Privacy Policy

This Privacy Policy explains how your personal data is handled when you use the ProfesaGo iOS app (the “App”) and the profesago.com website. Users in Türkiye can find the notice under Law No. 6698 (KVKK) on the Turkish version of this page.

In short

• Your business details, customers and quotes are stored on your phone. They are not saved to our servers.
• Our server only holds your sign-in record and a daily usage counter. It is located in EU — Frankfurt, Germany (AWS eu-central-1).
• To write the quote text, your quote details are passed through our server to OpenAI; we do not store them.
• We show no ads, do not track you across apps or websites, and do not sell your data.

1. Controller

The controller is [Controller name / legal entity — owner to fill], [Postal address — owner to fill]. For any privacy request, contact support@profesago.com.

2. What we process and why

2.1 Account and sign-in data

We use Supabase authentication to sign you in and manage your session. Depending on the sign-in method you choose, our server holds:

• Email sign-in: your email address.
• Sign in with Apple: the account identifier Apple provides and the email address Apple shares (Apple’s relay address if you chose “Hide My Email”).
• Sign in with Google: your Google account identifier, your email address and, as far as Google shares them, your name and profile picture link.
• Continue as guest: only a randomly generated identifier — no email or name.

We also keep when your account was created and when you last signed in. Session keys are stored on your phone. Purpose: to create your account, verify your sign-in and provide the service.

2.2 Business and quote data — on your phone only

The business name, trade(s), phone, address, email, logo, tax and payment settings you enter; the customer names and addresses, job descriptions, line items and prices you add to quotes; and the PDF files you create are stored only in the App’s storage on your phone. We do not store this data on our servers and do not sync it between devices. Deleting the App or using “Reset app” deletes it. If your phone’s own backup (e.g. iCloud Backup) is on, App data may be included in Apple’s backup, which is governed by your terms with Apple.

2.3 AI-written quote text

When you create a quote and you are online, the following is sent to a function on our server (EU — Frankfurt, Germany (AWS eu-central-1)) and passed on toOpenAI’s API to write the quote text: your business name, trade(s), phone, address, payment note and tax settings; the customer’s name and address; the job description, line items and amounts. The generated text is returned to your phone. Our server does not store this content; it only counts how many texts your account generated that day, to limit abuse and cost. Under OpenAI’s API terms, data sent through the API is not used to train models by default and may be retained for up to 30 days for abuse monitoring. If you are offline or the service is unavailable, the text is written on your phone and nothing is sent.

2.4 AI logo (Premium)

If you choose to generate a logo with AI on Premium, your business name, trade, the style words you pick, your short description and colour choice are sent through the same server function to OpenAI’s image API. The images return to your phone and are not stored on our server.

2.5 Address suggestions (Google Places)

When you type at least three characters into an address field, the text you typed, a country code and a random session code are sent through a function on our server to the Google Places API, which returns address suggestions. The request reaches Google from our server, not from your phone. You can always type the address yourself instead.

2.6 District lists

In some countries, district names are fetched from a public table on our server by country and province name to fill a picker. No personal data is sent with this request. Lists for Türkiye are built into the App.

2.7 Photos

To pick a logo, the App accesses only the photo you select. The image stays on your phone and is not uploaded to our server.

2.8 Subscriptions and payments

Premium is purchased through the App Store and Apple processes the payment; we never see your card details. Once in-app purchases are enabled we use RevenueCat to verify your subscription status; RevenueCat receives a random app user ID and App Store transaction information (product, purchase and renewal dates, country and currency). No name, email or card data is shared with it.

2.9 Technical logs

For requests to our servers, our infrastructure provider keeps short-lived technical logs for security and debugging (IP address, time, request type, app/device information).

2.10 profesago.com

This website sets no cookies and contains no analytics or advertising tools. Our hosting provider (Vercel) keeps standard server logs for security.

3. What we do not do

• We do not show ads or collect data for advertising.
• We do not track you across other companies’ apps and websites and do not access your advertising identifier (IDFA), so the App never asks for tracking permission.
• The App contains no analytics, advertising or tracking SDKs.
• We do not sell or rent your personal data.

4. Service providers and international transfers

Data sent to OpenAI, Google, Apple and RevenueCat is transferred outside Türkiye and the European Economic Area. These transfers are necessary to provide the service and rely on the safeguards required by applicable law.

5. Legal bases

• Performance of a contract: creating your account, signing you in, generating quote text, logos and address suggestions, managing your subscription.
• Legitimate interests: keeping the service secure and limiting abuse and cost (daily counter, technical logs).
• Legal obligation: where the law requires it.

6. Your customers’ details

You are the controller of the customer details (name, address) you add to your quotes. Add them only to prepare quotes and inform your customers where required. They are stored on your phone and are only transmitted as described in 2.3 to write the quote text.

7. Retention

• Data on your phone: until you delete it, use “Reset app” or remove the App.
• Account record and daily counter: while your account exists; deleted within 30 days of a deletion request.
• Quote text and logo requests: not stored on our server (see 2.3 for OpenAI’s retention).
• Technical logs: for the provider’s short log retention period.

8. Your rights

You have the right to access, correct and delete your data, to restrict or object to processing, and to receive your data in a portable format. Send your request to support@profesago.com; we reply within 30 days. You may also complain to the data protection authority in your country (in Türkiye, the Personal Data Protection Board).

9. Deleting your account

You can delete the data on your phone from inside the App and your server account by email. Steps: Delete account.

10. Security

All traffic between the App and our servers is encrypted (HTTPS/TLS). The OpenAI and Google keys are kept only on the server and never ship inside the App. Database access is restricted by row-level security rules.

11. Children

ProfesaGo is for businesses and business owners. It is not directed at anyone under 18 and we do not knowingly collect data from children.

12. Changes

We may update this policy. We announce material changes in the App or on this page; the “Last updated” date is always at the top.