Privacy Policy

This Privacy Policy explains how your personal data is handled when you use the ProfesaGo iOS app (the “App”) and the profesago.com website. Users in Türkiye can find the notice under Law No. 6698 (KVKK) on the Turkish version of this page.

In short

• Your business details, customers and quotes are stored on your phone. Quotes are put together on your phone; this data is not uploaded to our servers.
• Our server holds your sign-in record, your subscription and purchase records, and a count of the AI logos you have generated. It is located in EU — Frankfurt, Germany (AWS eu-central-1).
• AI is used only when you ask the App to draw a logo: then, after you agree, your business name, trades and logo description are sent to OpenAI.
• The App sends crash and performance reports to Sentry (EU) without your name, email or account identifier.
• You can delete your account in the App: Settings → Delete account.
• We show no ads, do not track you across apps or websites, and do not sell your data.

1. Controller

The controller of your personal data, under the GDPR and under Turkish law no. 6698 (KVKK), isATC GRUP OTOMOTİV AKARYAKIT İNŞAAT GIDA İTHALAT İHRACAT VE SANAYİ LİMİTED ŞİRKETİ (“ATC GRUP LTD. ŞTİ.”), a limited liability company registered in the Republic of Türkiye, which provides the ProfesaGo app and the profesago.com website (“ProfesaGo”, “we”). For any privacy request, contact info@profesago.com. The full company details are on the About page.

2. What we process and why

2.1 Account and sign-in data

We use Supabase authentication to sign you in and manage your session. Depending on how you use the App, our server holds:

• Email sign-in: your email address. We sign you in with a one-time code that is emailed to you through our email delivery provider (Resend).
• Sign in with Apple: the account identifier Apple provides and the email address Apple shares (Apple’s relay address if you chose “Hide My Email”). The App does not ask Apple for your name.
• Sign in with Google: your Google account identifier, your email address and, as far as Google shares them, your name and profile picture link.
• Continue as guest: the App creates a guest account with only a randomly generated identifier — no email or name — so that features that need our server, such as address suggestions, work.

We also keep when your account was created and when you last signed in. Session keys are stored on your phone. Purpose: to create your account, verify your sign-in and provide the service.

2.2 Business and quote data — on your phone only

The business name, trade(s), phone, address, email, tax number (for a sole trader this can be a national ID number), logo, signature, tax and payment settings you enter; the customer names, phone numbers and addresses, vehicle details, job descriptions, line items and prices you add to quotes; and the PDF files you create are storedonly in the App’s storage on your phone. The App puts each quote together on your phone; we do not receive or store this data and do not sync it between devices. Only the pieces described in 2.3 and 2.4 leave your phone, and only when you use those features. A PDF you share goes only to the app and the recipient you choose. Deleting the App, “Reset app” or “Delete account” deletes this data. One exception: a counter of how many free quotes this device has used is kept in the iPhone Keychain so that reinstalling the App or using “Reset app” does not restore the free quotes. It is a single number, holds no personal data, never leaves your device, and is removed only when you erase the device. If your phone’s own backup (e.g. iCloud Backup) is on, App data may be included in Apple’s backup, which is governed by your terms with Apple.

2.3 AI logo (optional)

If you ask the App to draw a logo with AI, it first tells you that your details will be sent to OpenAI, and nothing is sent unless you agree. Your business name, trade(s) and services line, the logo description and style words you enter and your brand colour are then sent to a function on our server (EU — Frankfurt, Germany (AWS eu-central-1)) and from there to OpenAI’s image API; OpenAI also checks the drawn images for quality using your business name. The images return to your phone; our server does not store your details or the images. AI logos need a signed-in account (not a guest), and our server counts how many logo rounds your account has used to apply the usage limits. Under OpenAI’s API terms, data sent through the API is not used to train models by default and may be retained by OpenAI for up to 30 days for abuse monitoring. You can always upload your own logo instead; nothing is sent to OpenAI then.

2.4 Address suggestions (Google Places)

When you type at least three characters into an address field, the text you typed, a country code, a language code and a random session code are sent through a function on our server to the Google Places API, which returns address suggestions; when you pick one, its place identifier is sent to fetch the full address. The request reaches Google from our server, not from your phone. You can always type the address yourself instead.

2.5 District lists

In some countries, district names are fetched from a public table on our server by country and province name to fill a picker. No personal data is sent with this request. Lists for Türkiye are built into the App.

2.6 Photos

To add a logo, the App uses only the photo you pick. The image stays on your phone and is not uploaded to our server.

2.7 Subscriptions and purchases

Premium is bought through the App Store and Apple processes the payment; we never see your card details. When you buy or restore Premium, the App gives Apple your account’s random identifier with the purchase and sends the purchase confirmation signed by Apple to a function on our server (EU — Frankfurt, Germany (AWS eu-central-1)), which checks it and links the subscription to your account. Apple also informs our server directly about renewals, cancellations, refunds and expiry (App Store Server Notifications). For this our server keeps purchase and subscription records linked to your account: the product (monthly or yearly), the transaction and original transaction IDs, the purchase, renewal and expiry dates, the offer type (for example the free trial), whether auto-renewal is on, the App Store environment, and any refund or revocation date and reason. No name, email or card data is involved. You do not need to create an account to buy or restore Premium: as a guest, your purchase is linked to the random identifier the App uses for you, and if you sign in later it moves to your account. Purpose: to unlock Premium on your account and keep its status correct on your devices.

2.8 Crash and performance reports (Sentry)

The App uses Sentry to find and fix errors. When the App crashes, freezes or hits an error, it sends a report to Sentry’s EU region (Germany): the error and where in the App it happened, the App version and build, the device model and iOS version, and the steps just before the error (screens opened, buttons tapped, requests to our server). The App also reports when a session starts and ends, so we can measure crash-free use, and for a small sample of sessions (about 5%) how long screens and server requests take. Reports do not contain your account identifier, name or email address, and the App removes anything that looks like an email address or phone number from error messages before sending; Sentry may use a random installation identifier that is not linked to your account.

2.9 Technical logs

For requests to our servers, our infrastructure provider keeps short-lived technical logs for security and debugging (IP address, time, request type, app/device information).

2.10 profesago.com

This website sets no cookies and contains no analytics or advertising tools. Our hosting provider (Vercel) keeps standard server logs for security.

3. What we do not do

• We do not show ads or collect data for advertising.
• We do not track you across other companies’ apps and websites and do not access your advertising identifier (IDFA), so the App never asks for tracking permission.
• The App contains no analytics or advertising SDKs; its only diagnostics tool is the crash and performance reporting in 2.8.
• We do not sell or rent your personal data.

4. Service providers and international transfers

Data sent to OpenAI, Google, Apple and Resend is transferred outside Türkiye and the European Economic Area; data processed in the EU (Supabase, Sentry) is transferred outside Türkiye. These transfers are necessary to provide the service and rely on the safeguards required by applicable law.

5. Legal bases

• Performance of a contract: creating your account, signing you in, address suggestions, the AI logos you ask for, verifying your purchases and managing your subscription.
• Legitimate interests: keeping the App stable and the service secure, and limiting abuse and cost (crash and performance reports, the AI logo counter, technical logs).
• Legal obligation: where the law requires it.

6. Your customers’ details

You are the controller of the customer details (name, phone, address) you add to your quotes. Add them only to prepare quotes and inform your customers where required. They are stored on your phone and are not sent to us; only the text you type into an address field while using address suggestions is passed on as described in 2.4.

7. Retention

• Data on your phone: until you delete it, use “Reset app” or “Delete account”, or remove the App.
• Account record, purchase and subscription records, AI logo counter: while your account exists; deleted immediately when you delete your account in the App, or within 30 days of a request by email. One exception: the App Store's original transaction ID, the product and the expiry date of a subscription are kept without any link to you, so that the subscription you paid for can be restored to a new account (Apple keeps the subscription itself); they hold no name, email or account identifier.
• AI logo and address requests: not stored on our server (see 2.3 for OpenAI’s retention).
• Crash and performance reports: deleted automatically by Sentry after at most 90 days.
• Technical logs: for the provider’s short log retention period.

8. Your rights

You have the right to access, correct and delete your data, to restrict or object to processing, and to receive your data in a portable format. You can correct your details in the App at any time and delete your account in the App (section 9). For anything else, send your request to info@profesago.com; we reply within 30 days. You may also complain to the data protection authority in your country (in Türkiye, the Personal Data Protection Board).

9. Deleting your account

You can delete your account in the App: open Settings, tap Delete account in the App section, then Delete permanently. This immediately and permanently deletes your account on our server — your sign-in record, purchase and subscription records and usage counters — and then erases all ProfesaGo data on your phone. If you signed in with Apple, Apple asks you to confirm once more and the App is disconnected from your Apple ID. Deleting needs an internet connection. Deleting your account does not cancel an App Store subscription; cancel it in your iPhone Settings. We keep only a technical note that a deletion took place, without your email, name or any other personal details. If you can no longer use the App, you can ask us by email: Delete account.

10. Security

All traffic between the App and our servers is encrypted (HTTPS/TLS). The OpenAI and Google keys are kept only on the server and never ship inside the App. Database access is restricted by row-level security rules.

11. Children

ProfesaGo is for businesses and business owners. It is not directed at anyone under 18 and we do not knowingly collect data from children.

12. Changes

We may update this policy. We announce material changes in the App or on this page; the “Last updated” date is always at the top.