Cookie Policy

This Policy is published in Turkish and English with the same content. If you are located outside Türkiye, this English version is the authoritative version for you.

Data Controller Information

• Data controller / company: Mobiza Teknoloji
• Brand / service: Planfly
• Email: legal@planfly.app
• Phone: +90 850 307 90 23
• Address: Ovaakça Santral Mah. Ovaakça Fatih Sultan Mehmet Cad. No: 86, 16335 Osmangazi, Bursa, Türkiye
• Tax number: 1280527561
• Tax office: Uludağ Tax Office
• DUNS number: 751143161

1. Purpose

This Cookie Policy has been prepared to inform visitors and users about the cookies and similar technologies used on the Planfly website operated by Mobiza Teknoloji, its marketing and pricing pages, the business dashboard, businesses' online booking pages, appointment management pages, the embeddable booking widget and related digital services.

The purpose of this Policy is to:

• explain the purposes for which the cookies used on Planfly are used,
• state which cookies are strictly necessary and which are optional,
• explain how we manage your preferences for cookies that require consent,
• provide transparency about the personal data processed through cookies, its transfers, retention periods and your rights.

This Policy should be read together with the Privacy Policy, the KVKK Privacy Notice and the Terms of Use.

2. Scope

This Policy applies to the following digital environments:

• the planfly.app website and marketing pages,
• sign-up, sign-in, password reset and contact forms,
• the business dashboard and account settings,
• businesses' online booking pages (planfly.app/business-name),
• appointment management (cancellation and rescheduling) pages,
• the booking widget and iframe that businesses embed on their own sites,
• web technologies that operate for security, session management and preference management purposes.

This Policy applies only to areas controlled by Planfly. For businesses' own websites, the pages on which the widget is embedded, third-party platforms and integrations, the privacy and cookie notices of the relevant site apply.

3. Legal Framework

3.1. Legislation of the Republic of Türkiye

In its use of cookies and its processing of personal data through cookies, Planfly takes into account in particular the following regulations:

• Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu, KVKK),
• the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform (Aydınlatma Yükümlülüğünün Yerine Getirilmesinde Uyulacak Usul ve Esaslar Hakkında Tebliğ),
• the Guidelines on Cookie Practices (Çerez Uygulamaları Hakkında Rehber) published by the Personal Data Protection Authority (KVKK Authority),
• the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad (Kişisel Verilerin Yurt Dışına Aktarılmasına İlişkin Usul ve Esaslar Hakkında Yönetmelik),
• relevant decisions of the Personal Data Protection Board (KVKK Board) and secondary regulations.

3.2. European Economic Area, United Kingdom and Switzerland

For users located in the European Economic Area, storing information on your device or accessing information stored on it is subject to Article 5(3) of Directive 2002/58/EC on privacy and electronic communications (the "ePrivacy Directive") and the national laws implementing it, and personal data processed through cookies is subject to Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR"). In the United Kingdom, the Privacy and Electronic Communications Regulations 2003 ("PECR") and the UK GDPR apply; in Switzerland, the Federal Act on Data Protection and Article 45c of the Telecommunications Act apply.

For users in these regions, cookies that are not strictly necessary are used only with prior consent. In addition, for visits from these regions the partner referral cookie is not set, nothing is stored in the browser for the chat button's information messages, and the cookieless visit statistics on booking pages are not kept (Sections 7 and 8). Further information for users in these regions is given in the GDPR Privacy Notice and the UK Privacy Notice.

3.3. United States

For users who live in the United States, the California Consumer Privacy Act and the privacy laws of other states are observed. Planfly does not sell personal information through cookies or similar technologies, does not share it for cross-context behavioral advertising and does not engage in targeted advertising. A Global Privacy Control signal sent by your browser is treated as a request to opt out of sale and sharing, and Google Analytics does not run while this signal is present. Further information for users who live in the United States, including their privacy choices, is given in the US Privacy Notice.

3.4. Applicable Standard

Where the legislations differ, the standard that provides the higher level of protection for the relevant processing or user is applied.

4. What Is a Cookie?

A cookie is a small text file that a website saves on the visitor's device. Cookies allow a website to maintain your session, remember your preferences, perform security checks or, if you have given consent, produce usage statistics.

In addition to cookies, local storage, session storage, pixels and similar technologies that work for similar purposes may also be used. Unless otherwise stated in this Policy, these technologies are also treated as "cookies".

5. Types of Cookies

5.1. By Duration

• Session cookies: Temporary cookies that are deleted when the browser is closed or the session ends.
• Persistent cookies: Cookies that remain on the device for a certain period.

5.2. By Source

• First-party cookies: Cookies set directly by the Planfly domain.
• Third-party cookies: Cookies set by infrastructure or security providers or, if you have given consent, analytics providers.

5.3. By Purpose

• Strictly necessary cookies
• Functional / preference cookies
• Performance / analytics cookies
• Advertising / marketing cookies
• Security cookies

6. Cookies by Purpose

6.1. Strictly Necessary Cookies

These cookies are essential for the website, the dashboard and booking pages to work correctly and securely. For example:

• signing in (including Sign in with Google) and maintaining the session,
• submitting booking and sign-up forms securely (CSRF protection),
• remembering the session when the "Remember me" option is checked,
• remembering the selected business in the business dashboard,
• preventing fraudulent transactions and misuse,
• remembering the cookie preference.

Without these cookies, some parts of the site or service, especially the sign-in and booking steps, will not work. Consent is not obtained for strictly necessary cookies.

6.2. Functional / Preference Cookies

These cookies remember preferences to make the user experience easier. For example:

• light / dark theme preference,
• whether the dashboard sidebar is open or closed,
• interface display preferences.

These cookies are created only to remember a choice that the user explicitly makes in the interface, and only when that choice is made.

6.3. Performance / Analytics Cookies

These cookies help us understand how Planfly is used. For example:

• measuring the number of visits and page views,
• analyzing traffic sources,
• identifying errors, delays and performance issues,
• performing aggregated analyses to improve the user experience.

Planfly runs analytics cookies only after your consent has been obtained. Planfly does not use analytics or advertising cookies on businesses' booking pages or in the widget. On these pages, only the cookieless, anonymous visit statistics described in Section 8 are kept.

Google Analytics 4: If the integration is enabled, it is loaded on marketing, pricing and legal pages and in the account acquisition flow only after your analytics consent. Page views, navigation and basic interactions, as well as events for successful sign-up, sign-in and business setup, are measured. No name, email, phone number, form field content, business name, customer information or personal appointment / payment links are added to measurement events. Ad storage, ad user data and ad personalization permissions are kept turned off. Google Analytics cookies and measurement requests to Google are not started before consent is given. If your browser sends a Do Not Track or Global Privacy Control signal, measurement does not run.

In the Google Analytics configuration, Google signals and ad personalization signals are turned off; page addresses are sent without query parameters, and the referring site is sent only as a domain name. Google Analytics 4 uses the IP address to determine approximate location but does not log or store IP addresses. The business dashboard, booking pages, the widget, appointment management pages and pages embedded in another site (iframe) are not measured; when you move to the dashboard after signing in or signing up, only the relevant successful sign-in / sign-up event is sent, without the address or content of the dashboard.

6.4. Advertising / Marketing Cookies

These cookies are used to measure the performance of advertising campaigns, track conversions and perform retargeting. Planfly does not currently use advertising or marketing cookies. If such cookies are used in the future, they will be offered as a separate option in the cookie notice, only on Planfly's own marketing pages, and will run only after your explicit consent has been obtained. Advertising cookies are not used on booking pages, appointment management pages or in the business dashboard.

6.5. Security Cookies

These cookies are used for:

• detecting unusual traffic and bots,
• preventing denial-of-service (DDoS) attacks,
• account security and access controls.

Cloudflare, which provides Planfly's network security services, may set strictly necessary cookies for this purpose.

7. Cookies We Use

The main cookies and similar technologies used on Planfly are listed below. The list is updated in line with technical changes to the service.

You can change your analytics preference using the "Cookie preferences" button on the relevant pages. When you withdraw your consent, new measurement stops and the Google Analytics cookies on the Planfly domain are deleted. If new analytics or advertising cookies are added, this list will be updated and they will not run without your consent.

8. Booking Pages, Widget and Iframe Use

Businesses' booking pages and appointment management pages on Planfly use only the session and security cookies necessary for these pages to work. When you verify your mobile phone with a verification code on a booking page, a session cookie (pf_musteri_*) that keeps you signed in for that business on this device is set; the cookie is valid for 1 year, is renewed with each new appointment and is deleted with "Sign out". This cookie is not used inside the widget and iframe; there, verification is valid only for that appointment.

The widget embedded on the business's own website sends the data needed to book an appointment directly to Planfly's infrastructure, and Planfly does not set any advertising or analytics cookies through it. If the booking page is embedded with an iframe, strictly necessary cookies belonging to the Planfly domain may be treated as third-party cookies or blocked by the browser, depending on your browser settings; in that case, the booking steps can be completed in a new tab.

Cookieless visit statistics: On booking pages, the widget and appointment management pages, anonymous statistics are kept that show how many times the business's page has been viewed, which channel visitors came from (e.g., Instagram, Google, QR code, campaign link) and how they progressed through the booking steps. For this purpose:

• no cookies are used; campaign information is kept only in the browser tab's session storage and is deleted when the tab is closed,
• the IP address is not stored; unique visitors are counted with a short hash calculated from the IP address and browser information using a secret key that is regenerated every day, and the hash becomes irreversible the next day,
• if your browser sends a "Do Not Track" or "Global Privacy Control" signal, no visit records are kept,
• for visits from the European Economic Area, the United Kingdom and Switzerland, these statistics are not kept and nothing is written to the browser,
• raw records are kept for at most 90 days and aggregated daily counts for at most 25 months, and they are shown only to the relevant business, in aggregate form.

For the cookies and tracking tools of the website on which the widget appears, that site's cookie policy applies.

9. Categories of Data Processed Through Cookies

The following categories of data may be processed through the cookies used on Planfly:

• IP address,
• session identifier and session information,
• browser and device information,
• operating system, screen and language preferences,
• date and time of the visit,
• theme and interface preferences,
• cookie preference status,
• security logs,
• if consent is given, the Google Analytics cookie ID and event records relating to browsing activity, campaign interactions and successful sign-up / sign-in events.

Planfly processes data obtained through cookies in a manner that is fit for purpose, proportionate and limited to what is necessary.

10. Legal Grounds for the Use of Cookies

10.1. Strictly Necessary Cookies

Since strictly necessary cookies are essential for providing the service you request (e.g., signing in, booking an appointment), they are used on the legal grounds in the second paragraph of Article 5 of the KVKK of the establishment or performance of a contract and the legitimate interest of the data controller.

10.2. Cookies That Are Not Strictly Necessary

For cookies that are not strictly necessary, such as analytics, advertising and marketing cookies, prior explicit consent / consent is obtained.

Planfly follows these principles:

• no pre-ticked boxes or default acceptance mechanisms are used,
• continuing to use the site, scrolling the page or closing the notice does not by itself constitute consent,
• the "Accept" and "Decline" options are offered with equal ease,
• withdrawing consent is as easy as giving it,
• your preference is saved and asked again at reasonable intervals or when there are material changes.

10.3. European Economic Area, United Kingdom and Switzerland

For users in these regions, strictly necessary cookies are used without consent under the "strictly necessary" exemption in Article 5(3) of the ePrivacy Directive and in PECR; personal data processed through these cookies is processed under Article 6(1)(b) of the GDPR (providing the service you request) and Article 6(1)(f) (our legitimate interest in security). Cookies that are not strictly necessary, such as Google Analytics, are used only with your consent (GDPR Art. 6(1)(a)). Planfly does not rely on legitimate interests for cookies that are not strictly necessary.

11. Managing Cookie Preferences

You can manage your cookie preferences in the following ways:

1. the cookie notice shown on marketing pages ("Accept" / "Decline") and the "Cookie preferences" link at the bottom of the page or in the corner,
2. browser settings and your browser's Do Not Track / Global Privacy Control setting (Google Analytics does not run while this signal is present),
3. preference tools offered by third-party platforms (e.g., Google's Google Analytics Opt-out Browser Add-on),
4. contacting us at legal@planfly.app.

You can withdraw consent you previously gave at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

If your browser sends a Global Privacy Control or Do Not Track signal, this is shown in the "Cookie preferences" window and analytics cookies stay off for as long as the signal is present. For users who live in the United States, this signal is also treated as a request to opt out of the sale and sharing of personal information.

12. Managing Cookies Through Your Browser

Most browsers are set to accept cookies automatically. By changing your browser settings, you can:

• block cookies,
• delete existing cookies,
• allow only certain types of cookies,
• be warned when a cookie is set.

If you block or delete strictly necessary cookies, you may not be able to sign in to Planfly, book appointments or benefit from having your preferences remembered.

13. Third-Party Service Providers

In providing its services, Planfly uses third-party service providers in the following categories:

• content delivery, file storage (Cloudflare R2), DNS and network security services (Cloudflare),
• hosting and infrastructure services,
• for orders paid in currencies other than Turkish lira, the Paddle payment form (Paddle.js), which is loaded only when the checkout is opened; on this page, Paddle loads its payment form and may set its own strictly necessary cookies for payment security and fraud prevention, which are governed by the Paddle cookie policy,
• if you have given consent, analytics and measurement tools with Google Analytics 4 (Google LLC) (Section 6.3).

Sign in with Google and Google Meet: The "Continue with Google" button and Google Meet links do not load any Google script or cookie on Planfly pages (Google Analytics is loaded only with your consent and as described in Section 6.3). When you press the "Continue with Google" button, you are redirected to Google's own page; there and in Google Meet calls, Google's own cookies and cookie and privacy policies apply. The single-use values used to verify that the sign-in request belongs to you are kept on the server, tied to the existing session cookie without setting a new cookie, and are deleted when sign-in is complete.

These providers may set their own cookies or similar identifiers. For third-party cookies, the privacy and cookie policies of the relevant service providers also apply. Planfly designs its use of third parties to be as limited as possible, fit for purpose and compliant with legislation.

14. Transfers of Data Abroad

Data obtained through cookies and similar technologies may be transferred to servers or service providers located outside Türkiye due to infrastructure, network security, cloud, payment security for orders paid in currencies other than Turkish lira (Paddle) or, if consent is given, analytics services (e.g., Google Analytics).

In that case, the transfer is carried out pursuant to Article 9 of the KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, within the framework of:

• an adequacy decision,
• in the absence of an adequacy decision, the standard contract announced by the Personal Data Protection Board (notified to the Authority within five business days) or other appropriate safeguards,
• where these options are not available, and only provided that the transfer is incidental, the exceptional cases listed in the Law, including explicit consent.

For users in the European Economic Area, Switzerland and the United Kingdom, the transfer safeguards are described in the GDPR Privacy Notice and the UK Privacy Notice.

15. Cookie Retention Periods

Planfly keeps cookies only for the period that is limited to the purpose and necessary. In general:

• session cookies are deleted when the session ends or the browser is closed,
• the "Remember me" cookie is deleted when you sign out,
• preference cookies are kept for the period stated in the table above,
• if consent is given, Google Analytics cookies (_ga, _ga_*) are valid for at most 12 months and are deleted when you withdraw your consent; measurement data sent to Google Analytics is deleted at the end of the retention period selected in Planfly's Google Analytics account (at most 14 months for standard accounts),
• cookie consent or rejection preferences are kept for at most 12 months to remember your choice.

16. Principle of Notice and Transparency

Planfly aims to inform users through clear, understandable and layered information when using cookies. In this context, information is provided about the identity of the data controller, the purposes of cookies, the categories of data processed, the groups of recipients to whom data is transferred, the legal grounds, your rights and the preference mechanisms.

The obligation to inform and the process of obtaining explicit consent are carried out as separate processes.

17. Data Subject Rights

Under Article 11 of the KVKK, you have the following rights regarding your personal data:

• to learn whether personal data is processed,
• to request information about it if it has been processed,
• to learn the purpose of processing and whether it is used in line with that purpose,
• to know the third parties to whom it is transferred in Türkiye or abroad,
• to request correction if it is incomplete or inaccurately processed,
• to request erasure or destruction if the conditions in Article 7 of the KVKK are met,
• to request that the actions taken be notified to the third parties to whom it has been transferred,
• to object to a result against you arising from analysis exclusively by automated systems,
• to request compensation for damage caused by unlawful processing.

In addition, for consent-based cookies, you can withdraw your consent at any time.

The rights and complaint options of users in the European Economic Area, Switzerland, the United Kingdom and the United States are described in the privacy notices for their regions (Section 20 of the Privacy Policy).

18. Exercising Your Rights and Contact

You can send your requests regarding cookies and your personal data through the following channels:

• Email: legal@planfly.app
• Phone: +90 850 307 90 23
• Mail: Ovaakça Santral Mah. Ovaakça Fatih Sultan Mehmet Cad. No: 86, 16335 Osmangazi, Bursa, Türkiye

Applications are concluded within thirty days at the latest in accordance with the Communiqué on the Procedures and Principles of Applications to the Data Controller (Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ).

Applications from users located outside Türkiye are answered in accordance with the procedures and time limits described in the privacy notice for their region (Section 20 of the Privacy Policy) or in Section 21 of the Privacy Policy.

19. Children and Vulnerable Users

Planfly takes into account the rights of children and persons who need special protection in its use of cookies and tracking technologies. No profiling, behavioral advertising or similar high-risk tracking activities targeted at children are carried out.

20. Security and Technical Measures

Planfly implements appropriate technical and administrative measures to ensure the security of cookies and the data processed through them. In this context, session cookies are transmitted over an encrypted connection (HTTPS) and, where possible, created with the HttpOnly and SameSite attributes; access controls, logging, data minimization and retention period management are applied.

21. Updates to the Cookie Policy

Planfly may update this Cookie Policy due to legislative changes, product and infrastructure updates, the introduction of new service providers or the use of new cookie categories.

The current text takes effect on the date it is published on the website. If a new category of cookies that are not strictly necessary begins to be used, your consent will be requested again.

22. Language of This Policy

This Cookie Policy is published in Turkish and English with the same content. For individuals located in Türkiye, the Turkish version is authoritative; for individuals located outside Türkiye, the English version is authoritative.