Privacy Policy

• Data controller: Yiğitcan Şafak (Fayops)
• Email: fayopsdev@gmail.com

Send questions about this policy or your personal data to the email address above. How to make a formal request under the KVKK is described in section 11.

Fayops is a business customer relationship management (CRM) service for companies that manage field and sales teams. The mobile app and the web panel have no sign-up screen; user accounts are created by an administrator of the company that uses Fayops, by invitation.

• User account data: For the data of your own account (name, email, role, sign-in data), Yiğitcan Şafak is the data controller.
• Your company’s customer records: For records about a company’s own customers (name, phone, email, address, notes, etc.), that company is the data controller. Fayops processes this data on the company’s behalf and on its instructions, as a data processor.
• Your company’s work records: Shift start and end times, visit and activity records, and the log of actions taken in the app are processed on your company’s behalf so that it can manage its employees and work. For this data your company is the data controller and Fayops acts as a data processor.

You can direct requests about this company data to your company first. We forward such requests that reach us to the company concerned.

• Account and identity data: First and last name, email address, your role, your company and team, account creation and last sign-in time.
• Sign-in and security data: Your password (stored on our servers only as a one-way hash), verification codes sent by email, and session tokens. When your account is created, a password for your first sign-in is sent to you in the invitation email; we recommend changing it after you first sign in.
• Business data created while using the Service: Customer records, tasks, activities, comments and reactions, visit and communication logs, notes, tags, shift start and end times, and a log of actions taken in the app (which user did what, and when).
• Technical data: When you connect to our servers, your IP address, date and time, request details and, for some actions, your email address are kept in server logs for security and troubleshooting.

Location: the app currently does not collect your device location and does not ask for location permission. Addresses entered in customer records are stored as business data. If a feature that uses device location is added later, you will be informed in the app beforehand and asked for permission.

Fayops has no ads. We do not use the advertising ID, analytics, or third-party tracking tools. The app does not access your contacts, camera or photos.

Your personal data is collected electronically, by fully or partly automated means, from these sources:

• the details your company’s Fayops administrator enters in the web panel when inviting you (first and last name, email address, role, team);
• the information you enter in the Fayops mobile app and web panel, and the sign-in, shift and action records created while you use them;
• server logs created automatically when you connect to our servers and websites.

• Providing the Service and service emails: Creating and managing your account, verifying your sign-in, showing your company’s data according to your role, and sending invitation, verification code and password reset emails. Legal basis: our legitimate interest in processing the data of people who use the Service on behalf of a company we have a service contract with (KVKK Art. 5/2-f), and establishing or performing a contract (KVKK Art. 5/2-c).
• Security and troubleshooting: Preventing unauthorized access and misuse, finding and fixing errors, and keeping action logs. Legal basis: legitimate interest (KVKK Art. 5/2-f).
• Running the websites: Processing IP addresses and request details so that fayops.com and panel.fayops.com work and stay secure. Legal basis: legitimate interest (KVKK Art. 5/2-f).
• Legal obligations: Complying with the law and answering requests from competent authorities. Legal basis: legal obligation, and establishing, exercising or defending a right (KVKK Art. 5/2-ç and 5/2-e).

We do not rely on consent for any processing. If that becomes necessary, we will ask for your consent separately and in advance.

We do not sell your personal data or share it for advertising. It is shared only with the following parties, and only as far as needed:

• Your company: Data you enter can be seen by your company’s administrators and team members according to their roles. The in-app “Live” feed shows your name and your actions (for example adding a customer, changing a task status, starting and ending your workday and how long you worked) to all users in your company. Company administrators can also list your shift start and end records.
• Fayops authorized team: A small number of authorized people who build and operate the Service, bound by confidentiality, can access all companies’ data for support, maintenance, troubleshooting and security.
• Hosting: Our servers and databases are hosted on Oracle Cloud, in a European Union region.
• Email and web hosting: Service emails are sent through Google’s email infrastructure. fayops.com and panel.fayops.com are served from Google Firebase Hosting, which processes your IP address when you visit them.
• Maps: The in-app map loads OpenStreetMap map tiles and the Leaflet library (unpkg.com). While doing so, your device’s IP address and the map area you view are sent to these providers.
• Actions you start: When you start a call, email, WhatsApp message or directions from a customer card, the phone number, email address or address is handed to the app you choose (for example your phone, email app, WhatsApp or Google Maps) and is then subject to that app’s privacy policy.
• Public authorities: Only when the law requires it.

When you download the app from Google Play or the App Store, those stores process your data under their own privacy policies.

Our servers are in an Oracle Cloud region in the European Union. Service emails and our websites are delivered through Google’s infrastructure, and the in-app map through OpenStreetMap and unpkg.com. Your personal data is therefore transferred outside Turkey (to European Union countries and to the other countries where these providers’ servers are located) in order to provide the Service.

You can write to us with any question about international transfers.

• Account data: For as long as your account is open.
• Your company’s business data and action logs: For as long as your company uses Fayops. They are deleted when the company stops using the Service or asks for deletion.
• After a deletion request: Deleted or anonymized within 30 days at the latest from the date your request reaches us. Copies in backups expire automatically within 7 days. Records that the law requires us to keep are kept only for the required period.
• Server logs: When log files reach a set size, the oldest ones are deleted automatically.
• Data on your device: Session tokens are removed from your device when you sign out. If you tick “Remember me”, your email address and password are kept in the device’s secure storage; they are removed when you sign in again with the option unticked. On Android, uninstalling the app removes all Fayops data from the device. On iOS, items in the secure storage (Keychain) may remain on the device after the app is uninstalled.

To ask for your Fayops account to be deleted, email fayopsdev@gmail.com from the email address registered to your account, with the subject “Account deletion request”. You can also send your request to us through your company’s Fayops administrator.

If you no longer have access to the email address on your account (for example, because you have left the company), write to us from another address with your full name and company name; we will verify your identity through your company’s administrator.

• What we delete: Within 30 days at the latest from the date your request reaches us, we delete your Fayops account and sign-in data (name, email, role, password hash, sessions), your team memberships and the tasks assigned to you. Copies in backups expire automatically within 7 days.
• What stays with your company: Customer records, activities, notes, tasks and comments you entered, your shift records and the action log are your company’s business records. They are not deleted with your account and are kept or deleted on the company’s instructions. Your name remains shown in them as the person who performed each action.

• All communication between the app, the panel and our servers is encrypted (HTTPS/TLS).
• Passwords are stored on our servers in a form that cannot be reversed.
• In the mobile app, session tokens and the email address and password saved with “Remember me” are kept in the operating system’s encrypted secure storage (Android Keystore / iOS Keychain).
• In the web panel, session tokens are kept in your browser’s local storage (localStorage) and are removed when you sign out.
• Access to data is limited by the user’s role and company.

If a breach affects data for which we are the data controller, we will notify the Turkish Personal Data Protection Board without delay and within 72 hours at the latest of becoming aware of it, and the people affected as soon as possible. Breaches affecting data we process on your company’s behalf are reported to your company without delay.

Under Article 11 of the KVKK you have the right to:

• learn whether your personal data is processed and, if so, request information about it;
• learn the purpose of processing and whether the data is used accordingly;
• know the third parties in Turkey or abroad to whom it is transferred;
• ask for incomplete or inaccurate data to be corrected;
• ask for the data to be deleted or destroyed under the conditions of KVKK Article 7;
• ask for corrections, deletions or destruction to be notified to third parties who received the data;
• object to a result against you that arises solely from automated analysis;
• claim compensation for damage caused by unlawful processing.

Send your request in Turkish, stating your first and last name, Turkish ID number (for foreigners, nationality and passport number), address for notifications, email and phone if any, and what you are asking for, by one of these channels: (i) from the email address registered in our system, to fayopsdev@gmail.com; (ii) signed with a secure electronic signature or mobile signature, to fayopsdev@gmail.com.

We answer free of charge as soon as possible depending on the nature of the request, and within 30 days at the latest from the date it reaches us. We may ask for additional information to confirm that the request is yours.

If your request is rejected, you find the answer insufficient, or we do not answer in time, you can complain to the Turkish Personal Data Protection Board within 30 days of learning of our answer, and in any case within 60 days of your request.

Fayops is meant for business use and is not directed at anyone under 18. We do not knowingly collect personal data from children.

fayops.com and panel.fayops.com use no analytics or advertising cookies. The panel only uses the technical browser storage (localStorage) needed to keep you signed in.

We may update this policy from time to time. The current version is always published on this page, with the date at the top updated. We will also announce significant changes in the app or by email.

For any privacy question: fayopsdev@gmail.com