Privacy Policy

Müşterify ("we") operates both this website and the cloud-based customer management platform we provide to businesses. This policy explains two separate relationships: people who visit the site or contact us, and businesses that use the platform together with their own customers.

Anyone who accesses the site, uses the site and/or starts using our products and services is deemed to have read this policy. Use of the platform is also subject to the Terms of Use.

Two distinct roles: controller and processor

This distinction matters because it determines who you exercise your rights against.

• Where we are the controller: data of site visitors, people who submit the contact form, and users who hold a platform account. We decide for what purpose this data is processed.
• Where we are the processor: the business's own customer, patient or client records that a business using the platform enters into the system. The controller of this data is the business concerned; we process it only on that business's instructions and only to provide the service. We do not use it for our own purposes, we do not sell it, and we do not make it available to other customers.

If you are a patient or client recorded in the platform, you should first direct your request about your data to the business you receive services from; we act on that business's instructions.

What data we process

• Contact form: your name and surname, email address, phone number and message.
• Platform account: name and surname, email address, an irreversible hash of your password, workspace and permission details, and session records.
• Usage and technical data: IP address, browser information, error logs and transaction audit records. Kept for security and service continuity.
• Advertising measurement data: the address of the page you viewed on our marketing pages and a cookie identifier that distinguishes your browser. Used only to measure the performance of our own advertising; your name, email or phone number are not part of this measurement.
• Content entered by the business: customer, patient or client records, appointments, notes and messages. The "processor" rules above apply to this content.

Special category data (for example, health data) exists in the system only to the extent it is entered by the business using the platform, and is processed solely to provide the service.

Our legal bases for processing

• Establishment and performance of a contract: opening your account, providing the service, billing.
• Legitimate interests: system security, prevention of abuse, improving service quality, and measuring the performance of our own advertising (the Meta pixel). You can object to this measurement at any time and block it in your browser; how to do so is explained on the Cookie Policy page.
• Explicit consent: analytics cookies and marketing messages. You can withdraw your consent at any time.
• Legal obligation: retention and notification obligations prescribed by legislation.

These bases correspond to Articles 5 and 6 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and Article 6 of the European Union General Data Protection Regulation (GDPR).

Where your data is stored

Our database is hosted within the European Union, in the Frankfurt region of Germany. The web application is served through a global delivery network; this network distributes page content and does not carry database records.

Where data is transferred outside Türkiye, the transfer is made only to countries offering adequate protection or under appropriate safeguards such as standard contractual clauses.

Who we share it with

We do not sell your data. The only thing we share for advertising purposes is the advertising measurement signal on our marketing pages (the Meta pixel, below); apart from that, none of your data is shared for advertising purposes. No content you enter into the platform is used for advertising under any circumstances. Otherwise, we work only with the service providers needed to deliver the service, and only to the extent needed:

• Database and file infrastructure: a cloud database provider hosted in the European Union region.
• Application hosting and delivery network: a cloud application platform.
• Email delivery: an email infrastructure provider for notification and correspondence emails.
• Availability monitoring: a monitoring service that checks whether the site is up. It processes no personal data.
• Measurement and tag management: Google Analytics 4 and Google Tag Manager (Google Ireland Limited / Google LLC). They run only on marketing pages and according to your cookie preference; they are not loaded at all once you sign in to the platform.
• Advertising measurement: the Meta pixel (Meta Platforms Ireland Limited). It runs only on marketing pages and is never loaded once you sign in to the platform; it runs independently of the choice made in the cookie banner, because it rests on legitimate interests. The only information sent to Meta is which page was viewed and the cookie identifier that distinguishes the browser. How to block it is explained on the Cookie Policy page.

For businesses that enable the WhatsApp or phone assistant modules, the relevant messaging and telephony providers are also involved; these modules are activated only at the business's request, and the providers used are notified in writing during setup.

In addition, where there is a legal obligation or a request from a competent authority, data may be disclosed to the extent required by legislation.

How long we keep it

• Contact form records: up to 2 years from the resolution of the request.
• Platform account and business content: for as long as the account is active. After the account is closed, data is deleted or anonymised within 30 days; this period exists so that you can request your data back.
• Security and audit logs: up to 12 months.
• Records for which legislation prescribes a longer retention period are kept for the prescribed period.

How we protect your data

• All connections are encrypted with TLS.
• Passwords are stored as irreversible hashes; plaintext passwords are not kept and we cannot see them either.
• Each business sees only its own data; isolation is enforced at the database level with row-level access rules.
• Critical actions are written to an audit log recording who did what and when.
• Session, rate limiting and failed-login lockout protections are applied on administrative endpoints.
• Data is held on redundant cloud infrastructure.

No system can promise absolute security. If we identify a security breach affecting your personal data, we will notify the competent authority and you within the period and in the manner prescribed by the applicable legislation.

Your rights

Under Article 11 of KVKK and Articles 15 to 22 of the GDPR, you have the following rights:

• To learn whether your data is processed and to access it
• To request correction of inaccurate or incomplete data
• To request its erasure or destruction
• To request restriction of processing
• To receive your data in a structured format and port it to another controller
• To object to processing and to withdraw the consent you have given
• To object to an outcome adverse to you arising from analysis by automated systems
• To request compensation if you suffer damage
• To lodge a complaint with the competent supervisory authority

You can send your requests to info@musterify.com. We will conclude your application within 30 days at the latest. We may ask for additional information to verify your identity.

In Türkiye the competent authority is the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu). If you reside in the European Union, you may also apply to the data protection authority of your own country.

Automated decision-making and profiling

We do not take any decision concerning you that is based solely on automated systems and that produces legal effects or similarly affects you. We assess measurement data in aggregate and anonymously; we build no individual-level profiles in our own systems.

To be honest, this does not apply to the third party receiving the signal: the visit signal sent by the Meta pixel running on our marketing pages may be used by Meta, under its own rules, for ad delivery and audience building. This use is governed by Meta's own data policy and is outside our control. If you do not want it, you can block the pixel in your browser; how to do so is on the Cookie Policy page.

Automated reply and assistant features offered in the platform run at the business's request and do not replace professional judgement. Defining the scope of these features and adding human oversight where needed is the responsibility of the business concerned.

Commercial electronic messages

We send promotional and campaign messages only to people who have given their approval, and every message offers an opt-out; an opt-out request is applied within three business days at the latest.

The obligations under Law No. 6563 and the Message Management System (İleti Yönetim Sistemi, İYS) belong to the party sending the message: to us for our own messages, and to the business concerned where a business sends messages to its own customers through the platform. In this second case Müşterify provides only the sending tool. Details are on the Service Terms and Liability page.

Children's data

Our service is not directed at people under 18 and we do not knowingly collect data from them. If a business using the platform enters data about a minor client, obtaining the necessary parental consent is that business's responsibility.

Anonymous visit statistics

Our marketing pages include an anonymous visit counter that runs on our own server. It sets no cookies and stores no IP address or any identifier that identifies a visitor. It keeps records not as individual visits but as daily per-page totals. Because it does not constitute personal data it falls outside the scope of this policy, but we state it here for transparency. Details are on the Cookie Policy page.

Changes

If we change this policy, we publish the current version on this page and update the date above. We notify platform users separately about significant changes.