails.

About transfers abroad

Some of these providers are headquartered in the United States, and Proton is in Switzerland. Your data is transferred to our company in the United Arab Emirates and to these providers and processed abroad. By submitting the form you are informed of this transfer through this notice. We do not sell your data to anyone and do not share it for advertising.

6. Retention

We keep your data only as long as the purpose requires:

• Business pre-registration: at most 24 months; deleted once a business application made with the same verified phone number is approved or rejected. When a business application is approved and the founding business benefit is granted on the basis of that pre-registration, only the non-personal pre-registration details (such as category, staff count range, registration date and source) are kept and the pre-registration record is deleted.
• Rejected business application (including the applicant's name and phone number): deleted 6 months after the rejection date.
• Notify me record: 6 months after the launch notification. If you withdraw your consent, it is deleted without delay on your request and within 30 days at the latest.
• Rate-limit counters (salted hashes of IP, phone and email): about 24 hours.

Deletion

For now, deletion is carried out manually on request to [email protected]; automatic cleanup will be added later.

7. Your rights and how to apply

As a data subject you have the right to:

• Find out whether your data is being processed and request information if it is,
• Learn the purpose of the processing and whether it is used accordingly,
• Learn who your data is transferred to, in the country or abroad,
• Request correction of incomplete or inaccurate data,
• Request deletion or destruction of your data and that this be notified to third parties it was transferred to,
• Object to the processing and claim compensation if you suffer harm from unlawful processing,
• Object to a result that works against you where it arises solely from analysis by automated systems,
• Lodge a complaint with the supervisory authority (the KVKK Board for Turkey, the competent authority in Northern Cyprus) if you have trouble exercising these rights.

How to apply

Send your request by email to [email protected]. So that we can verify your identity, mention the phone number or email address you gave when registering. We respond within 30 days at the latest.

8. Withdrawing consent

You can withdraw your explicit consent (launch notification and commercial communication) at any time by writing to [email protected]. Once withdrawn, the related processing stops and your notify me record is deleted without delay on your request, within 30 days at the latest. Withdrawal does not affect the lawfulness of processing carried out before it.