In short
- Merchifyt is a work app built for businesses' field teams. Your employer creates your account; there is no individual sign-up in the app.
- Your location is recorded only between “Güne Başla” (Start Day) and “Günü Bitir” (End Day). No location is collected while your work day is closed.
- Your records are visible to your employer's authorized administrators; representatives of the brands you serve see only their own brands' work.
- Your employer is the data controller for your data. Merchifyt processes it on the employer's behalf and according to its instructions.
- There are no ads, your data is not sold, and you are not tracked across apps or websites.
- Servers are in Turkey. A limited set of providers outside Turkey are used for error monitoring, notifications, maps and email (see 8 and 9).
1.Scope
This policy covers the Merchifyt iOS and Android app, the Merchifyt admin panel (web) and the Merchifyt web pages that host this policy (together, the “Service”). It also serves as the privacy notice required by article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”).
The Service is provided under a service agreement between Merchifyt and businesses. Your employer may also need to give you its own privacy notice; this policy complements it and does not replace it.
2.Definitions
- Service
- The Merchifyt mobile app, admin panel and the server infrastructure behind them.
- Employer (Customer)
- A business that has an agreement with Merchifyt and uses the Service for its team.
- User
- A person the employer gives access to the Service: a field agent, an administrator or a brand representative.
- Personal data
- Any information relating to an identified or identifiable natural person.
- Data controller
- The party that determines the purposes and means of processing personal data.
- Data processor
- The party that processes personal data on behalf of the controller, under its authority.
- Sub-processor
- An infrastructure or service provider that Merchifyt uses to provide the Service and that processes data on its behalf.
3.Controller and processor
Merchifyt as a processor
You use the Service as an employee or representative of an employer. For the data processed through the Service (account, location, visit, photo, message and work records), your employer is the data controller. Merchifyt processes this data only to provide the Service, according to the employer's instructions and the service agreement; it does not use it for its own purposes, sell it, or share it for any other purpose.
Merchifyt as a controller
Merchifyt is the data controller for the following limited data:
- Support requests and correspondence sent to support@merchifyt.me,
- Contact details of the employer's representatives in connection with the service agreement,
- Security and diagnostic records kept to secure the Service, prevent misuse and fix errors.
4.Personal data we process
| Category | Data | How and when |
|---|---|---|
| Account and identity | Full name, email address, role, user ID, the business you belong to; phone number and vehicle plate if entered by your employer. | When your employer creates or updates your account in the admin panel. |
| Location | Precise location and its accuracy, time of recording; store check-in and check-out location and distance to the store; distance travelled during the day. | Only while your work day is open (see section 5). |
| Photos | Shelf, display, price tag, order and odometer photos and the time they were taken. | Only when you take them with the app's own camera. Your photo library is not accessed. |
| Work records | Visits, brand results, notes, quantities, mileage, skip reasons, approval requests and tasks. | When you enter them in the app. |
| Messages | In-app messages and replies with users in the same business; records of messages reported as inappropriate. | When you send a message or report one. |
| Device and app | Push token, device model, operating system and version, app version, language. | To send notifications and fix errors, while you use the app. |
| Diagnostics | Crash and error reports, error logs, screen transitions and taps before an error, app launch time. In the mobile app, only if Profil → “Kullanım Verisi” (Profile → Usage Data) is on (default: off): performance measurements and a screen recording of the moment of an error, with text and images masked. In the admin panel: error reports, sampled performance measurements and a masked screen recording of the moment of an error. | Automatically, when an error occurs or the app launches. |
| Security and access records | IP address, sign-in and session times, session identifiers; an audit log of which action was performed by whom and when. | On each access to the Service and for recorded actions. |
| Support | The topic and description in the “Sorun Bildir” (Report a problem) form; support correspondence by email. | When you send a support request. |
Data we do not process: advertising identifiers (IDFA/AAID), cross-app or cross-site tracking data, contacts, microphone or audio recordings, your photo library, health data and other special categories of personal data. No payment information is collected in the Service.
5.Location data
Location is needed to verify and plan field work and is deliberately limited to the work day.
- When: Only from the moment you tap “Güne Başla” (Start Day) until you tap “Günü Bitir” (End Day). No location is collected while your work day is closed.
- How: At regular intervals while the app is open; also while the app is closed if you granted “Always” permission. While location is being recorded, Android shows a “Merchifyt aktif” (Merchifyt active) notification and iOS shows location use in the status bar.
- Store check-in: Your location at check-in is compared with the store's saved location; check-in must happen within 200 m of the store. The measured distance is written to the visit record. Check-in is not possible if your phone shares only approximate location, or (on Android) if a mock location app is detected.
- Who sees it: Your employer's authorized administrators can see your route and location while your day is open. Brand representatives do not see your live location by default; this access can be granted only explicitly by your employer.
- Retention: Raw location records are deleted automatically after 90 days. Store check-in and check-out locations are kept with the visit record (section 10).
You can change the location permission in your phone's settings at any time; however, work-day and store check-in features do not work without location.
6.Purposes and legal bases
| Purpose | Data involved | Legal basis (KVKK) |
|---|---|---|
| Providing the Service: account and session, daily route and distance travelled, visits, photos, messaging, approval and task flows | Account, location, photos, work records, messages, device | Establishment and performance of a contract (art. 5/2-c); the employer's legitimate interest (art. 5/2-f) |
| Verifying that visits happen at the store and preventing fake visits | Location, work records | Legitimate interest (art. 5/2-f) |
| Sending notifications | Push token, account | Performance of a contract (art. 5/2-c) |
| Responding to support requests | Support, account, device, diagnostics | Legitimate interest (art. 5/2-f) |
| Security, preventing unauthorized access and misuse, audit logging | Security and access records, account | Legitimate interest (art. 5/2-f); data security obligation (art. 12) |
| Detecting errors and keeping the Service running | Diagnostics, device, user ID | Legitimate interest (art. 5/2-f) |
| Mobile performance measurements and error screen recording | Diagnostics | Explicit consent (art. 5/1); can be withdrawn at any time in Profil → “Kullanım Verisi” (Profile → Usage Data) |
| Legal obligations and disputes | All relevant data | Required by law, legal obligation, establishing, exercising or protecting a right (art. 5/2-a, ç, e) |
Where Merchifyt acts as a processor, the legal basis is determined by the employer as the controller; the bases above are those typically relied on for this use.
7.Who can access the data
- Your employer's authorized administrators: see your route, location, visits, photos and messages in the admin panel, to the extent of the permissions given to their role.
- Representatives of the brands you serve (brand managers): see only visit results, photos and related store information for their own brands.
- Other businesses: The Service separates businesses from each other; users of one business cannot access another business's data.
- Merchifyt: only authorized persons, only as needed for support, maintenance and security, and under confidentiality obligations.
- Sub-processors: the providers in section 8, only to the data needed for the service they provide.
- Competent public authorities: only when legally required and only to the extent necessary.
If Merchifyt's business is transferred to another organization, the data will be transferred together with the safeguards in this policy, and this will be announced in advance.
8.Sub-processors and third parties
| Provider | Service | Data processed | Location |
|---|---|---|---|
| Server infrastructure | Application servers, database, file storage and backups | All Service data | Turkey |
| Functional Software, Inc. (Sentry) | Error, crash and performance monitoring | Diagnostics, user ID, device information, masked screen recordings | EU data region (Germany) |
| Google LLC (Firebase Cloud Messaging) | Notification delivery | Push token, notification content | United States and global |
| Apple Inc. (Apple Push Notification service) | iOS notification delivery | Push token, notification content | United States and global |
| Mapbox, Inc. | Map imagery; map improvement data | IP address and the area being viewed during map requests. The Mapbox map library also sends Mapbox location and usage data that is not linked to your identity, to improve its maps; you can turn this off with the Profil → “Harita İyileştirme” (Profile → Map Improvement) switch or the ⓘ icon on the map. | United States |
| 650 Industries, Inc. (Expo) | Measuring app launch performance | Launch times, device model, operating system and app version | United States |
| Google (Google Workspace) | Support email (support@merchifyt.me) | When you write to us: name, email address, message content and attachments | United States and global |
Google Maps: Not a sub-processor. When you tap “Google Haritalar'da aç” (Open in Google Maps) in the app, the store's coordinates are sent to Google Maps; from then on Google's own privacy policy applies.
Sub-processors are bound by contractual obligations no less protective than this policy. This page is updated when the list changes.
9.International transfers
Service data is hosted on servers in Turkey; no data is transferred abroad for hosting. Your location records, photos and visit records are not sent abroad (except Mapbox's map improvement data, which is not linked to your identity). Only the limited data listed in section 8 is transferred to providers located outside Turkey (Sentry, Google, Apple, Mapbox, Expo).
These transfers are based on the conditions and appropriate safeguards set out in KVKK article 9. Data processing agreements with the providers ensure that data is processed only to provide the relevant service and is protected.
Transferred data is minimized: error and performance records identify you only by a user number, never by your name or email address; text and images are masked in screen recordings; map improvement data is not linked to your identity and can be turned off.
10.Retention
| Data | Retention period |
|---|---|
| Raw location records | 90 days; deleted automatically when the period ends. |
| Visit, photo and work records and messages | As the employer's operational records, for as long as the service relationship with the employer continues. When it ends, they are deleted or handed over to the employer according to its instructions. |
| Account information | While the account is open. It is deleted when the account is closed; records in the employer's operational history that mention you follow the period above. |
| Session information | Access tokens 15 minutes; session renewal information at most 14 days (30 days if “Beni hatırla” (Remember me) was selected). |
| Diagnostic records (Sentry) | At most 90 days. |
| Security and audit records | As long as needed for security, detecting misuse and legal obligations. |
| Support correspondence | A reasonable period after the request is resolved, for follow-up requests and legal obligations. |
| Backups | Database backups are kept on a rolling 30-day basis. Photos deleted from the system are also removed from backups after 30 days. Backups are used only for disaster recovery and access to them is restricted. |
When these periods end, data is deleted, destroyed or anonymized. Anonymized statistics (for example, total visit counts) may be kept without being linked to any person.
11.Security
Technical and organizational measures are applied to protect data against unauthorized access, loss and alteration:
- All communication uses encrypted connections (TLS 1.2 or later); the admin panel opens only over HTTPS.
- Servers are protected by a firewall; administrative access is key-based only and password sign-in is disabled. Security updates are applied automatically.
- The database is not reachable from the internet; the application connects to it with a separate user that has only the permissions it needs.
- Passwords are stored irreversibly (bcrypt). Access tokens are short-lived; session renewal information is rotated on every use and theft attempts are detected.
- In the mobile app, session information is kept in the phone's secure storage (iOS Keychain, Android Keystore).
- Access is restricted by role and by business; businesses' data is kept separate. Photos can be accessed only with an authorized session.
- Important actions are written to a chained audit log in which later changes would be detectable.
- Rate limiting and abuse protection are applied; the system is monitored continuously and backed up daily.
Breach notification: If we learn that your data has been accessed without authorization, we inform the employer without undue delay. Where required under KVKK article 12/5, the Personal Data Protection Board and the affected persons are notified as soon as possible.
No system is completely secure. Protecting your phone and password, and not sharing your password with anyone, is also part of security.
13.Your permissions and choices
| What | How to change it |
|---|---|
| Location recording | Stops when you tap “Günü Bitir” (End Day). You can change the location permission in your phone's Settings → Merchifyt → Location (work-day features do not work without location). |
| Camera | Settings → Merchifyt → Camera. |
| Notifications | In the app, Profil → “Bildirimler” (Profile → Notifications), or your phone's notification settings. |
| Performance data and error screen recording | Turn off Profil → “Kullanım Verisi” (Profile → Usage Data) (default: off). |
| Mapbox map improvement data | Turn off Profil → “Harita İyileştirme” (Profile → Map Improvement). |
| Remembered email in the admin panel | Leave “Beni hatırla” (Remember me) unchecked at sign-in, or clear the site data in your browser. |
14.Your rights
Under KVKK article 11 you have the right to:
- Learn whether your personal data is processed,
- Request information if it has been processed,
- Learn the purpose of processing and whether it is used accordingly,
- Know the third parties in Turkey or abroad to whom it is transferred,
- Request correction if it is incomplete or inaccurate,
- Request deletion or destruction under the conditions in KVKK article 7,
- Request that the actions under (e) and (f) be notified to third parties it was transferred to,
- Object to a result against you arising solely from automated analysis,
- Claim compensation if you suffer damage from unlawful processing.
How to apply
Send your request to support@merchifyt.me with the subject “KVKK Request”. Include your full name, the business you belong to, your request and contact details where we can reach you; we may ask for additional information to verify your identity. Requests are answered free of charge within 30 days at the latest.
Because your employer is the data controller for your data, you can also apply directly to your employer. We forward requests that require the employer's decision without delay and provide the support needed to respond.
If your request is rejected, you find the response insufficient, or it is not answered in time, you may file a complaint with the Turkish Personal Data Protection Board under KVKK article 14.
Users in the European Economic Area
If you use the Service in the European Economic Area and the General Data Protection Regulation (GDPR) applies, you have the rights of access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with a competent supervisory authority. Requests go to the same address.
15.Account and data deletion
Merchifyt accounts are created and closed from your employer's admin panel; there is no sign-up or account deletion button in the app. You can ask your employer's administrator, or write to support@merchifyt.me, to delete your account.
When your account is deleted, your session information, device push records, personal notification inbox and raw location records are deleted. Visit, photo and approval records are the employer's operational records and are kept for the period in section 10.
16.Automated checks
At store check-in the Service makes two automated checks: whether check-in happens within 200 m of the store and (on Android) whether a mock location app is in use. These checks only determine whether the check-in is accepted; the Service makes no other automated decision that produces legal effects or similarly significantly affects you. If you believe a check gave a wrong result, you can contact your employer or us.
17.Children
The Service is intended only for employees whose accounts are created by their employers; it is not directed at anyone under 18 and we do not knowingly process the data of anyone under 18.
18.Changes
We may update this policy to reflect changes in the Service or in the law. When we do, the “Last updated” date changes; significant changes are announced in the app or the admin panel.
19.Contact
For any question about this policy or your personal data: support@merchifyt.me. You can also write from inside the app: Profil → “Sorun Bildir” (Profile → Report a problem).