Privacy Policy — English summary
Effective date: 5 September 2026 ·
Last updated: 7 October 2026
Published at: https://rando.vu/gizlilik-en
This is a courtesy summary of the Turkish original. In case of any conflict, the Turkish text prevails: Gizlilik Politikası.
1. Who we are
Rando is an appointment-management app for small businesses. The app is used by the business owner and their staff; the business stores its own customer records in it.
We carry the whole operational burden for customer data — the business is not asked to do anything about it:
| Whose data | Controller | Our role |
|---|---|---|
| Business owner and staff (login phone number, session, device id, usage events) | Us — Melih Ünal | Data controller |
| The business's own customers (name, phone, appointments, notes, tickets) | Us, jointly with the business | Joint controller. Requests, erasure, security, breach notification, retention and deletion are all handled by us |
If you are a customer of a business using Rando: contact us directly at melihunal79@gmail.com · Esentepe Mah. Talat Paşa Cad. No: 5 İç Kapı No: 1, Şişli / İstanbul. You do not need to contact the business as well; we accept and answer requests on the business's behalf too.
For customer data we are a joint controller together with the business and we take on performance of the obligations: we answer Article 11 requests within thirty days free of charge, we carry out erasure, we implement the security measures under Article 12, we make breach notifications, and we apply the retention and deletion periods. This text does not claim that we are the sole controller — Turkish law assigns that status on the facts, and the business collects the customer's number itself. KVKK Article 3(1)(ı) defines the controller as the party that determines the purposes and means of processing personal data and is responsible for the establishment and management of the data filing system.
Developer named in the Google Play store listing: Melih Ünal · App: Rando · Privacy contact: melihunal79@gmail.com · Address: Esentepe Mah. Talat Paşa Cad. No: 5 İç Kapı No: 1, Şişli / İstanbul · Web: https://rando.vu
2. Data we collect
As controller (owner and staff): phone number (used as the login identity), e-mail address and Google account identifier (both used to create the account and to sign in; kept until the account is deleted), one-time login code (only a hash is stored, valid for 3 minutes), recovery code (hash only), session token (30 days, stored in the device's encrypted storage), an app-generated random device identifier, name and role, and server-side product-usage events.
Signing in with Google or e-mail. From Google we take only two things: your e-mail address and your Google account's stable identifier. Your name and profile picture are not requested, not read and not stored, and we do not reach your Google contacts, calendar or any other Google data. On the e-mail route the address comes only from you; there is no password — a one-time code is sent to the address.
Sign-up is invitation-gated. Open self-service sign-up is switched off: only e-mail addresses on the invitation list can open an account. An invitation record holds the invited e-mail address, the business that issued it, and whether it has been used.
Usage events never contain a raw phone number, a name, a message body or free text. A person is represented by an irreversible, per-business code.
As joint controller (the business's customers): customer name, phone number, birthday, free-text note, marketing consent flag, appointment history, and ticket / cash-register / commission records. No card or bank details are processed.
Voice: captured only while you hold the assistant's microphone button; see section 5.
Contacts: when you choose "add from contacts", the phone's contact list is read on the device, but only the people you select (name and number) are sent to our server; the rest of your contacts are not sent. The permission is asked at first use.
Subscription and purchase record: plan, product identifier, trial and period dates, status and subscription events, tied to your business account and kept until the account is deleted. The subscription is bought through Google Play (App Store on iOS); card and payment details are handled by the store and never reach us.
WhatsApp / Instagram inbox (only if the business connects the channel): the customer's message text, channel identifier, display name, username, a link to the profile picture, and the reply text the business sends. Connecting a channel is the business's choice. Messages are kept for 180 days, then deleted; when Meta reports a message as deleted, its body is deleted.
Sign in with Apple (iOS only): we receive the account identifier Apple gives and, if provided, an e-mail address or Apple's private relay address. The e-mail arrives only at the first authorisation and may not arrive at all.
Biometrics: the app does not collect, read or process biometric (fingerprint / face) data.
Worldwide use: the app can be offered to users in any country; this text describes the request routes under Turkish law, and the same routes are open to users in every country.
Assistant chat record: stored only if your business turns the chat record on. It holds your sentence, the assistant's answer, which tool it called with which arguments and the size of the result, your decision on the confirmation card, the provider/model, token counts, your role and the time. Personal data is masked before it is written (raw phone numbers, secrets, and customer names from your own records are replaced). Kept for 12 months; see section 5.
3. What we never collect
Location/GPS, camera, photo gallery, SMS content, call logs, advertising ID (AAID). (Contacts: only the people you pick, see section 2.) Even when you sign in with Google, your Google name, profile picture, contacts, calendar and any other Google data are not read and not stored — the server takes only the e-mail address and the account's stable identifier out of the identity token Google issues. The app contains no advertising network, no analytics SDK, no crash reporting SDK and no third-party trackers. Its permissions, by purpose:
- Internet — to exchange data with our server.
- Microphone — only while you speak to the voice assistant; asked at first use, and if you refuse it the assistant keeps working by typing.
- Notifications — only to show appointment reminders generated on the device itself; asked at runtime.
- Vibration — so that reminder can be felt while the phone is on silent.
- Contacts (read) — only when you choose "add from contacts"; asked at first use; only the people you select are sent to the server.
- Billing and network state — to buy and verify the subscription through the store and to check connectivity.
- Biometric — comes with a library inside the app; the app itself does not collect, read or process biometric data.
No SMS-reading permission is requested — login codes are typed in manually.
4. Who we share data with
| Party | What is sent | Why | Where |
|---|---|---|---|
| Hosting provider (DigitalOcean) | All stored data resides on the server | Running the service | Frankfurt, Germany |
| SMS provider (İletiMerkezi) | Recipient's phone number and the message text | Delivering login codes and appointment messages | Türkiye |
| E-mail provider (Brevo; fallback Mailjet) | Recipient's e-mail address and the message text (the one-time code) | Delivering sign-in / sign-up codes | France / Germany — European Union |
| Google — only when you choose "Continue with Google" | We send Google nothing about you: authentication happens between your device and Google, and only Google's signed identity token reaches us. We fetch Google's public keys to check that token; that request carries no identity data | Letting you sign in with your Google account | USA |
| Subscription store: Google Play (Google) or Apple App Store (Apple) | Our server only asks the store about the purchase token and receives subscription status, plan, product identifier and period dates. Card and payment details never reach us | Verifying the subscription | USA |
| Meta (WhatsApp / Instagram) — only if the business connects the channel | Incoming messages reach us from Meta; the reply text the business sends goes to Meta | Receiving and answering customer messages | USA |
| Apple — only when you choose "Sign in with Apple" | Authentication happens at Apple; Apple's signed identity token reaches us | Letting you sign in with your Apple account | USA |
| AI provider (via OpenRouter) | See section 5 | Understanding and answering assistant questions | USA |
| The device's speech-recognition service | Your voice (section 5) | Converting speech to text | Determined by the device / OS vendor |
| Competent public authorities | Requested data | Where required by law | Türkiye |
We do not sell personal data and do not use it for advertising.
5. Voice assistant and AI
Your speech is transcribed by the device's own speech-recognition service. No audio is sent to our servers and no audio is stored by us or sent to the AI provider. The recognition is started on the device but is not guaranteed to stay there: the device's service may send the audio to its own provider. However, Android's own documentation states that this API "is likely to stream audio to remote servers to perform speech recognition" — in that case the audio is governed by the device/OS vendor's privacy policy, not ours. If you deny the microphone permission, the assistant still works in text mode.
Sent to the AI provider: your typed (or transcribed) sentence; the business name, branch names, service list, staff names and your role; and, if your question concerns a customer, that customer's name, masked phone number, visit counts, first/last visit dates, favourite service, no-show count and a summary of recent appointments; money figures only if your role is allowed to see them.
Never sent: any raw phone number, the text of a customer note (the assistant only learns that a note exists), passwords, login codes, session tokens or provider keys.
Chat text is stored if your business turns the chat record on. While the record is off, chat text is written nowhere and the chat window is limited to the session. While it is on, the chat is kept in a separate table with personal data masked at write time. In both cases the event log never receives chat text — only the number of chats, never their content.
The chat record and your consent. We want to keep your chats so we can improve the assistant: find bad answers, grow the examples we give it, and build material for a future fine-tuning of the AI model. The business decides: you are asked once during setup, and you can switch it on or off at any time from the Veri (Data) screen. Staff chats fall under the same decision, and staff see the same on/off line above the assistant. While the record is off, nothing is stored — this is structural, not a preference flag: the database itself refuses a chat row for a business whose consent is not on. Masked before writing: raw phone numbers, passwords / login codes / tokens, and customer names taken from your own records (replaced by an irreversible code unique to your business). Honest limit: that masking works from your own customer records, so a name with no record in the system (for example a brand-new customer) can remain in the text. The customer note's text and the tool result itself are never stored. Setup-wizard answers are not recorded. Retention: 12 months. If you turn the record off, your whole chat history is deleted at that moment; deleting your account deletes it too. There is no screen that lists your chat history, and the fine-tuning set carries no business identity (no tenant, person code, session code or system prompt). It is given to no third party today; if that ever changes, this text and the Google data-safety declaration are updated together.
The assistant cannot change data on its own: every write requires an explicit on-screen confirmation.
6. Security
HTTPS for all traffic; login and recovery codes stored only as hashes; session token and device id kept in the device's encrypted storage; secrets, phone numbers and message bodies never written to logs; strict per-business data isolation (including the event log's person code); role-based access (staff cannot see revenue or commission, in the UI or via the assistant); temporary lockout after repeated failed logins. Backup frequency, location and encryption: daily automatic backups; kept on the same server in a directory accessible only to the server administrator; backups older than 14 days are deleted
7. Retention and deletion
Login code hash: 3 minutes. Session token: 30 days. Account and business data, e-mail address, Google account identifier and invitation records: until the account is deleted. Subscription and purchase record: until the account is deleted. WhatsApp / Instagram inbox messages: 180 days. Event log: 24 months. Assistant chat record (only if the business turned it on): 12 months, and the whole history is deleted the moment the record is turned off. Backups: 14 days.
Delete your account in the app: Data screen → "Hesabı sil" (Delete account), with a two-step confirmation listing what will be deleted. Deletion also covers the identity you signed in with: your e-mail address and Google account identifier are deleted, and so are your invitation records (both those tied to your business and your new-business invitation). Your assistant chat record and your chat-record preference are deleted as well. To delete only the chat record without deleting the account, turn the record off on the Veri (Data) screen.
Delete without installing the app: https://rando.vu/hesap-silme.
Today no separate set of data is retained for security, fraud prevention or legal compliance. Copies inside backups taken before the deletion fall away when the backup retention period ends.
If a business deletes its account, its customers' records are deleted with it. Customers do not have to wait for that: a customer may ask us directly to delete their data (melihunal79@gmail.com or https://rando.vu/hesap-silme). We handle the request ourselves and tell the customer the outcome; we do not send them back to the business.
8. Your rights
This section applies to everyone — business owners and staff who use the app, and customers who book an appointment with a business using it. Because we are a joint controller for customer data (§1), customers may exercise all of these rights directly against us; contacting the business as well is not required.
Under Turkish Law No. 6698 (KVKK) Article 11 you may ask whether your data is processed, request information about the processing and its purpose, learn the third parties the data is transferred to in Türkiye or abroad, request correction or erasure, request that corrections be notified to those third parties, object to decisions produced solely by automated analysis, and claim compensation for damage caused by unlawful processing.
Requests are answered free of charge within 30 days at the latest. Submit them in writing to Esentepe Mah. Talat Paşa Cad. No: 5 İç Kapı No: 1, Şişli / İstanbul, via registered electronic mail (KEP) none, with a secure or mobile electronic signature, or from the e-mail address already registered with us to melihunal79@gmail.com.
9. International transfers
Our server is in Germany, and the AI provider may be outside Türkiye. Under KVKK Article 9 (as amended by Law No. 7499) this is an international transfer. The Turkish DPA has not issued an adequacy decision for any country to date, so the transfer must rest on an appropriate safeguard — for example the Board's standard contractual clauses, which must be notified to the Authority within five business days of signature.
Safeguard relied on for this transfer: the standard contract published by the Turkish Personal Data Protection Board under Article 9 of the KVKK; the contract and the notification to the Authority are in preparation
Sign-in and sign-up providers. The e-mail provider's servers (Brevo; fallback Mailjet) are in France and Germany — the same country/regime group as our own server in Germany, so this line opens no new transfer item and falls under the same safeguard. Signing in with Google means authentication happens at a provider established in the United States; the same safeguard is being prepared and notified for that line as for the AI provider.
10. Children
The app is intended for business owners and staff aged 18 and over. It is not directed at children and does not knowingly collect children's data.
11. Changes and contact
We update the "last updated" date above whenever this policy changes. Material changes are additionally announced via an in-app notice.
Developer / controller: Melih Ünal · E-mail: melihunal79@gmail.com · Address: Esentepe Mah. Talat Paşa Cad. No: 5 İç Kapı No: 1, Şişli / İstanbul · Web: https://rando.vu · Account deletion: https://rando.vu/hesap-silme