KRAP Privacy Policy

Version: v1

KRAP is a platform where customers find nearby hairdressers and book appointments, and businesses manage their appointments, stylists, branches, services and campaigns. This policy explains what information we collect in the KRAP mobile app and on krapteknoloji.com, how we use it and how we protect it. The binding Turkish text is the KRAP Personal Data Protection Notice (KVKK Aydınlatma Metni). If the two differ, the Turkish text prevails.

Data controller: BURAK AÇIKGÖZ (sole proprietorship, "KRAP"), İlkbahar Mah. Doğukent Cad. No: 733 DH, Çankaya/Ankara, Türkiye, krapteknoloji@gmail.com

Information we collect

• Account information. We collect your full name and mobile number. The number is verified by an SMS code. You may also add an e-mail address, gender, province, district, neighbourhood and a profile photo. Your password is stored only as an irreversible hash, and nobody can see the password itself.
• Appointment and usage information. This covers:
• your appointments: salon, stylist, service, date, time and note,
• cancellations,
• the salons you follow,
• the ratings you give,
• the reports, feedback and suggestions you send.
• Business information (business and stylist accounts). This covers:
• business name, address and map location,
• services and prices,
• opening hours,
• photos,
• campaigns,
• stylist bio and certificates.

Most of this is published on the public business profile.

• Location. We use your device location only if you allow it, and only while the app is open, to show salons near you. We do not keep a location history. Location data inside uploaded photos is removed.
• Device and technical information. This covers:
• the device push token,
• app version and operating system,
• language preference,
• IP address,
• session and error logs.
• Advertising information. We use the advertising ID to show ads on customer screens. The ad module never runs in owner, manager or stylist accounts.

App permissions

The app asks for a permission only when you use the feature that needs it. If you decline, the rest of the app keeps working.

How we use information

We use information only to:

• create and protect your account,
• provide search, appointments, reminders and notifications,
• publish business profiles,
• answer support requests,
• prevent abuse and fix errors,
• show ads on customer screens,
• meet legal obligations.

We do not sell your information.

Notifications

Transactional notifications are part of the service. These include booking confirmations, cancellations and reminders. Campaign and announcement notifications are sent only with your permission, and you can turn them off at any time in Settings › Notification Preferences. Notification texts shorten your surname to its initial.

Ads

• Customer screens show Google AdMob ads. Sign-up and booking screens show no ads.
• By default, ads are not personalised.
• On iOS, the app asks for tracking permission. If you allow it, ads may be personalised to your interests. You can withdraw the permission in your device settings.

Who we share information with

• The salon you book with. We share your name, phone number, chosen services, appointment time and note with the salon and the stylist.
• Our service providers. We share only what each provider needs to run the service:
• server hosting (Türkiye),
• SMS delivery (Netgsm, Türkiye),
• e-mail delivery,
• push notification infrastructure (Expo, Google Firebase Cloud Messaging, Apple Push Notification Service),
• maps (Google Maps),
• ads (Google AdMob),
• error monitoring (Sentry, European Union).
• Authorities. We share information when the law requires it.

Where information is stored

Our database and uploaded files are stored on servers in Türkiye. The notification, map, advertising and error-monitoring providers listed above may process data abroad. These transfers follow the cross-border transfer rules of the Turkish Personal Data Protection Law (KVKK).

Retention

Security

Our measures:

• All connections are encrypted with TLS.
• Passwords are hashed with argon2id.
• Session keys are kept in your device's secure storage.
• Accounts are verified by SMS code.
• Access is limited by role.
• The admin panel requires two-factor authentication.
• Phone numbers and e-mail addresses are masked in logs.

No system is free of risk. In case of a breach, we meet our legal notification duties.

Deleting your account

• You can delete your account in the app under Settings › Delete Account.
• If you cannot open the app, send a request at krapteknoloji.com/hesap-silme. Requests are completed within 30 days at the latest.
• When an account is deleted, personal information is deleted or anonymised.
• Salons keep their appointment history and rating averages without your identity.

Your rights

To use your rights, write to krapteknoloji@gmail.com. Your rights include:

• accessing your personal data,
• asking for it to be corrected or deleted,
• objecting to its processing,
• the other rights under Article 11 of the KVKK.

Children

You must be at least 18 years old to create a KRAP account. We do not knowingly collect information from children under 18.

Changes

We may update this policy. We announce material changes in the app. The current version is always available in the app and on our website.

Contact

krapteknoloji@gmail.com · İlkbahar Mah. Doğukent Cad. No: 733 DH, Çankaya/Ankara, Türkiye