Legal Documents

Privacy Policy

Last updated: 17 August 2026 — This policy has been prepared in accordance with GDPR (EU 2016/679) and the Turkish KVKK Law No. 6698.

Data Controller
Data We Collect
Purpose and Legal Basis
Who We Share Data With
International Data Transfers
Data Retention
Your Rights (GDPR Art. 15-22)
Cookie Policy
Security
Children's Privacy
Changes
Contact & Complaints

1. Data Controller

The party responsible for processing your personal data as the operator of the CalenFox platform:

Name	CalenFox
Operator	Fırat Gök
Email	privacy@calenfox.com
Platform	calenfox.com

In this policy, "we", "CalenFox", "platform" refer to the data controller above. "You" or "user" refers to professionals who register on the platform; "visitor" refers to individuals who visit profile pages to book appointments.

2. Data We Collect

2.1 Registration & Account Information (Users)

When you register on the platform, we collect:

First and last name
Email address
Password (hashed with bcrypt; plain text is never stored)
Profile photo (optional)
Job title, city, biography (optional; displayed on profile page)
Working hours and booking preferences
Date of acceptance of Terms of Service and this Privacy Policy

2.2 Booking Request Information (Visitors)

From visitors requesting appointments through a user's profile page, we collect:

First and last name
Email address (for OTP verification)
Appointment note (optional)
Requested date and time
IP address (for spam and abuse prevention; deleted after 90 days)

2.3 Automatically Collected Technical Data

IP address
Browser type and version
Operating system
Page access times (log files)
Session data (server-side, tracked via browser cookie)

We do not use third-party analytics tools (Google Analytics, Meta Pixel, etc.) and do not share data with advertising networks.

3. Purpose and Legal Basis

Purpose	Data Processed	GDPR Legal Basis
Account creation and authentication	Name, email, password	Contract performance — Art. 6(1)(b)
Profile page creation and publication	Name, title, bio, working hours	Contract performance — Art. 6(1)(b)
Booking request and management system	User + visitor data	Contract performance — Art. 6(1)(b)
Email notifications (approval/rejection)	Email address	Contract performance — Art. 6(1)(b)
OTP verification (spam protection)	Visitor email	Legitimate interest — Art. 6(1)(f)
Security, fraud and abuse detection	IP address, log records	Legitimate interest — Art. 6(1)(f)
Legal obligations and official authority requests	All relevant data	Legal obligation — Art. 6(1)(c)
Consent record (terms acceptance date)	Acceptance date and IP	Legal obligation — Art. 6(1)(c)

We do not process your personal data for marketing, advertising or profiling purposes. We do not sell your data to third parties.

4. Who We Share Data With

4.1 Platform Users

When you request an appointment, your name, email, and note are shared with the relevant user (appointment owner). This is inherent to the nature of the service.

4.2 Infrastructure Service Providers

The following sub-processors are used to operate the platform, all bound by data processing agreements under GDPR:

Service	Provider	Purpose	Location
Server / Hosting	Hetzner / DigitalOcean	Platform infrastructure	EU / US
Email delivery	SMTP service	Notification emails	—

4.3 Legal Obligation

Upon written request from Turkish courts, prosecutors, KVKK, or other competent EU/Turkish official authorities, we share the requested legally required information. We notify you unless the request contains a confidentiality order.

5. International Data Transfers

Your data may be processed on servers in Turkey or within the European Economic Area (EEA). Where transfer outside the EEA is required (e.g., email infrastructure), appropriate safeguards under GDPR Article 46 — such as Standard Contractual Clauses (SCCs) or Adequacy Decisions — are applied.

6. Data Retention

Data Type	Retention Period
User account information	While account is active + 30 days after deletion request
Booking records	2 years from the appointment date
Visitor email (OTP)	Stored encrypted with the booking record after verification
IP address (log)	90 days
Email communication records	6 months
Consent records (terms acceptance date)	3 years after account deletion (legal proof obligation)

When you delete your account, your personal data is permanently deleted within 30 days; data subject to legal retention is anonymized.

7. Your Rights (GDPR Art. 15-22 / KVKK Art. 11)

Individuals residing in the EU/EEA and persons resident in Turkey have the following rights:

Right of access (Art. 15): You may request a copy of the data we process about you.
Right to rectification (Art. 16): You may request correction of inaccurate or incomplete data.
Right to erasure / "right to be forgotten" (Art. 17): Under certain conditions, you may request deletion of your data.
Right to restriction of processing (Art. 18): You may request that processing of your data be suspended.
Right to data portability (Art. 20): You may request delivery of your data in machine-readable format.
Right to object (Art. 21): You may object to processing based on legitimate interest.
Automated decision-making (Art. 22): You may object to decisions based solely on automated processing (our platform does not make such decisions).

Submit requests to privacy@calenfox.com. After verifying your identity, we respond within 30 days.

If you reside in the EU, you have the right to lodge a complaint with the competent Data Protection Authority (DPA). If you reside in Turkey, you may apply to the Personal Data Protection Authority (KVKK).

8. Cookie Policy

The platform only uses cookies that are strictly necessary for the service to operate:

Cookie Name	Type	Purpose	Duration
`calenfox_session`	Necessary	Session management (login state)	Until browser close
`XSRF-TOKEN`	Necessary	CSRF protection	Until browser close

We do not use marketing, analytics or third-party cookies. Therefore, a cookie consent banner is not required; consent is not needed for strictly necessary cookies (ePrivacy Directive Art. 5(3)).

9. Security

We apply the following technical and administrative measures to protect your data:

All connections are encrypted with TLS 1.2+ (HTTPS)
Passwords are one-way encrypted with bcrypt (cost factor ≥ 12)
OTP codes are single-use and time-limited (10 minutes)
CSRF protection is active for all form submissions
Protection against SQL injection, XSS and other OWASP Top 10 attacks
Server access is limited to authorized personnel only

In the event of a data breach, affected individuals and competent authorities are notified within 72 hours in accordance with GDPR Articles 33-34.

10. Children's Privacy

The platform is intended for individuals aged 18 and over. We do not knowingly collect data from individuals under 18. If we become aware that a child has shared data, we will delete it immediately.

11. Changes to This Policy

We may update this policy. For material changes, a notification will be sent to the email address associated with your account and the effective date at the top of the page will be updated. Continued use of the platform after a change constitutes acceptance of the updated policy.

12. Contact & Complaints

For questions or requests regarding our privacy policy:

Email: privacy@calenfox.com

If you reside in the EU, you may lodge a complaint with the competent DPA. If you reside in Turkey, you may apply to KVKK (kvkk.gov.tr).