Privacy Policy

1. Scope and our role

Reeped is a B2B SaaS platform that provides in-store sales, campaign and customer relationship software to retail businesses ("Merchants"). Our role depends on whose data is concerned:

• As a data controller: we process the data of website visitors, demo requesters, Merchant representatives and dashboard users, as well as device and session data of the mobile app, for our own purposes.
• As a data processor: data of shoppers at Merchants' stores ("Store Customers") and Merchant staff is processed on behalf of, and under the instructions of, the relevant Merchant, who is the data controller. Store Customers should primarily exercise their rights with the store; Reeped assists the Merchant in fulfilling such requests.

2. What personal data we process

a) Website visitors and demo requests

• Demo form: first and last name, work e-mail, phone, company, number of stores, industry, current system and an optional message.
• Technical data: IP address, browser type and access time (in server logs, for security and abuse prevention).
• Strictly necessary cookies: language, currency and cookie-notice preferences (see the Cookies section).

b) Merchant representatives and dashboard users

• Identity and contact: name, e-mail, phone.
• Account: password (stored only as an irreversible hash), role and permissions, last sign-in time and IP address.
• Business details: legal name, tax office and number, billing address, store address and contact details, logo.
• Billing payment method: card brand, last 4 digits and expiry only. Full card numbers and security codes are never stored by Reeped.
• Integration settings: connection details for the ERP (Logo, Nebim, Akinon, etc.) and WhatsApp channel connected by the Merchant.

c) Store staff (cashiers and store managers)

• Name, role and assigned store.
• 4-digit POS PIN (stored only as a hash).
• Records of sales, refunds and campaign actions performed by the staff member.

d) Store Customers (on behalf of the Merchant)

• Phone number: recorded only if the customer shares it at checkout and the cashier marks the customer's consent in the app.
• Purchase data: products, amounts, date, store and applied campaigns.
• For online orders or in-store pickup: name, delivery address and order notes.
• Campaign interactions: whether an offer link was opened, reserved or purchased.
• Payments: in-store card payments are taken on the Merchant's own POS terminal; Reeped neither sees nor stores card data. Online card payments are processed directly by a licensed payment institution.

e) Reeped POS mobile app — device data

• A random device identifier (UUID) generated by the app and a device pairing key.
• Device model, operating system version and platform; last-seen time of the device.
• When offline, sales are kept in a local database on the device and uploaded once a connection is available.
• Session keys are stored in the device's secure storage (Android Keystore / iOS Keychain).

3. Mobile app permissions

The Reeped POS app only uses the following permissions:

• Camera: only to scan product barcodes and the device pairing QR code. Camera images are not recorded, stored or sent to our servers; only the decoded barcode/QR value is processed.
• Internet and network state: to communicate with our servers and sync offline sales.
• Vibration: haptic feedback during PIN entry and barcode scanning.

The app does not access the microphone, location, contacts, photo library, SMS or call logs; it does not use the advertising ID and contains no ads or third-party analytics/tracking SDKs.

4. Why we process personal data

• Providing the Services: account creation, authentication, device pairing, POS sales, refunds, stock and product management.
• Synchronising product, stock and sales data with ERP systems connected by the Merchant.
• Running the Merchant's campaign rules and showing product suggestions at checkout.
• With the customer's consent, sending campaign or order links via WhatsApp; handling online orders, in-store pickup and e-invoice/e-archive processes.
• Providing the Merchant with sales, campaign performance and customer analytics reports.
• Responding to demo requests and communicating with Merchants.
• Billing subscription fees.
• Ensuring information security, preventing abuse and fraud, and fixing errors.
• Complying with legal obligations and requests from competent authorities.

5. Legal bases

We process personal data on the following legal bases under Article 5 of the KVKK:

• Performance of a contract (Art. 5/2-c): accounts, subscriptions, sales and orders.
• Compliance with a legal obligation (Art. 5/2-ç): invoicing, tax and commercial record-keeping laws.
• Establishment, exercise or defence of legal claims (Art. 5/2-e).
• Legitimate interests (Art. 5/2-f): information security, service quality measurement, responding to demo requests.
• Explicit consent (Art. 5/1): personalised suggestions for Store Customers and campaign messages via WhatsApp. Commercial electronic messages are sent in line with Law No. 6563; consent can be withdrawn at any time.

6. AI-assisted suggestions and profiling

Where enabled by the Merchant and consented to by the Store Customer, Google's Gemini AI service is used to generate basket-relevant product suggestions at checkout and to predict a customer's likely next need.

• Only the current basket, the store catalogue and a product/category/amount summary of recent purchases are sent to the AI service.
• The customer's phone number, name, address or contact details are never sent to the AI service.
• Suggestions are shown to the cashier as recommendations only; no automated decision producing legal or similarly significant effects is made about the customer.
• Under Art. 11/1-g of the KVKK, you may object to an outcome against you arising from analysis by automated systems.

7. Sharing of personal data

We do not sell or rent personal data and do not share it with third parties for advertising. Data is shared only as necessary to provide the Services, with the following categories of recipients:

• Infrastructure and hosting: server and database providers (e.g. MongoDB Atlas).
• AI: Google (Gemini API) — only the anonymous purchase summary described in Section 6.
• Messaging: Meta Platforms (WhatsApp Business) or the WhatsApp account connected by the Merchant — phone number and message content for consented campaign/order messages.
• E-mail: an e-mail delivery provider (e.g. Resend) for transactional and notification e-mails.
• Integrations chosen by the Merchant: ERP providers (Logo, Nebim, Akinon, etc.), e-invoice integrator, payment institution and shipping company.
• The relevant Merchant: Store Customer and staff data is made available in the dashboard of the Merchant acting as data controller.
• Competent public authorities: upon lawful request and to the extent required by law.

Our service providers process data only on our instructions and under confidentiality obligations.

8. International transfers

Some of our hosting, AI, messaging and e-mail providers may operate servers outside Türkiye. Such transfers are carried out in accordance with Article 9 of the KVKK, relying on the standard contractual clauses published by the Personal Data Protection Board or other appropriate safeguards provided by law, and standard contracts are notified to the Authority within the statutory period.

9. Retention periods

• Merchant account and dashboard user data: for the term of the contract and the applicable statutory limitation periods thereafter.
• Sales, invoice and accounting records: 10 years under Turkish tax and commercial laws.
• Store Customer phone number and purchase history: for the term of the Merchant's contract or until the customer requests deletion or withdraws consent. Sales records that must be retained by law are kept with restricted access for that period.
• Campaign offer links: deactivated once the offer expires.
• Demo requests: up to 2 years after the request is closed.
• Security and access logs: up to 2 years under Law No. 5651 and our legitimate interests.
• Local data in the mobile app: offline sales are removed from the device once uploaded; the product catalogue cache is refreshed on every sync. Unpairing the device deletes its session keys; uninstalling the app removes all local data from the device.

Data whose retention period has expired is deleted, destroyed or anonymised.

10. Security

• All communication between the app, the dashboard and our servers is encrypted with TLS (HTTPS).
• Passwords and PINs are stored as irreversible hashes (bcrypt).
• ERP connection credentials are stored encrypted with AES-256; on mobile devices session keys are kept in the operating system's secure storage.
• Access is restricted with role-based permissions; each Merchant can only access its own data.
• Sign-in attempts are rate-limited and suspicious activity is logged.
• Card data is never stored on Reeped systems.

11. Cookies

reeped.com only uses cookies that are strictly necessary for the site to work:

• NEXT_LOCALE — remembers your language (for the browser session).
• user_currency — remembers the currency used to display prices (1 year).
• cookie_consent_accepted — remembers that you have seen the cookie notice (1 year).

The merchant dashboard (live.reeped.com) uses HttpOnly session cookies to keep you securely signed in. No advertising, retargeting or third-party analytics cookies are used. You can delete cookies in your browser settings; your preferences will be reset and you will need to sign in to the dashboard again. The full list of cookies is available in our Cookie Policy.

12. Your rights under the KVKK

Under Article 11 of the KVKK you have the right to learn whether your personal data is processed and request information about it; learn the purpose of processing and whether it is used accordingly; know the third parties to whom it is transferred in Türkiye or abroad; request rectification of incomplete or inaccurate data and its erasure or destruction; request that these actions be notified to third parties to whom data was transferred; object to an outcome against you arising from analysis by automated systems; and claim compensation for damages arising from unlawful processing.

You can send your requests to gethelp@reeped.com from your registered e-mail address or in writing. Requests are concluded free of charge within 30 days at the latest. If your request is rejected or you find the response insufficient, you may lodge a complaint with the Personal Data Protection Board.

If you are a Store Customer, the store where you shopped is the controller of your data; you may contact the store or send your request to us. We forward such requests to the relevant Merchant and help fulfil them.

13. Account and data deletion

Merchant account

To delete your Merchant account and associated data, send an e-mail with the subject "Account deletion request" to gethelp@reeped.com from the account owner's e-mail address. After verifying your identity, your account is closed within 30 days; product, campaign, staff and customer data is deleted or anonymised.

Store staff

Staff accounts are created and deleted by the Merchant in the dashboard. To have your account deleted, contact your manager or write to us.

Mobile app device data

Device pairing can be removed from the Merchant dashboard. Uninstalling the app removes all local data and session keys stored on the device.

Store Customers

To delete your phone number and purchase history, contact the store where you shopped or write to gethelp@reeped.com stating the store name and your phone number.

Data we must keep

Data that must be retained by law, such as invoice and sales records, is kept with restricted access for the statutory period and deleted at the end of it.

14. Children's privacy

The Services are intended for businesses and their employees and are not directed to anyone under 18. We do not knowingly collect data from anyone under 18.

15. Changes to this policy

We may update this policy to reflect changes to the Services or the law. The current version is always published on this page, and Merchants are notified of material changes via the dashboard or e-mail.

16. Contact

For any questions about this policy or your personal data, contact us at gethelp@reeped.com.