Privacy Policy
Last updated: · Effective:
In short:
- We process only what the service needs: your name and mobile number for the account, and the order, address, photo and payment details that come with carpet cleaning.
- A courier’s location is processed only while the courier’s shift is open; we do not track anyone else’s location.
- Card details are entered on PayTR’s payment page and never reach us.
- We do not show ads, we do not use advertising or analytics SDKs and we do not sell your personal data.
- You can request the deletion of your account and data at any time: Account & Data Deletion.
1. Scope and data controller
This policy explains how personal data is processed in the PakBi mobile app (Android, iOS), the macOS app, the web panel and the website at https://pakbi.net (together, the “Service”). PakBi is a single app with three roles: Management (the carpet-cleaning business and its staff), Courier (the business’s own couriers) and Customer.
The data controller for the Service is Bigeransoft Yazılım (“BigeranSoft”, “we”). Contact: bigeransoft.info@gmail.com.
A carpet-cleaning business that uses PakBi is itself a data controller for the customer and staff data it enters into the app; we process that data on the business’s behalf and on its instructions (as a data processor). The KVKK Privacy Notice contains the formal notice required by Turkish Personal Data Protection Law No. 6698 (“KVKK”).
2. What data we process
| Data group | What it includes | Why |
|---|---|---|
| Account | Full name, mobile number, password (only an irreversible hash), language preference, time you accepted the privacy notice | Creating the account, signing in, showing the app for your role |
| Sign-in and security | SMS verification code (hash only), session tokens (hash only), device name, sign-in attempts, IP address | Verifying identity, preventing abuse and unauthorised access |
| Business | Business name and short name, phone, address and map location, branch details, tax number and tax office (for sole proprietors the tax number may equal the Turkish ID number; the field is optional) | Providing the business panel, receipt and invoice details |
| Team | Staff and couriers’ full names, phone numbers, roles and permissions, invitations, shift start and end times, vehicle assignment, end-of-day cash reconciliation | Managing the business’s team and tasks |
| Customer card and address | Full name, phone numbers, the business’s notes, address (province, district, neighbourhood, street address, directions), the address’s map coordinates, SMS permission, balance and credit (veresiye) | Collecting carpets from and returning them to the address, keeping the customer informed |
| Orders | Order and carpet details (item, size, label / QR code), status history, pick-up and delivery times, delivery code | Tracking and delivering the order |
| Photos and signature | Carpet photos (pick-up, damage and stain marks, before and after cleaning, delivery) and the signature image taken at delivery | Documenting the carpet’s condition and proving delivery |
| Courier location | Latitude, longitude, speed, heading and accuracy — only while the courier’s shift is open, about every 15 seconds | Assigning and routing tasks, showing the customer that the courier is on the way |
| Payments | Payment method, amount, status and the PayTR transaction reference (we never store card numbers) | Taking payment, cash and reconciliation |
| Subscriptions and purchases | Package, App Store / Google Play / PayTR transaction ID, receipt verification result, subscription start and end | Providing the business subscription and SMS credits (only the business owner can buy them) |
| Communication records | SMS delivery records (recipient number, text, provider reference), in-app notifications, push-notification registration (FCM token, platform, language) | Sending verification codes and order updates, notifications |
| Reviews | Rating, comment, complaint flag, the business’s reply | Service quality |
| Support and requests | Email correspondence; account-deletion requests (phone number, request details, IP address, browser information) | Answering and fulfilling requests |
| Location-sharing link | The customer’s one-time location (latitude, longitude, accuracy), taken only when the customer opens the link the business sent and confirms; the request record and the sender business | Collecting the carpets from the right address |
| Digital receipt page | Anyone who knows the code can open this page. It does not show the customer’s address, phone number or photos; only the business name, order number, pick-up time, the customer’s initials, the items and the estimated amount are visible | Letting the customer see what was collected |
| On your device | Session tokens (in the device’s secure storage), a local database for offline use, preferences | Letting the app work offline; this data stays on your device and is not sent to us separately |
What we do not collect: advertising identifiers, your contacts, your microphone, health data or card numbers. We do not use third-party advertising or analytics SDKs. We do not process special categories of personal data. Please avoid capturing people in carpet photos.
3. App permissions
The app asks for a permission only when you use the related feature. You can withdraw any permission in your device settings at any time; only the feature that depends on it stops working.
- Notifications: order status, tasks and reminders.
- Camera: taking carpet photos and scanning QR / barcode labels.
- Photos: uploading a photo you pick from your gallery (only the photos you pick are accessed).
- Location (couriers only): while the shift is open, for tasks and deliveries — including when the app is in the background, for as long as the shift lasts. Sending location stops when the shift is closed.
- Bluetooth / nearby devices: connecting to a receipt or label printer. On older Android versions the system may ask for location permission to scan for Bluetooth devices; your location is not collected through this permission.
4. Purposes and legal bases
| Purpose | Legal basis (KVKK art. 5/2) |
|---|---|
| Creating your account, signing in, providing the Service, orders, courier tasks, payments and subscriptions | Necessary for entering into or performing a contract (c) |
| Invoices and financial records, server access logs, requests from authorised public authorities | Expressly provided for by law; compliance with a legal obligation (a, ç) |
| Security, preventing abuse, fixing errors, improving the Service with aggregated statistics | Our legitimate interest, without harming your fundamental rights (f) |
| Establishing, exercising or defending rights in a dispute (for example delivery photos and signature) | Establishment, exercise or protection of a right (e) |
| Courier location while the shift is open | Performance of the employment / service relationship and the business’s legitimate interest (c, f) |
If we ever need to process your data for a purpose not listed here, we will ask for your explicit consent separately, and you can withdraw it at any time.
Campaign and reminder SMS that a business sends to its customers through the app are commercial electronic messages. Obtaining the customer’s consent and registering it with the Message Management System (İYS) is the business’s responsibility; the app sends bulk messages only to customers whose SMS permission is on, and you can opt out at any time.
5. Who we share data with
Inside the app: a business sees the data of its own customers and team. A courier sees only the customer name, phone number and address of the tasks assigned to them. A customer sees the details of the business they use, the status of their order and, during pick-up or delivery, the assigned courier’s name and approximate location.
Service providers (processors) that process data only on our instructions:
| Provider | Service and data | Location |
|---|---|---|
| Hostinger International Ltd. | Server hosting (all Service data) | United Kingdom |
| Netgsm İletişim ve Bilgi Teknolojileri A.Ş. | Sending SMS (phone number, message text) | Türkiye |
| PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. | Card payments (card details you enter on the payment page go directly to PayTR) | Türkiye |
| Google LLC — Firebase Cloud Messaging | Push notifications (notification token, notification content, Firebase installation ID) | United States |
| Apple Inc. and Google LLC (App Store, Google Play) | In-app purchases of the business subscription and SMS credits (store transaction ID, receipt) | United States |
Authorities: we disclose data to courts and authorised public bodies only when legally required. We do not sell or rent personal data or share it for advertising.
6. International transfers
Our servers are in the United Kingdom and the notification and app-store services are in the United States, so your personal data is transferred abroad. These transfers are made in accordance with article 9 of KVKK, relying on appropriate safeguards such as the standard contracts announced by the Turkish Personal Data Protection Board, and with the security measures described below.
7. How long we keep data
| Data | Retention |
|---|---|
| Account details | As long as your account is open; deleted or anonymised within 30 days of a deletion request |
| A business’s customer, order, photo and team records | As long as the business account is open and as the business instructs; deleted within 90 days after the business account is closed |
| Invoices, payments, subscriptions, cash and credit records | 10 years (Turkish Commercial Code art. 82, Tax Procedure Law art. 253) |
| Courier location records | 30 days at most |
| SMS verification codes and sign-in attempts | 2 days at most |
| Session tokens | Invalid after 60 days or when you sign out; deleted 30 days after that |
| Offline request records (to prevent duplicate actions) | 30 days |
| SMS delivery records and in-app notifications | As long as the related account or business account is open |
| Server access logs | 1 year |
| Account-deletion requests | 3 years after they are concluded |
| Imports | Excel/CSV files uploaded by a business are not stored on the server. Parsed rows are deleted 30 days after the import finishes; only counts and error codes are kept. Abandoned imports are deleted entirely after 7 days. |
| Location-sharing link | The customer’s location is taken only once, through the link the business sends and with the customer’s consent; the location request record is kept for 30 days; per-IP request counters used to prevent abuse are kept for 2 days |
| Backups | 30 days |
8. Security
- All traffic between the app, the website and our servers is encrypted (HTTPS/TLS).
- Passwords are stored only as bcrypt hashes; SMS codes and session tokens only as hashes.
- Each business can reach only its own data; every request is checked for role and ownership.
- The Service runs in an isolated process on the server with its own database user; only authorised team members can access the server.
- Requests are rate-limited, and backups are kept for 30 days.
No method is 100% secure. If a personal data breach occurs, we notify the Personal Data Protection Board and the people affected as required by KVKK article 12.
9. Your rights
Under KVKK article 11 you have the right to learn whether your personal data is processed and to request information about it; to learn the purpose of processing and whether it is used accordingly; to know the third parties in Türkiye or abroad to whom it is transferred; to request rectification of incomplete or inaccurate data and deletion or destruction of your data, and to have these actions notified to those third parties; to object to a result against you arising exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing.
To use your rights, email bigeransoft.info@gmail.com from your own address including your registered mobile number, or use the deletion form. We reply free of charge within 30 days at the latest. If your application is rejected, the reply is insufficient or we do not reply in time, you may complain to the Personal Data Protection Board within 30 days of learning of the reply and in any case within 60 days of your application. If you are in the European Economic Area or the United Kingdom, you can also exercise your rights under the GDPR / UK GDPR and complain to your local supervisory authority.
10. Account and data deletion
You can request the deletion of your account and associated data, or of specific data only, at any time without reinstalling the app: Account & Data Deletion. That page lists what is deleted and what is kept, and for how long.
11. Children
The Service is not intended for people under 18 and they may not create an account. If we learn that a person under 18 has created an account, we delete it.
12. Website and cookies
This website does not use cookies, visitor tracking or analytics tools; fonts and images are served from our own server. For every request the server records the IP address, date and time, requested address and browser information in its access log, which is kept for 1 year.
13. Changes
We may update this policy. We announce significant changes in the app or by SMS. The current version is always on this page, with its date shown at the top.
14. Contact
Bigeransoft Yazılım (“BigeranSoft”) · bigeransoft.info@gmail.com · Support