Privacy Policy

1. Scope

Rezerfit is software that studios (pilates, therapy, fitness) use to run classes, packages, attendance, payments and client messaging. It is provided by Idyma Teknoloji Danışmanlık Ltd. Şti. ("Rezerfit", "we"). This policy covers studio staff, studio clients and users of the Rezerfit mobile app.

2. Roles

For client data, the studio the client belongs to is the data controller; Rezerfit processes that data on the studio's behalf and instructions (processor).

Rezerfit is the controller for studio staff account data and for technical records kept to secure the service.

3. Data we process

• Identity and contact: first and last name, email, phone number, date of birth (optional).
• Studio service: packages and remaining credits, bookings, attendance, credit changes with reasons, payment records (amount, method, date). We do not process card details.
• Health-related data entered by the studio: body measurements and coach session notes (exercises, pain, progress). The studio must obtain the client's explicit consent before entering them.
• Messages the studio sends to clients and their delivery status; messages a client writes to the studio's WhatsApp number (text only; photos, audio and other files are not downloaded, only their type is recorded).
• Other service records: waitlist positions and offers, home-exercise programmes and "done today" ticks, bookings and cancellations the client makes in the app.
• Technical: session tokens, error and security logs, QR check-in records, the device push token Apple issues for notifications, and the IP address and a one-way hash of the email used to rate-limit sign-in attempts.

We do not collect location, contacts or advertising identifiers, and the apps contain no ads or third-party trackers.

4. Why we process it

• To deliver the studio's service: scheduling, check-in, credit tracking, makeup and no-show rules.
• To send service notifications: check-in, class reminders, makeup, package expiry.
• Birthday, holiday and campaign messages only within the consent the studio has collected.
• Health-related data only with the client's explicit consent, to track progress.
• Security, troubleshooting and legal obligations.

5. Sharing

• Hosting: Fly.io (servers and database, EU — Frankfurt) and Vercel (studio web desk).
• Email provider for account invitations and password resets.
• WhatsApp: when a studio connects WhatsApp, messages are sent through the studio's own WhatsApp Business account on Meta Platforms' WhatsApp Business Platform; the recipient's phone number and the message content are shared with Meta for delivery.
• Apple and Google for app distribution and device notifications. Notifications are sent through Apple Push Notification service (APNs), which receives the device push token and the notification text.

We do not sell personal data or use it for advertising.

6. Retention

Data is kept while the studio uses Rezerfit. When a studio leaves or asks for deletion, data is deleted or anonymised, subject to legal retention periods. Credit and payment movements are kept as an append-only record so disputes can be resolved. Messages clients send on WhatsApp are deleted automatically after 12 months. Expired session records and sign-in rate-limit counters are purged regularly; push tokens are deleted when Apple reports them invalid.

7. Your rights

Under Turkish data protection law (KVKK art. 11) and, where applicable, the GDPR, you may request access, correction, deletion or objection. Clients may contact their studio first; you can also write to dasgin@idyma.tech.

8. Data deletion

You can delete your account inside the app: Profile → "Delete my account" (coaches and studio owners: at the bottom of the home screen). Once you confirm with your password the deletion happens immediately and you are signed out on every device. Steps and details are on the Account deletion page (/account-deletion).

• Deleted immediately: name, email, phone, date of birth, password and sessions; body measurements, session notes and home-exercise programmes; in-app messages, notifications and WhatsApp chats with the studio; waitlist places. Upcoming bookings are cancelled.
• Kept anonymised: packages, credit movements, receivables, payments and past attendance are the studio's append-only accounting records and subject to legal retention, so they are not deleted; the link to you is removed and the studio only sees "Deleted account".
• The deletion itself is logged with who did it and when, without personal data. A deleted account cannot be restored.

If you cannot open the app, email dasgin@idyma.tech from the address on your account and name your studio; after verifying the request we delete the account the same way within 30 days. The studio owner can also delete your account from the studio desk at your request. You can turn off app notifications at any time in your device settings.

9. Security

Connections use HTTPS, passwords are stored as one-way hashes, studios' WhatsApp access tokens are stored encrypted (AES-256-GCM) and never shown again, and each studio's data is isolated. Within a studio, only owners see financial information; coaches can access only clients who attend their sessions or are assigned to them. Sign-in attempts are rate-limited, and sessions are revoked on the server at sign-out or password change.

10. Requests from public authorities

• We review every request from a public authority for its legal basis and for whether it comes from a competent authority, and we do not respond to requests without one.
• We use the available legal remedies to challenge requests we consider unlawful.
• We disclose only the minimum data needed to comply.
• We document each request, including the authority, its legal basis, our response, the legal reasoning and the people involved.

Unless legally prohibited, we inform the studio whose data is requested.

11. Contact and changes

Idyma Teknoloji Danışmanlık Ltd. Şti., Zeytinalanı Mah. Tepeler 13 Sokak No:1A, 48800 Köyceğiz / Muğla, Türkiye. Tax office / number: Köyceğiz / 4651613041. Phone: +90 532 740 34 17. Email: dasgin@idyma.tech.

We may update this policy and will announce material changes in the app or the studio desk.