Privacy Policy & GDPR Compliance Notice
Principles on Personal Data Protection, GDPR Compliance & Cloud Security
§1. Data Controller & Contact Information
Data Controller: Batuhan Mutlu (Buluyo Sole Proprietorship), Yeni Mah. Ahmet Cavus Cad. Taarruz F Blok No: 44 F Ic Kapi No: 1 Kemer / Antalya, Turkey. Tax ID: 6250754182. Contact: kvkk@buluyo.app | Phone: +90 850 840 96 39 | KEP: batuhan.mutlu@hs01.kep.tr.
§2. Categories of Data Processed
Identity & Contact Details: Full name, phone number, email address.
Reservation Information: Booked salons, specialists, service types, and appointment date/time.
Technical Device Data: IP address, operating system, device identifiers, and system logs.
Location Data: Optional, coarse/precise location used exclusively to display nearby service providers on the interactive map.
§3. Financial Security & Payment Processing (Polar.sh Merchant of Record)
All subscription billing, payment collection, and invoicing are handled by Polar Software, Inc. (polar.sh) as our Merchant of Record.
Credit and debit card transactions are processed directly via Polar's Stripe-powered PCI-DSS Level 1 certified infrastructure with 256-bit TLS encryption and 3D Secure 2.0.
Card numbers, expiration dates, and security codes (CVV) are never viewed, stored, or processed on Buluyo servers.
§4. Cloud Infrastructure and International Safeguards
Our primary databases and backend applications are hosted within the high-security European Union data centers of Hetzner Online GmbH (Germany/EU).
Payment processing, subscription billing, customer portal management, and global tax compliance are executed through Polar Software, Inc. (polar.sh - USA / Global) under EU Standard Contractual Clauses (SCCs).
Network security and edge caching are supported by Cloudflare Inc. (USA), transactional email notifications by Mailgun Technologies Inc., and mobile push delivery by Google LLC (Firebase).
International transfers adhere strictly to GDPR Chapter V mechanisms and Turkish Data Protection Law No. 6698 Standard Clauses.
§5. Zero Third-Party Sale Guarantee
We do not sell, rent, or trade your personal data to third-party advertisers or data brokers under any circumstances.
Only essential booking details (name and phone number) are transmitted to the reserved business solely for appointment execution.
§6. In-App Account Deletion (Apple & Google Compliant)
Users can permanently delete their account and associated personal data directly within the mobile application via Settings -> Account -> Delete Account.
For accounts created via Sign in with Apple, authorization tokens are automatically revoked upon account deletion.
Terminated business accounts undergo a 30-day suspension and a 90-day archive purge before complete data elimination.
§7. Your Rights under GDPR (EEA/UK Residents)
EEA/UK residents are entitled to rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21), and lodging a complaint with their local supervisory authority.
To exercise these rights, contact us at kvkk@buluyo.app. Requests are resolved within 30 days.
Electronic Storage & Record Keeping
This agreement enters into full force upon electronic confirmation and is securely stored in Batuhan Mutlu (Buluyo) digital systems. Users can access this document on the platform at any time or request an electronic copy by emailing destek@buluyo.app.
Payment, Invoicing & Card Security Commitment (PCI-DSS Level 1 & Polar.sh MoR)
All subscription payments and billing transactions on the Buluyo platform are securely processed by our international Merchant of Record, Polar Software, Inc. (polar.sh), powered by Stripe infrastructure with 256-bit SSL encryption and 3D Secure 2.0. Credit and debit card credentials are never stored or handled on Buluyo servers; invoicing and global tax (VAT/sales tax) compliance are fully managed by Polar.
Data Controller & Service Provider Identity
© 2026 Buluyo. All rights reserved.