← BookVoya

Data Processing Terms

Last updated: 2026-10-13 · Version 2026-09-10

These terms apply whenever you use BookVoya to handle personal data belonging to your clients. They form part of the Terms of Service and take effect automatically when you create an account — you do not need to sign a separate document, though we will sign a countersigned copy on request.

1. Who is who

Two different relationships exist inside one product, and they must not be confused:

• Your clients' data — you are the controller, we are the processor. When someone submits a booking request on your public page or sends a direct message to, or comments on a post of, your connected Instagram account, that person's data belongs to your relationship with them. You decide why it is collected and what happens to it. We process it on your instructions, to run the features you use.
• Your own account data — we are the controller. Your name, email, login and settings are processed by us to provide and bill for the service, as described in the Privacy Policy and the KVKK Aydınlatma Metni.

2. Scope of the processing

3. Our obligations

• Instructions only. We process your clients' data only to provide the service and only on your documented instructions — your use of the features is that instruction. We will not use it for our own purposes, and we will never sell it, share it with advertisers or data brokers, or use it to train an AI model.
• Confidentiality. Anyone with access is bound by confidentiality. Today that access is limited to the operator named above.
• Security. The measures in section 4.
• Assistance. We help you respond to access, correction, deletion and objection requests from your clients, and with data protection impact assessments, insofar as the data sits in our systems.
• Breach notification. If we become aware of a personal data breach affecting your clients' data, we notify you without undue delay and in any case within 72 hours, with what we know, what we are doing, and what you may need to report.
• Deletion or return. On termination, section 8.
• Audit. On reasonable written request, and no more than once a year unless a regulator requires otherwise, we will answer your questions about these measures in writing and provide the evidence we hold.

4. Security measures

These are the measures actually in place, not aspirations:

• All traffic is served over HTTPS with certificates renewed automatically.
• Passwords are stored only as salted hashes; we cannot read them.
• Instagram access tokens are encrypted at rest with AES-256-GCM and are never displayed in plain text.
• Every request is scoped to one artist's workspace and checked server-side, so one artist cannot read another's clients, messages, or finances — including studio owners, who see a member's finances only with that member's explicit opt-in.
• Uploaded images are re-encoded on receipt, so the original file's embedded metadata is not retained or served.
• The database and uploaded files are backed up daily, with 14 rolling copies kept on restricted-permission storage.
• Credentials and secrets live only in a root-owned environment file on the server; none are in source code.
• Features that could send messages, take payments, or post on your behalf are off by default and fail closed when not configured.

5. Subprocessors

You give general authorisation for us to use the subprocessors listed at bookvoya.com/subprocessors. That page names each provider, its role, and whether it is conditional on a feature being switched on. We remain responsible to you for what they do.

If we intend to add or replace a subprocessor that can reach your clients' data, we will update that page beforehand. If you object on reasonable data protection grounds, tell us at privacy@bookvoya.com; if we cannot offer an alternative, you may terminate the affected part of the service and receive a pro-rata refund of any prepaid fees.

6. International transfers

Our servers are in Germany. If you are established in Türkiye, this is a transfer abroad under Article 9 of the KVKK, made on the basis that it is necessary to perform the contract with you and, where required, your explicit consent. Transfers to any provider outside Türkiye or the EEA are made under appropriate safeguards, such as standard contractual clauses.

7. Your obligations

• You must have a lawful basis for collecting your clients' data and for putting it into BookVoya.
• You must give your clients the information their own privacy notice requires — including that a booking tool is used to handle their request.
• If you switch on AI-assisted drafting, you are deciding that your clients' message content may be processed to generate a draft. Do not enable it if that is incompatible with what you told your clients.
• You are responsible for keeping your login credentials secure and for who you invite into your workspace.

8. Deletion

• Disconnecting an Instagram account deletes the stored access token immediately.
• Deleting your account deletes your workspace, your clients' records, and your uploaded files within 30 days, including from active systems.
• Backups are rotated on a 14-copy cycle, so deleted data leaves backups within that cycle. We do not restore deleted data from a backup except to recover from a failure.
• We keep only what law requires us to keep — principally invoice and accounting records, for five years, where a payment was made.
• You can export your data before deleting; ask at privacy@bookvoya.com if the in-app export does not cover what you need.

9. Liability and changes

Liability under these terms is subject to the limitations in the Terms of Service. Nothing here limits a data subject's rights or a supervisory authority's powers. If we change these terms in a way that materially affects your rights, we will publish the new version and give notice; continuing to use the service after that constitutes acceptance.