Version v1.4 — Effective date: 4 October 2026
This text explains how personal data is processed through the SayMeet iOS application and the SayMeet web panel at meet.saypartner.com (together the "App"). It serves as the disclosure text required by article 10 of Turkish Personal Data Protection Law no. 6698 ("KVKK") and also contains our privacy policy.
DEEGİTECH TEKNOLOJİ VE YAZILIM LİMİTED ŞİRKETİ ("Deegitech" or the "Company")
| Mode | For whom | Data controller | Deegitech’s role |
|---|---|---|---|
| Personal mode | An individual user who uses the App for their own appointments, notes and assistant conversation | Deegitech | Data controller |
| Corporate mode | An appointment book, customer/patient records and team management on behalf of a business (clinic, practice, salon and so on) | The business (clinic) | Data processor (KVKK art.3/1-ğ) — processes on the instruction of and on behalf of the business |
For the team member accounts belonging to a business (manager, secretary), Deegitech is the data controller of the account data (§3, the "Account" row); for the appointment book and customer records of the business, the business is the data controller.
| Category | Data types | Source |
|---|---|---|
| Account | Full name, e-mail address, phone number, password (only as an irreversible hash), e-mail/phone verification times, session ticket, device identifier for notifications (APNs token) | From you during registration and sign-in |
| Business (corporate mode) | Business name, address, time zone, currency, services offered, practitioner/staff definitions, working hours, business code, team members (name, e-mail, role) | From the business manager |
| Customer/patient records (corporate mode — the business is the data controller) | Full name, phone, e-mail, date of birth, marker for being under the age of 18, preferred language, appointment history and status, no-show count, notes entered by the business (stored encrypted), consent records (consent type, channel it was obtained through, time, text version) | From the business; through the channels the business has enabled (e.g. WhatsApp) from the customer directly |
| Assistant conversation | The texts you write, the voice recordings and photos you send, the assistant’s replies; in personal mode also notes, calendar events and reminders. To let the assistant process your request, this content is kept encrypted separately in more than one component of the App. | From you (inside the App or over WhatsApp) |
| Date of birth (personal mode — record of past consent only) | Your date of birth (the time of birth is neither asked for nor stored), the times your consent was given and withdrawn, the version of the consent text you approved | From you, with the explicit consent you gave in the past — no new date of birth is collected after 4 October 2026; if you never gave one, this row stays empty |
| Subscription | Apple transaction identifiers (including the original transaction identifier), the product purchased (a team plan), purchase, renewal and expiry dates, subscription status (trial, active, expired or refunded) and whether the transaction is live or a test; in corporate mode, the business the plan belongs to. Your payment card details stay with Apple and never reach us. | From the Apple App Store: at purchase and through Apple’s subscription status notifications |
| Notification | Reminder queue records (channel, planned time, delivery result), push notification records (the notification body carries no content) | Produced by the App |
| Technical and security | IP address, request time, device/app version, error records, audit records (who did what and when — carries no message content) | Automatically |
Special category data warning: in corporate mode the notes and appointment details entered by the business may contain health data (KVKK art.6). Determining the legal basis for processing this data, making the necessary disclosure and, where required, obtaining explicit consent is the responsibility of the business. Deegitech stores these fields encrypted at the application layer and processes them only on the instruction of the business. In personal mode you are not expected to enter health data; if you do, that data is stored with the same protection but is not kept as a health record.
| Purpose | Legal ground (KVKK) |
|---|---|
| Opening an account, identity verification (e-mail and phone verification), session management | art.5/2-c — establishment and performance of a contract |
| Providing the appointment, agenda, customer record and team management service | art.5/2-c — performance of a contract; in corporate mode the instruction of the business |
| The assistant understanding your request with artificial intelligence and producing a reply; and the transfer of data abroad required for this | art.5/1 and art.9 — explicit consent (the in-app artificial intelligence permission screen; see §5) |
| Appointment reminder and information messages (in corporate mode on behalf of the business) | The consent/ground obtained by the business from its customer; in personal mode art.5/2-c |
| Storing the date of birth in personal mode and keeping the consent record | art.5/1 — explicit consent (the in-app date of birth permission screen; see §5.1) |
| Subscription and plan management: verifying the purchase with Apple, switching team plan entitlements on and off, and tracking trial, renewal and refund status | art.5/2-c — conclusion and performance of a contract; art.5/2-ç — legal obligation (financial records) |
| Security: prevention of abuse and unauthorised access, rate limiting, audit records | art.5/2-f — legitimate interest |
| Meeting legal requests | art.5/2-ç — legal obligation; art.5/2-e — establishment/protection of a right |
Your personal data is collected electronically through the App, by partly automated means. No profiling or advertising-purpose processing is carried out.
The assistant feature uses the API services of third-party artificial intelligence providers to answer your requests. Only the content required to process that request is sent to the provider; the provider processes that content and returns the reply.
| Provider | Country | What it is used for | Use in training |
|---|---|---|---|
| Google LLC (Gemini API) | USA | Understanding assistant requests that contain text and producing replies; interpreting the photos you send; transcribing voice messages; producing meaning vectors (embeddings) | Under the paid service terms of the Gemini API, the data sent is not used in the training of Google models. |
Where can I see which provider is active? The artificial intelligence permission screen inside the app lists the providers active at that moment, the purpose of each and the data types it processes. When a provider changes, the permission text is presented again with a new version and your permission is obtained again.
How does the permission work? The assistant does not run until you allow artificial intelligence processing inside the app. You can withdraw the permission at any time from the Settings section; when you withdraw it the assistant conversation stops and the other features of the App (appointments, agenda, notes) keep working. The time of the permissions you give and withdraw and the version of the permission text are kept on record.
Artificial intelligence output is for information purposes; it is not medical, legal or financial advice. For details see Terms of Use §6.
The calendar framework based on your date of birth was removed from the App on 4 October 2026: nothing is computed from your date of birth any more, and no number, score or prediction is produced. If you gave explicit consent earlier, your date of birth and your consent record may still be stored; that data remains only as the record of your past consent, and the rights below apply to it unchanged. A date of birth is not health data and carries no health claim.
Your personal data is shared only for the provision of the service and with the parties below. Your data is never sold to any third party.
| Recipient | Country / region | Purpose |
|---|---|---|
| Amazon Web Services | Germany — Frankfurt (eu-central-1) | Server hosting, database and daily backup |
| Cloudflare | USA / global network | Connection security, content delivery and traffic routing (access to the server is provided through a Cloudflare tunnel); because Cloudflare terminates the visitor’s connection your IP address is visible to it and a network error reporting (NEL) header is delivered to the browser — see §13 |
| Apple Inc. | USA | Push notification delivery (APNs — the notification body carries no content); in-app purchase, payment collection and subscription management (App Store) — Apple collects the payment and your card details stay with Apple |
| Meta Platforms | USA / Ireland | Appointment reminder and information messages over the WhatsApp Business API — from Deegitech’s shared WhatsApp line on behalf of the business; only when the business has enabled this channel on a paid team plan and the customer’s consent is on record; your own personal-mode reminders (to your verified number); also the assistant conversation content when a personal-mode user starts chatting with the assistant over WhatsApp themself |
| Amazon Web Services (SNS) | Germany — Frankfurt (eu-central-1) | SMS reminders — the SMS channel is not available today; once opened it is used only when the business has enabled this channel, and in the final step the message is delivered to the recipient’s mobile operator |
| Microsoft Corporation (Microsoft 365 · Graph API) | EU region (tenant); company headquarters in the USA | Verification code e-mails (the capability to send team invitation e-mails exists but has not been used to date) |
In corporate mode, WhatsApp messages to customers are sent not from the business’s own WhatsApp account but from Deegitech’s shared WhatsApp line, on behalf of the business; the business is responsible for the message content and for obtaining the customer’s consent.
Our servers are located in Germany (AWS Frankfurt); for that reason all data you enter into the App is deemed to be transferred abroad within the meaning of the KVKK. The artificial intelligence providers (§5) and some sub-processors (§6) are established in the USA. Meta (USA/Ireland) also receives personal-mode assistant conversation content over WhatsApp.
Transfer abroad is carried out within the framework of KVKK art.9, by concluding the Standard Contract clauses announced by the Personal Data Protection Board with the relevant recipient and notifying the Board, and/or on the basis of the explicit consent we separately obtain for artificial intelligence processing. In corporate mode, the data processing provisions between the business (data controller) and Deegitech (data processor) also cover this transfer.
| Data | Retention period |
|---|---|
| Account data | For as long as the account is open; on an account deletion request (§9) |
| Assistant chat history (texts and replies) | 6 months (180 days). Personal-mode assistant chat content is also kept as separate encrypted copies in more than one component of the App; these copies are deleted from the live system when you delete your account (see the general backup note below for backups). |
| Conversation attachments (voice recording, photo) | Stored encrypted; no time-based automatic deletion is applied — they are deleted when you delete your account. If we define a retention period this text will be updated. |
| Personal mode data (notes, calendar events, reminders, widget subscriptions) | 1 year (365 days) — or when you delete them |
| Assistant preference learning (user behavior profile) | 1 year (365 days) |
| Date of birth and date of birth consent records (personal mode) | Until you withdraw consent — when you withdraw it the date of birth is deleted immediately; the consent/withdrawal timestamps remain until the account is deleted |
| Session and verification records | 3 months (90 days) |
| Notification and reminder queue records | 90 days — completed records are deleted automatically |
| Audit records (carry no content) | 2 years (730 days) |
| Corporate mode: business, customer/patient, appointment and consent records | For the term of the contract with the business and according to its instruction. The legislation to which the business is subject (e.g. health legislation) may require longer retention; that period is determined by the business. After the contract ends the business may request an export of its data within 30 days; at the end of that window the data is deleted. |
| Subscription transaction records | For the period prescribed by financial legislation (10 years). The records hold Apple transaction identifiers, the product, dates and subscription status, and no card details (§3); the legal basis is set out in §4. They are kept until the end of the legal period even if you delete your account (§9). |
| Backup — daily database copy | 7 days |
| Backup — weekly database copy | 4 weeks |
| Backup — monthly database copy | 3 months |
| Backup — server disk snapshot | 4 weeks |
| Backup — encrypted copy in separate storage | No deletion period is defined; this copy is kept indefinitely today. A deletion request must separately ask for it to be dropped from this copy. |
| Location of the backups | All backups are encrypted and kept in the Germany (Frankfurt) region. |
The current state of these periods — an honest declaration: time-based automatic deletion is in effect for the notification queue. For chat history, personal mode data, session records and audit records the periods above are a target; for those items time-based automatic deletion is not yet in effect in production. Today this data is deleted on request (§9, §11) and records older than the target may still be found. This text will be updated when automatic deletion is switched on. When you delete your account your data leaves the live system immediately; its removal from the backup copies depends on the backup periods above, and a separate request is needed for the copy that has no defined deletion period.
You can delete your account from within the app: Settings → Delete Account. Before deletion a preview showing what will be deleted is presented; to confirm you are asked to type SİL.
When a deletion request is confirmed the operation is carried out immediately and cannot be undone; there is no waiting or undo window. That is why the app asks you to type a confirmation word before deleting. If the deletion of personal-mode assistant data cannot be completed at that moment, it is retried automatically in the background. If you want a copy of your data before deletion, write to [email protected].
What is not deleted: audit records (they are the evidence that your deletion request was carried out; they carry no content) and the subscription transaction records that financial legislation requires to be kept are retained until the end of the relevant legal period.
Applications are concluded within 30 days at the latest, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Additional information may be requested in order to verify your identity.
If you are the customer/patient of a business in corporate mode, address your request to that business first (§1.1). If you contact us, we forward your request to the relevant business and fulfil it on that business’s instruction.
The SayMeet application contains no third-party analytics, advertising or crash reporting SDK. These pages use no cookies and load no measurement script. On your device the App stores functional data such as the session ticket and interface preferences.
Content kept on the device for widgets: So that home screen widgets can work, a limited amount of content is kept on your device, in the app’s widget container: the time and title of your upcoming entries. This content is deleted when you sign out, sign in with another account or delete your account; if you remove the widget, this content is deleted the next time the app opens.
When you open this page, who does your browser connect to? The content of the page fetches nothing from a third party: all assets including the fonts are served from saypartner.com, that is, your browser makes not one request to an independent third party. The only exception is our hosting and content delivery provider Cloudflare — not an independent third party but the data processor declared in the table in §6. Because the page reaches you over the Cloudflare network, Cloudflare terminates your connection and your IP address is therefore technically visible to it; in addition, a NEL header is delivered to your browser with the response, telling it to send an automatic network error report to Cloudflare if the connection fails. Apart from that, opening this page transmits your IP address to no other party.
Minimum age of use for the App: 18. In corporate mode it is the responsibility of the business to obtain parent/guardian consent for customer/patient records under the age of 18; the App makes it possible to record this type of consent.
This text is updated when necessary. Significant changes are announced by in-app notification or e-mail; the effective date of the new version appears at the top of the page.