Privacy and KVKK Notice

1. Controller

1.1. Controller: Taha Erel. Contact: support@reseryo.com.

1.2. Users in the European Union can also send requests under the GDPR to support@reseryo.com.

1.3. This document is both our privacy notice under Article 10 of Turkish Law No. 6698 (KVKK) and our information under Articles 13–14 of the GDPR.

2. Roles

2.1. Reseryo is the controller for: Platform accounts, sign-in and security, transmitting booking requests, reminders, publishing reviews, no-show disputes and cross-business restrictions, support, the contact form, the waitlist and its legal obligations.

2.2. For a business's own customer records, bookings it enters in its panel, the questions on its own booking form, notes, and staff and finance records, the business is the controller and Reseryo is its processor. You can send requests about that data to the business concerned. We also pass on to the business any such requests we receive.

3. Data we process

• Visitors: IP address, browser and device information, request logs, language and country preferences, aggregated usage and performance measurements.
• Customer accounts: first name, surname, e-mail, phone number, password (stored only as a hash), e-mail verification record, language, favourites, notification preferences.
• Google sign-in: the name and e-mail address on your Google account, and no other Google data.
• Sign in with Apple: name and e-mail address, which may be an Apple private relay address.
• Bookings: business, service, staff member, resource/table/room, date and time, party size, names of additional guests, notes and your answers to the business's form, status history, cancellation type, rescheduling history, verification code records.
• No-shows and restrictions: no-show records, dispute statements, decisions and restrictions; an irreversible identifier (SHA-256) derived from your account ID or phone number.
• Reviews: rating, comment, date, and a display name made up of your first name and surname initial.
• Mobile app: push token, device platform, language, app version.
• Location: used only if you allow it, and only on your device, at low accuracy, to pre-select your country and city. To turn the coordinates into a place name they are sent to your operating system provider's geocoding service (Apple or Google). They are never sent to or stored on Reseryo's servers.
• Business users and teams: name, e-mail, phone number, role, invitation records, two-step verification factor and hashed recovery codes, audit records; business details and images; staff names and titles.
• Contact form and waitlist: name, business name, e-mail, phone number, country, message content.
• Health notes: only where an eligible healthcare business has enabled the field, and under that business's responsibility.
• Technical and security: error records, rate-limit counters and abuse records.
• Payments: Reseryo does not process customers' card or bank data. When business plans become paid, payment data will be processed by the payment provider, and this notice will be updated beforehand.

4. Purposes and legal bases

For each purpose, the corresponding KVKK Art. 5(2) and GDPR Art. 6(1) basis:

• Creating accounts, signing in and keeping you signed in; creating booking requests, sending them to the business and showing their status; cancelling and rescheduling; transactional notifications: performance of a contract. KVKK 5(2)(c); GDPR 6(1)(b).
• Reminder e-mails and push notifications: performance of a contract and legitimate interests. KVKK 5(2)(c) and (f); GDPR 6(1)(b) and (f). You can switch them off at any time.
• Publishing reviews and showing them to the business: performance of a contract and our legitimate interest in informing other users. KVKK 5(2)(c) and (f); GDPR 6(1)(b) and (f).
• Overlap and daily-limit checks, verification codes, preventing fraud and abuse, no-show records, handling disputes and restrictions: our legitimate interest in protecting businesses' capacity and the reliability of the Platform, and establishing, exercising and defending legal claims. KVKK 5(2)(e) and (f); GDPR 6(1)(f).
• Security, error monitoring, performance measurement and product improvement: legitimate interests. KVKK 5(2)(f); GDPR 6(1)(f).
• Support, complaints and the contact form: legitimate interests and, where relevant, performance of a contract.
• Waitlist: sending the launch announcement you asked for. KVKK 5(2)(c) and (f).
• Legal obligations and requests from public authorities: KVKK 5(2)(a) and (ç); GDPR 6(1)(c).
• Legal disputes: KVKK 5(2)(e); GDPR 6(1)(f).
• Health notes: under the business's responsibility, in line with KVKK Article 6; explicit consent where required, GDPR 9(2)(a) or 9(2)(h).
• Marketing messages: none are sent at present. If any are, only with your separate consent.
• Objecting to processing based on legitimate interests: you can object under GDPR Article 21.
• Providing your data: the data requested for accounts and bookings is required for the contract; without it we cannot provide the service.

5. How we collect data

We collect data, by automated or partly automated means, through website and mobile app forms, Google and Apple sign-in, e-mail verification, the business panel (including bookings a business enters for you), support communications, cookies and similar technologies, and system logs.

6. Automated decisions

6.1. No-show restrictions (Terms of Use, Section 7) are calculated automatically from the records businesses create:

• 3 valid records at the same business in the last 180 days restrict new requests to that business.
• 3 valid records in total across at least two businesses in the last 180 days restrict new requests across the Platform for 30 days.

6.2. Disputed records are excluded until a decision is made. Disputes are reviewed by a person.

6.3. Under KVKK Art. 11(1)(g) and GDPR Art. 22, you may object to an automated assessment that has an adverse result for you, ask for human intervention and give your point of view.

6.4. No other automated decisions involving profiling are made.

7. Recipients

7.1. The business you book with and its authorised team: to carry out the booking.

7.2. The public: your reviews (rating, comment and your name shown as "First name S.").

7.3. Our service providers (processors):

• Supabase Inc.: database, authentication, file storage. Location: EU, Germany (Frankfurt). Company based in the US.
• Railway Corporation: API servers. Location: EU, the Netherlands. Company based in the US.
• Vercel Inc.: web hosting, content delivery, Web Analytics and Speed Insights. Server-side processing runs in the EU (Frankfurt); static content may be served from the edge location nearest to you. Company based in the US.
• Functional Software Inc. (Sentry): error and performance monitoring. Location: EU data region (Germany). Configured not to send IP addresses or request bodies.
• Hostinger: delivery of transactional and authentication e-mails.
• 650 Industries Inc. (Expo): push notification delivery and mobile app updates. Location: US.
• Apple: Apple Push Notification service (APNs), Sign in with Apple and e-mail relay. Location: US and Ireland.
• Google: Google sign-in and Firebase Cloud Messaging. Location: US and Ireland.
• UptimeRobot: monitors only the availability of our public addresses; it has no access to your personal data.
• Fonts are hosted on our own servers. No request is made to Google Fonts when you visit.

7.4. Competent public authorities and courts: where the law requires.

7.5. Professional advisers (legal, accounting, audit): under confidentiality obligations.

7.6. An acquirer in a transfer or merger: with prior notice.

7.7. We do not sell your data or share it for advertising.

8. International transfers

8.1. Because of the providers in Section 7, your data is processed outside Türkiye, mainly in the EU and partly in the US.

8.2. For information on the safeguards applied to these transfers (such as the providers' Standard Contractual Clauses and their commitments under the EU-US Data Privacy Framework), write to support@reseryo.com.

8.3. Google or Apple sign-in and push notifications are used at your request. You do not have to use them: you can sign in with e-mail and password and turn notifications off.

8.4. You can ask support@reseryo.com for a copy of the safeguards.

9. Retention

• Account: until you delete it. On deletion, your identity and contact details are deleted or anonymised.
• Booking records: kept for the business while its account is open. If you delete your account, your identity is removed immediately. If the business closes, personal data is anonymised 30 days after closure.
• No-show, dispute and restriction records: restrictions are calculated on a 180-day window. Records are kept as evidence for at most 2 years.
• Reviews: until you delete them, until you delete your account (the display name is then anonymised), or until the business closes.
• Push tokens: until you sign out, delete your account, or the token becomes invalid.
• Slot holds: deleted 1 hour after they expire. Rate-limit counters: 1 day. Business owner verification codes: 7 days after they expire.
• Contact and support correspondence: at most 2 years after the request is closed.
• Waitlist: at most 1 year from sign-up, or until you ask us to delete it.
• Technical and security logs (notification and operation logs, audit logs): at most 1 year. E-mail verification sessions: 30 days. Push tokens unused for 180 days are deleted.
• Error records: for Sentry's retention period, at most 90 days.
• Payment and invoice records (in future): 10 years.
• Data whose retention period has ended is periodically deleted, destroyed or anonymised.

10. Account deletion and copies of your data

10.1. You can delete your account yourself from the account page on the web or in the mobile app. If you have upcoming active bookings or access to a business panel, you will be asked to resolve those first.

10.2. To get a copy of your data, or a portable copy, write to support@reseryo.com. We answer free of charge within 30 days of verifying your identity.

11. Your rights

11.1. Under KVKK Article 11 you have the right to:

• (a) find out whether your data is processed;
• (b) request information about the processing;
• (c) find out the purpose of the processing and whether the data is used for that purpose;
• (ç) know the third parties in Türkiye or abroad to whom your data is transferred;
• (d) have incomplete or inaccurate data corrected;
• (e) have your data erased or destroyed under the conditions of KVKK Article 7;
• (f) have the third parties to whom your data was transferred notified of any correction, erasure or destruction under (d) and (e);
• (g) object to an outcome against you that results solely from automated analysis;
• (ğ) claim compensation for damage caused by unlawful processing.

11.2. Users in the EU additionally have the rights of access, rectification, erasure, restriction of processing, data portability and objection, the right to withdraw consent, and the right to complain to the supervisory authority in their country.

12. How to make a request

12.1. You can make a request by any of the following:

• e-mail to support@reseryo.com from the address registered with us;
• by sending an application signed with a secure electronic signature or mobile signature to support@reseryo.com.

12.2. Please include your name, surname, Turkish ID number (or, for foreign nationals, nationality and passport number), address, e-mail and your request. We ask only for what we need to verify your identity.

12.3. We respond free of charge within 30 days at the latest. If a request involves an additional cost, the Board's fee schedule may apply.

12.4. If your request is refused, you find our answer inadequate, or we do not answer in time, you may complain to the Turkish Personal Data Protection Board within 30 days of learning of our answer and in any case within 60 days of your request.

13. Children

You must be at least 13 to create an account. Under-18s use the Platform with the knowledge and permission of a parent or guardian. If you believe a child's data was shared without authority, write to support@reseryo.com; we will review it and delete it where appropriate.

14. Health data

14.1. Health notes are not requested for ordinary bookings. Only an eligible healthcare business may enable the field, and only where it is needed for the service. That business is then the controller and explains the purpose, legal basis, access and retention period separately.

14.2. Where explicit consent is required, a health note is not recorded without a separate, unticked consent. For under-18s, the business runs the parent or guardian process.

15. Security

We apply technical and organisational measures appropriate to the risk: encryption in transit, role and tenant separation, row-level authorisation, audit logging, backups, hashing of passwords and codes, and mandatory two-step verification for platform administrators. If a breach occurs, we notify the Board and, where required, you, within the statutory deadlines.

16. Marketing

Reseryo does not send marketing messages at present. If it does in future, it will do so only with your separate consent and İYS registration, and you can opt out at any time.

17. Changes

This notice is updated when we add features or providers or the law changes. Material changes are announced by e-mail or Platform notice. You can request earlier versions from support@reseryo.com.