Privacy Policy

Last updated: September 26, 2026 · Türkçe

This policy explains how Esnafhan, developed and operated by BydySoft, processes personal data across its services: the management panel (app.esnafhan.com), mobile apps, WhatsApp and web chat bots, Esnafhan Semtim, QR Menu, point-of-sale and clinic software, and the esnafhan.com website. It is prepared under the Turkish Personal Data Protection Law No. 6698 (KVKK). In case of conflict, the Turkish version prevails.

1. Who is the data controller?

For businesses (our customers): Esnafhan is the controller of the business account data and of the data collected on Esnafhan's own website.

For the customers, employees and couriers of a business: A business uses Esnafhan to process data about its own customers, employees or people who message it. That business is the controller; Esnafhan acts only as a processor on the business's behalf and instructions. For example, when you message a business's WhatsApp number, that business receives your message; Esnafhan stores it for the business and runs the business's bot.

For Esnafhan Courier users: Courier accounts are opened directly with Esnafhan, so Esnafhan is the controller of courier account and location data.

2. What data do we process?

  • Account and business details: name, e-mail, phone, business name and address, user roles, a one-way hash of the password.
  • Data entered by the business: products and prices, orders, customer name/phone/address, cash transactions and invoices, employee records (attendance, timesheets, payroll), clinic records. The business enters and manages this data.
  • WhatsApp data: When a business connects its WhatsApp number through Meta's signup window: the WhatsApp Business Account ID, phone number ID, display number, the business name on Meta and the access token issued by Meta. For people who message the business: phone number, message content, message time and delivery/read status. If the business keeps using the WhatsApp Business app on its phone with the same number, messages it sends to customers from that app are also recorded (so that the bot does not reply to that customer at the same time). Phone contacts and chat history from before the connection are not imported into Esnafhan.
  • Web chat and website visitors: messages typed into the chat window and a random visitor ID generated in the browser; visit statistics for the website and store pages.
  • Location: a one-time location at employee check-in/out to verify the workplace; the courier's location while the Esnafhan Courier app is open, for deliveries; in Esnafhan Semtim, location only when you tap "near me", to find nearby businesses.
  • Technical logs: IP address, browser details, error logs and security audit logs (who viewed/changed which record and when).
  • Payments: Card details are not stored by Esnafhan. The business pays WhatsApp messaging fees directly to Meta.

3. Why do we use the data?

  • To provide the service: orders, cash, staff and payroll calculations, store and menu pages.
  • To let the business's WhatsApp and web chat bot answer customers, take orders and send notifications approved by the business (e.g. appointment reminders).
  • For AI features: understanding messages, suggesting products, extracting entries from receipts or documents. AI processing only runs for features the business has enabled.
  • Account security, abuse prevention, debugging and technical support.
  • Account e-mails (welcome, e-mail verification, password reset, trial reminders).
  • Compliance with legal obligations.

We do not sell data for advertising and we do not use personal data to train AI models. Messages received via WhatsApp are used only to provide the service of the business they were sent to.

Legal bases (KVKK Art. 5): performance of a contract, legal obligation, legitimate interest (security and service improvement) and explicit consent where required.

4. Who do we share it with?

We share data only as far as needed to provide the service, with the following providers:

  • Meta Platforms (WhatsApp Business Platform): messages to and from the business's WhatsApp number pass through Meta's infrastructure.
  • OpenAI: if AI features are enabled, message text or document content is processed to generate responses. Document reading is off by default.
  • Google: maps and address display, e-mail delivery.
  • OpenRouteService: route distance calculation (coordinates only).
  • Open Food Facts: only the barcode number is sent when looking up a product image.
  • Hosting and backup providers.

Some of these providers have servers outside Türkiye; such transfers are made in line with KVKK Art. 9. We do not share data with other third parties except when required by competent public authorities.

5. How long do we keep it?

  • Account and business data are kept while the account is open.
  • Businesses can set how many days chat bot conversations are kept; when that period ends, conversations are permanently deleted.
  • For WhatsApp notification messages, the recipient's phone number and message parameters are deleted 7 days after the message's final status.
  • When an account is closed, its data is deleted or anonymised within 90 days, except where the law requires retention.

6. Security

All connections are encrypted (HTTPS). Secrets such as Meta access tokens and AI keys are stored encrypted in the database and are never shown on screen again. Each business sees only its own data, and access to sensitive records is logged. In the clinic software, health data stays on the clinic's own computer, encrypted field by field.

7. Deleting your data

  • Businesses: You can disconnect WhatsApp at any time from WhatsApp Connection in the panel ("Remove"); this also ends Esnafhan's access to your WhatsApp account. To delete your account and all your data, write to soner.eren@bydysoft.com.
  • If you messaged a business via WhatsApp or chat: that business is the controller of your data, so please contact the business first. You can also write to soner.eren@bydysoft.com with the business name and your phone number; we will forward your request to the business and delete the records with its approval.
  • Requests are completed within 30 days at the latest.

8. Your rights

Under KVKK Art. 11 you have the right to learn whether your data is processed, request information about it, learn the purpose of processing and the recipients, request correction, deletion or destruction, object to a result against you produced solely by automated analysis, and claim compensation for damages.

9. Cookies

The panel uses essential cookies to keep you signed in. On store pages, advertising measurement tools (e.g. the Meta pixel) run only if the business has enabled them and after you give cookie consent.

10. Children

Esnafhan is a service for businesses; it is not intended for anyone under 18.

11. Changes

If this policy changes, the current version is published on this page and the date above is updated. We notify businesses of material changes by e-mail.

12. Contact

BYDY Bilişim Ticaret Ltd. Şti. (Esnafhan) · Sinanoba Mah. Ertekin Cad. A1-002 Apt. No:1 B4, Büyükçekmece / İstanbul
E-mail: soner.eren@bydysoft.com
Phone: +90 532 380 73 95