Privacy policy

1. In short

hepp.app is operated by V3CODERS SOFTWARE SOLUTIONS - FZCO (Dubai, United Arab Emirates). On this site we process only the form details you share with us and the minimum technical data needed to protect the system. We do not use analytics or tracking cookies.

2. What we collect

The details you give in the business pre-registration and notify me forms:

• Business pre-registration: business name, category, region, contact person's name, phone, optional email, staff count range and note.
• Notify me form: phone and/or email, region and the categories you are interested in. A vote you give with "I want this category" on a coming soon card is also a notify me sign-up; the category you vote for is added to your sign-up as a category you are interested in.
• Your consents and the version of the text you accepted.
• Only salted hashes (pseudonymised data) of your IP address, phone number and email address, for about 24 hours, to limit abuse.

Optional gender in the app

In the hepp app, giving a gender (woman or man) for your account and for the family members you save is optional. You can leave it blank, and leaving it blank does not affect the service.

We use it only to put businesses that suit you first in categories that serve by gender (for example barbers, hairdressers, beauty centers) and to warn you about a business that may not fit. This matching happens on your device; your gender is not added to search requests.

Your gender is not shared with businesses, and business accounts cannot see it. The same applies to what you enter for your family members.

You can change it or clear it in the app at any time, or ask for its deletion by writing to [email protected].

Data processed when you use the app and panel

When you use the hepp app, the business panel or booking pages, the following is processed in addition to the form data above:

• Account: your phone number for sign-in, your name, an optional email address and your language preference.
• Appointments: the business, service, staff member and time you choose, your notes, the appointment status, cancellation and no-show records, and your waiting list ("notify me when a slot opens") entries. The business you book with sees your name, phone number and the details you give for the appointment.
• Family members, pets and address: if you add them to your account, they are shared with the business only as far as needed for the relevant appointment.
• Reviews: the rating and review text you leave are visible to everyone on the business page together with your shortened name (e.g. "Ayşe K.").
• Business and staff accounts: business and staff details (name, photo, services, prices, opening hours) are visible to customers.
• Your device's notification token (push token) and your notification and Live Activity preferences.

Login code and notifications

The login code is sent to your phone number by WhatsApp (Meta). If WhatsApp delivery fails it may be sent by SMS to +905 mobile numbers (MasGSM). On the web business panel, accounts with a verified email address can also receive the login code by email as a fallback (through Supabase and the email delivery service Resend); the hepp app has no email code. These providers process your phone number or email address to deliver the code.

Appointment reminders and status updates are sent as app notifications (Apple Push Notification service) or by WhatsApp. The Live Activity shown on the lock screen and in the Dynamic Island, and the home screen widget, show your appointment details on your device; you can turn Live Activities off under Profile > Settings, in which case your device's activity tokens are deleted. You can also withdraw notification permission in iOS settings.

Maps and location

We use Google Maps services (Maps, Places, Geocoding) to show business addresses on a map and to search addresses; map and address search requests are sent to Google. If you grant location permission, it is used to show businesses near you; you can withdraw the permission in iOS settings at any time.

Business subscriptions and payment

Business subscriptions are bought on the web panel through Stripe. Card details are processed only by Stripe and do not reach us; we keep the subscription status, plan and invoice records. Customers do not pay through hepp, and the iOS app has no purchases.

Deleting your account

You can delete your account in the app under Profile > Settings > Delete account, or on the web through the account deletion page; a new login code is required when deleting. Your name, phone number, email address, address and pet details are deleted. Appointment and review records remain as "Deleted user", without your name, so that businesses' statistics are not distorted. Subscription and invoice records may be kept for as long as the law requires.

3. Why we use it

To evaluate your pre-registration and contact you, to tell you when the app launches, and to protect the site from bots and abuse. If you agreed, we also send hepp campaigns and announcements. The detailed legal bases are in the Privacy Notice.

We show the votes for coming soon categories on the site only in aggregate (each category's percentage of all votes); who voted is never shown.

4. Cookies and analytics

The site uses no analytics, advertising or tracking cookies; it uses only three functional cookies. NEXT_LOCALE remembers your language choice. hb_voted remembers that you have cast a category vote (everyone gets one vote); it holds no personal data and is kept for 1 year. hb_cookie_notice remembers that the cookie notice was dismissed and is kept for 1 year. These cookies are strictly necessary and functional, do not identify you and are not used for anything else. There are no analytics or tracking cookies. If we add analytics later, we will update this text first.

5. Cloudflare Turnstile

We use Cloudflare Turnstile to protect our forms and sign-in from bots and abuse. Turnstile runs on the pre-registration and notify me forms, on login code, password sign-in and password reset requests in the business panel, on account deletion code requests on the web, and when you request a login code in the hepp app. At sign-in it is usually invisible; if Cloudflare is suspicious, a short verification box appears. Turnstile shares some technical signals from your browser or the app's web view (for example browser and device characteristics and your IP address) with Cloudflare and produces a verification result. For verification our server or our sign-in infrastructure (Supabase) also passes your IP address to Cloudflare. This data is processed only for the security of the system and to prevent abuse; it is not used for advertising or tracking. Cloudflare's own privacy policy also applies.

6. Who we share it with

To provide the service we use these providers:

• Supabase: database (European Union, Frankfurt).
• Railway: website hosting.
• Email delivery (Supabase and the email delivery service Resend): notification emails and login code emails for the web business panel.
• Cloudflare: Turnstile bot protection (forms and sign-in), domain and DNS.
• Meta (WhatsApp): delivering login codes and appointment messages.
• MasGSM: delivering login codes by SMS to +905 mobile numbers when WhatsApp delivery fails.
• Apple (APNs): app notifications and Live Activity updates.
• Google (Maps, Places, Geocoding): maps and address search.
• Stripe: business subscription payments; card details are processed only by Stripe.
• Proton: email mailbox provider (Switzerland); it receives requests to [email protected] and pre-registration notifications.

Transfers abroad

The data controller is in the United Arab Emirates; the database is in the European Union (Frankfurt); some of the providers are headquartered in the United States (Proton is in Switzerland). Your data is therefore processed abroad. We do not sell your data to anyone and do not share it for advertising.

7. How long we keep it

Business pre-registrations are kept for at most 24 months. If a business application is made with the same verified phone number, the pre-registration is matched to the application and used to pre-fill the application form; once that application is approved or rejected, the pre-registration is deleted; when a business application is approved and the founding business benefit is granted on the basis of that pre-registration, only the non-personal pre-registration details (such as category, staff count range, registration date and source) are kept and the pre-registration record is deleted. Rejected business applications, including the applicant's name and phone number, are deleted 6 months after the rejection date. Notify me records are kept for 6 months after the launch notification (deleted without delay on your request, within 30 days at the latest, if consent is withdrawn). Records to which no launch notification could be sent are deleted after 24 months at the latest. Rate-limit counters (salted hashes of IP, phone and email) are kept for about 24 hours. When a customer deletes their app account while an order is still with a business, the copy of their name and phone kept for that order is deleted when the order closes, within 90 days at the latest.

8. Your rights

You have the right to access, correct and delete your data, to object to processing and to withdraw your consent. Details and how to apply are in the Privacy Notice. Send requests to [email protected]; we respond within 30 days.

9. Children

hepp is not directed at people under 18 and we do not knowingly collect personal data from them. If you notice that a child has given us data, write to [email protected] and we will delete it.

10. Changes and version

We may update this text from time to time. The current version number and date are at the top of the page. When you give consent in a form, the version of the text you accepted is stored with your record.

11. Contact

V3CODERS SOFTWARE SOLUTIONS - FZCO, IFZA Properties, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates. For privacy and personal data requests: [email protected] For support: support page ([email protected]). Terms of use: terms of use.