Privacy policy
Viimeksi päivitetty:
This notice explains how the Musteri app (Android, Wear OS, iPhone, Apple Watch and widgets), the web panel and the musteri.sayfa.app website handle personal data. It is the English version of our information notice under Article 10 of Turkey’s Personal Data Protection Law No. 6698 (KVKK).
In short
- If you use the app without an account, none of your records reach us. Everything stays on your phone.
- If you sign in, a copy of your records is kept on our server for sync and backup.
- No ads, no ad tracking, and we never sell your data. The app collects no usage analytics; page visits on the website and the web panel are counted with cookieless Yuva Analytics.
- Business card photos and voice notes are processed on your phone and never sent to the server.
Data controller
The data controller is Musteri (musteri.sayfa.app). For any question about this notice or your data: musteri@sayfa.app.
What we process
Without an account
Customers, addresses, contact persons, fairs, encounters, notes and follow-ups are stored only on your device. We cannot see or receive them.
When you sign in
- Account data: your e-mail address; if you sign in with Google or Apple, the user identifier and name they send us; the public key of your passkey. Your fingerprint or face data never leaves your phone; we only store the public key.
- Session data: a random identifier the app creates for your device, hashes of the session and refresh tokens, and when they were last used; in the web panel, a device name derived from your browser details (user agent), for example “Chrome on macOS”.
- Your content: customers (company name, legal name, tax office and number, sector, phone, e-mail, website, tags, notes), addresses and their locations, contact persons (name, title, department, phones, e-mails, notes), fairs and events, encounters and interest levels, activity records such as calls and visits, follow-ups and reminder times, and the transcribed text of voice notes.
- Technical records: the IP address and time of requests to our server, app version and error logs.
When you use the web panel
You sign in to the web panel with your passkey; your fingerprint or face data still never leaves your device. To keep you signed in, the panel uses only two necessary cookies: a session cookie that holds your session tokens encrypted (scripts in the browser cannot read it; at most 60 days or until you sign out) and a cookie that protects against cross-site request forgery (CSRF). Your language and theme choice and changes not yet sent to the server are kept in your browser’s local storage. The panel’s requests reach our server through musteri.sayfa.app, which also passes on your IP address for rate limits and technical records. Your web session appears in the session list in Settings and can be signed out from there.
When you pay for Musteri Pro
- Paying on the web: Polar Software Inc. takes the payment as merchant of record. Your name, e-mail address, billing address and card details are entered directly on Polar’s checkout page and processed by Polar and its payment provider Stripe under Polar’s privacy policy. Your card details never reach us. When we open the checkout, we send Polar your account ID (as the external customer ID in Polar), your account’s e-mail address so it is filled in on the checkout page, the plan you chose (monthly or yearly), the currency and your IP address. We pick the currency from the country Cloudflare derives from your IP address: Turkish lira in Türkiye, US dollars elsewhere; we do not store the country. Polar tells us the subscription’s status, plan, period dates, whether it ends at the end of the period, and the subscription and customer IDs.
- Paying in the app: the seller of the subscription is the Apple App Store or Google Play. They take the payment and process it under their own privacy policies; your card and payment details never reach us or RevenueCat. Store subscriptions are verified through RevenueCat, Inc. For this, the purchase history (which product you have, when it started, renews and ends, whether it was cancelled or refunded, and the transaction identifiers from the store) and an app user ID are processed: your account ID if you are signed in, otherwise a random ID created by RevenueCat. It links the subscription to your account.
- Device ID: the random device identifier the app creates, used to count on how many devices Pro is active.
- What we keep: your plan (monthly or yearly), the subscription’s status, its source (web, App Store or Google Play), period dates and whether it ends at the end of the period; for web subscriptions the Polar subscription and customer IDs, for store subscriptions the store’s transaction identifiers.
When you visit the website
Page visits on the musteri.sayfa.app website and the web panel are counted with Yuva Analytics (useyuva.com), the open-source analytics service we develop and run ourselves. It sets no cookie and stores nothing on your device. Your IP address is shortened before anything else uses it and is never stored; your approximate location (country, region and city) is worked out from the shortened address. What is kept for each page view is the page address, the address of the page that linked to it, any utm_* campaign parameters, the browser, operating system and device type, the screen size class, the language, the time spent on the page and how far it was scrolled. To count visitors, a hash of the shortened address and your browser is computed under a random key that is deleted within hours of the end of the day, so a visitor is counted once a day but cannot be recognised the next day or on another website. Individual page views are kept for 90 days and daily totals for 25 months. We use this only to understand and improve the website and the panel; it is not used for advertising, not combined with other data and not shared. The legal basis is our legitimate interest in understanding and improving the website (KVKK Art. 5(2)(f)). Browsers that send Do Not Track or Global Privacy Control are not counted at all.
The website sets no cookies; only the web panel uses cookies, to keep you signed in as described above. Cloudflare, which serves the site, processes your IP address and browser details to deliver the page and block attacks.
When you use the live support chat
The chat button on the website and in the web panel opens the live chat of Yuva (useyuva.com), the open-source support service we develop and run ourselves. Your messages, the files you attach, your e-mail address if you choose to give it, the address and title of the page where you started the chat and any rating you give the chat are kept in Yuva so that we can answer you, and the Musteri team sees them. The chat is not linked to your Musteri account. To let the chat continue, your browser’s local storage keeps a random chat ID; it is deleted when you sign out of the web panel.
When you send feedback
When you send feedback from the web panel, we store the category you chose (bug, complaint, suggestion, question or other), your message, up to 3 screenshots you attach, whether the team may contact you, and the context the form adds by itself: platform, panel version, your browser and operating system, language and the screen you opened it from. The feedback is linked to your account. Only you and the Musteri team see it; the team sees it together with your name, e-mail address and plan, and you see the team’s reply in the panel. If you allowed contact, we may also write to you by e-mail. If your screenshots show details of your customers or other people, we recommend hiding them before you send. Screenshots that are attached but never sent are deleted within 24 hours.
When you e-mail us
Your e-mail address, name and message, used only to reply.
What we do not collect
We do not track your location. Your address book is accessed only when you pick a contact or save one to it. Business card photos and audio recordings are not stored and not sent to the server.
Why, and on which legal basis
| Purpose | KVKK Art. 5(2) |
|---|---|
| Creating your account, verifying sign-in, syncing and backing up your records | (c) performance of a contract |
| Security, preventing abuse, finding errors | (f) legitimate interest |
| Lawful requests from public authorities | (ç) legal obligation |
| Answering support (e-mail and live chat) and deletion requests | (c) performance of a contract |
| Selling Musteri Pro on the web through Polar, verifying the subscription and unlocking Pro features | (c) performance of a contract |
| Reading and answering your feedback and improving Musteri | (f) legitimate interest |
| Counting website and web panel visits without cookies, understanding and improving the website | (f) legitimate interest |
We do not use your data for marketing, profiling or advertising, and we do not sell it.
Records about other people
The customers and contact persons you add are other people’s data. When you save them for your own business, you are the data controller for those people; Musteri only stores and syncs those records on your behalf. Informing the people whose cards you collect, and respecting their consent before you send them commercial messages, is your responsibility.
Where it is stored and who receives it
- Your device: the main copy of all your records.
- Our server: if you sign in, for sync and backup, including feedback and screenshots; in Hetzner Online GmbH’s data centre in Finland, inside the European Union.
- Cloudflare, Inc.: hosting and serving the website and the web panel, passing the panel’s requests on to our server, protecting traffic to our server and forwarding e-mail. We use no visitor analytics through Cloudflare.
- Yuva (useyuva.com): the open-source support and analytics service we develop and run on our own server; it holds live chat messages and the cookieless page visit counts.
- RevenueCat, Inc. (USA): the app user ID and purchase history, to keep the status of your Musteri Pro subscription. RevenueCat notifies our server when the subscription changes.
- Polar Software Inc. (USA): sells subscriptions bought on the web as merchant of record, takes the payment through Stripe, calculates the tax and sends the receipt and invoice. It receives your account ID, e-mail address, the plan you chose, the currency and your IP address. For the buyer’s payment details, Polar is the data controller under its own privacy policy.
- Apple (App Store) and Google (Google Play): purchase and payment details, as the seller of Musteri Pro that takes the payment; they process them under their own privacy policies.
- Google and Apple: only for sign-in if you choose them; and the text of an address when your phone’s operating system looks up its location.
Because our server and service providers are outside Turkey (RevenueCat and Polar in the USA), this is a transfer abroad under KVKK Article 9, based on standard contracts with the providers. They process data only on our behalf and for the purposes in this notice; the payment details that Apple, Google and Polar receive as sellers are subject to their own privacy policies.
How long we keep it
| Data | Retention |
|---|---|
| Records on your device | Until you delete them or uninstall the app |
| Account and synced records | While your account exists; deleted as soon as you delete the account |
| Copies in server backups | At most 30 days after the account is deleted |
| Technical records (IP, requests, errors) | At most 30 days |
| Support e-mails | At most 1 year after the request is closed |
| Live support chats | At most 1 year after the request is closed |
| Page views (Yuva Analytics) | Individual page views 90 days, daily totals 25 months |
| Subscription records on our server (plan, status, source, period dates, subscription and customer IDs) | While your account exists; deleted as soon as you delete the account |
| Feedback and screenshots | While your account exists; deleted as soon as you delete the account |
| Screenshots never sent | At most 24 hours |
| Web panel session cookie | At most 60 days or until you sign out |
| Purchase records at Polar, RevenueCat, the App Store and Google Play | For as long as those companies must keep them by law |
The account deletion page explains how to delete your account.
Your rights
Under KVKK Article 11 you can ask us to:
- tell you whether we process your personal data and, if so, give you information about it,
- tell you the purpose of processing and whether the data is used accordingly,
- tell you the third parties in Turkey or abroad that receive it,
- correct it if it is incomplete or wrong,
- delete or destroy it under the conditions of KVKK Article 7,
- notify third parties that received the data of any correction or deletion,
- object to a result against you that comes solely from automated analysis,
- compensate damage you suffered from unlawful processing.
Send your request from your account’s e-mail address to musteri@sayfa.app. We answer free of charge within 30 days. If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurulu). If you are in the European Economic Area, you also have the rights of the GDPR, including a complaint to your local supervisory authority.
Children
Musteri is a business app and is not directed at people under 18.
Changes
When we change this notice we update the date on this page. We also announce important changes in the app.