Privacy Policy

For your account data, the data controller is the company operating the Platform (identity and contact details are in the Contact section at the bottom of this page).

Account data: name, email and sign-in details.

Profile/clinic content: the professional information, contact details, images and text you enter to publish your site.

Payment data: payments are handled by iyzico (Turkey) or Paddle (international); your card details are never stored by the Platform.

Usage data: session, device/browser information and basic logs.

Providing the service, creating your account and publishing your site.

Payment and subscription management, and invoicing.

Support, security, abuse prevention and compliance with legal obligations.

Performance of a contract, compliance with legal obligations, and our legitimate interests. Where required, we rely on your explicit consent.

We use trusted infrastructure providers to deliver the service: hosting (Vercel), database and authentication (Supabase), media storage (Cloudflare R2/CDN), email delivery (Resend), and payments (iyzico and Paddle).

Some providers may be located abroad; transfers are made only as needed to provide the service and in accordance with applicable law.

For visitor/patient data on the site you publish (e.g. the contact form), you are the data controller and the Platform is the data processor.

Contact-form messages are not stored on the Platform; they are only emailed to you (via Resend). Informing your visitors and obtaining any required consent is your responsibility.

We use strictly necessary cookies for sessions and core functionality. Where analytics or marketing cookies are used, we obtain consent to the extent required.

We keep your data for as long as needed for the relevant purpose and for periods required by law. Invoices and financial records are kept for 10 years under tax law.

When you close your account, your content is deleted after the recovery window (except financial records).

You have rights to access, correct, delete, object to processing and port your data. You can export your data as JSON from the dashboard.

Send requests to the contact address on this page.

We apply technical and organizational measures such as access control, row-level security (RLS), encrypted transport (HTTPS) and secure authentication to protect your data.

We may update this policy from time to time. We announce material changes reasonably; the current version is always on this page.