Privacy Policy

Effective Date: May 27, 2026 Last Updated: October 27, 2026 Version: 2.2

1. Introduction

This Privacy Policy explains how Supastack Teknoloji Limited Şirketi ("Supastack", "we", "us", or "our") collects, uses, stores, and protects your personal data when you use the Trimsy mobile application ("Trimsy" or the "Service"), available on the Apple App Store and Google Play Store.

Supastack is the data controller responsible for your personal data under this policy.

We are committed to protecting your privacy and processing your data in compliance with:

• The Turkish Personal Data Protection Law (KVKK – Kişisel Verilerin Korunması Kanunu), Law No. 6698
• The EU General Data Protection Regulation (GDPR), Regulation (EU) 2016/679
• Applicable national data protection laws in jurisdictions where Trimsy is available

Our primary legal framework is the Turkish KVKK; the GDPR applies only as a supplementary framework for users located in the EU/EEA. This Privacy Policy should be read together with our detailed KVKK Notice (prepared under KVKK Article 10) and our Cookie Policy, which describes cookie use on our website.

If you have any questions about this policy or how we handle your data, please contact us at support@trimsy.co.

2. Who We Are

Trimsy is a business management application for professional pet groomers. It is designed exclusively for business use — pet groomers use Trimsy to manage appointments, customers, pets, and daily operations. Trimsy is not intended for use by pet owners or the general public.

3. Data We Collect

3.1 Account & Business Data

When you register for and use Trimsy, we collect:

• Email address and password (for authentication)
• Business name, business type (fixed location or mobile), and operating timezone
• Profile information you optionally provide (name, phone number)
• Subscription plan and billing status

3.2 Operational Data You Enter

As a groomer using Trimsy, you enter data about your customers and their pets. This data belongs to your business workflow and may include:

• Customer records: Names, phone numbers (in E.164 international format), and contact preferences
• Pet records: Pet name, species, breed, age, size, coat type, health notes, grooming history, and any photos of the pet you take or upload in the app (for example before/after grooming photos)
• Appointment records: Date, time, services performed, pricing, status, and notes
• Service & pricing data: Custom service templates, custom price adjustments, and discount tags

Important: When you enter customer and pet data into Trimsy, you are acting as a data controller for that information and are responsible for having the appropriate legal basis to process it. Supastack acts as a data processor for the customer and pet data you enter on behalf of your business (see the Terms of Service, Section 11: Data Processing Addendum).

What not to put in notes: Do not enter your customers' health information or any other special categories of personal data (for example religion, ethnic origin, or biometric data; KVKK Article 6 / GDPR Article 9) in note fields. A pet's health notes are not human health data; you can write them for the pet's care.

3.3 Messaging Data

If you use Trimsy's messaging features (WhatsApp / SMS reminders and confirmations via Twilio), we process:

• The phone numbers of your customers
• Message content you send or that is sent automatically on your behalf (e.g. appointment reminders)
• Photos and care cards you choose to send to a customer (a care card is an image we generate from the appointment's details and any before/after photos of that customer's pet; it is only sent when you choose to send it)
• Message delivery status

3.4 Payment & Subscription Data

Trimsy subscriptions are purchased and billed only through the Apple App Store or Google Play; we track subscription status through RevenueCat (see §6.3). To process your subscription we collect:

• Subscription tier, purchase date, expiry date, and renewal status
• Transaction identifiers provided by the App Store (Apple) or Google Play

We do not store raw payment card numbers.

If you collect deposits or appointment payments from your own customers through Trimsy's payment links, your customer's payment is processed by our payment provider (iyzico in Turkey — see §6.4). To take that payment we share the payment amount and your customer's name and phone number with the provider; your customer enters their card details directly with the provider, and we never see or store raw card numbers.

3.5 Usage & Technical Data

We automatically collect limited technical data to operate and improve the Service:

• Device type, operating system version, and app version
• Notification tokens (push tokens, to deliver appointment alerts to your device)
• Error logs and crash reports (via Sentry)
• Product-analytics events — which features are used and conversion-funnel steps (via PostHog; see §6.11).

3.6 AI-Assisted Contact Import (Optional)

If you import your phone contacts and choose the "Use AI to organize" option (see §9), the text fields of those contacts (name, company/organization, job title, and notes) are sent to Google's Gemini API (Google LLC, USA) to be parsed into customer and pet records. Phone numbers are never sent to Google. If you choose "Import without AI", nothing is sent to Google: the selected contacts are sent to Trimsy's servers and parsed there without AI.

3.7 AI Voice Assistant (Optional)

If you enable the voice assistant (see §9), each question you ask, spoken or typed, is sent to Google's Gemini API (Google LLC, USA) together with the business records needed to answer it. For spoken questions, a list of customer and pet names from your account is also sent so those names are recognised correctly. While a question is handled, a small batch of names may also be sent to create sound-alike spellings that help with this (see §9). Google's Gemini API transcribes a spoken question, writes the answer, and voices the spoken reply. The voice assistant is off unless you turn it on, and you can revoke it at any time in Settings → Data & Privacy.

4. Legal Basis for Processing

Under GDPR and KVKK, we process your personal data on the following legal bases:

5. How We Use Your Data

We use the data we collect to:

• Create and manage your Trimsy account
• Deliver and maintain the Service
• Process your subscription and handle billing
• Send automated appointment reminders and confirmations to your customers via WhatsApp/SMS (only when you enable this feature)
• Send a care card, which may include photos of the customer's pet, to that customer via WhatsApp (only when you choose to send it)
• Send push notifications to your device for appointments and updates about your business
• Detect, investigate, and prevent fraud, abuse, and security incidents
• Respond to your support requests
• Comply with legal obligations
• Improve and develop new features of the Service (using aggregated, anonymised data)

We do not sell your personal data to third parties. We do not use your data for advertising or marketing purposes beyond communicating with you about Trimsy itself.

6. Third-Party Services and Data Processors

Trimsy uses the following third-party services to deliver the product. Providers that act as data processors process data on our behalf under the provider's data processing terms. iyzico, Apple (App Store), and Google (Google Play) act as independent data controllers for their own processing.

6.1 Supabase (Database, Authentication, File Storage)

Trimsy's backend infrastructure runs on Supabase (Supabase Inc., USA), which provides:

• PostgreSQL database (stores all account, customer, pet, and appointment data)
• Authentication (manages login sessions and tokens)
• File storage (for any uploaded files, including pet photos and generated care-card images)

All data stored in Supabase is protected by Row-Level Security (RLS) policies — your business data is isolated and not accessible by other Trimsy users.

Data location: Data is hosted in the EU West (Ireland, eu-west-1) region. Supabase takes daily backups of the database, which are kept for 7 days (see §7).

More information: https://supabase.com/privacy

6.2 Twilio (WhatsApp & SMS Messaging)

When you use Trimsy's messaging features, messages are delivered via Twilio (Twilio Inc., USA). Twilio processes:

• Your customers' phone numbers
• Message content (appointment reminders, confirmations, custom messages you compose, and any photos or care-card images you choose to send)

Twilio may retain message metadata for up to 7 days for delivery reporting. Message body content retention varies by Twilio product and region.

More information: https://www.twilio.com/en-us/legal/privacy

6.3 RevenueCat (Subscription Management)

Trimsy uses RevenueCat (RevenueCat Inc., USA) to manage in-app subscriptions on iOS and Android. RevenueCat processes:

• A random identifier (UUID) belonging to your business
• Subscription purchase events from Apple App Store and Google Play
• Entitlement status (which features you have access to)

RevenueCat does not receive your name, email address, or payment card details.

More information: https://www.revenuecat.com/privacy

6.4 iyzico (Payment Processing — Turkey)

For users in Turkey, payment processing is handled via iyzico (iyzico Ödeme Hizmetleri A.Ş., İstanbul, Türkiye), a licensed payment institution regulated by the Banking Regulation and Supervision Agency (BDDK). This covers the deposit and appointment payments you collect from your customers through Trimsy's payment links. Trimsy subscription payments are not taken through iyzico; subscriptions are billed through the App Store or Google Play (see §3.4). iyzico processes:

• Payment card details (card number, expiry, CVV — processed directly by iyzico; we do not store raw card data)
• Transaction amount, date, and outcome
• Billing identity information required by Turkish financial regulations
• For payments you collect from your customers, the customer's name and phone number (to identify the payer and issue the receipt)

iyzico is an independent data controller for payment card data and is PCI-DSS compliant.

More information: https://www.iyzico.com/gizlilik-politikasi

6.5 Cloudflare (Website, Link Pages, and Photo and Workspace Backups)

Trimsy uses Cloudflare (Cloudflare, Inc., USA) for two purposes:

• Backup copies: backup copies of pet photos and of the nightly workspace copies (ZIP) are stored in Cloudflare R2 storage (Eastern Europe region), so they survive a problem at our main provider. Backup copies are protected from deletion for 29 days after they are made; when you delete a photo or your account is permanently deleted, its backup copies are deleted within 30 days.
• trimsy.co and link pages: the trimsy.co website and the appointment confirmation, payment (trimsy.co/pay), and receipt pages you send to your customers are hosted on Cloudflare. When these pages are opened, Cloudflare processes technical connection data such as the visitor's IP address, and the appointment details shown on the page, in order to serve the page.

More information: https://www.cloudflare.com/privacypolicy/

6.6 Expo / Expo Push Notifications (Push Notification Delivery)

Trimsy is built on Expo (Expo Inc., USA) using Expo's managed workflow. In this architecture, push notifications are routed through Expo's push notification service, which then forwards them to Apple Push Notification service (APNs) on iOS and Google Firebase Cloud Messaging (FCM) on Android. Expo acts as an intermediary in the notification delivery chain and processes:

• A device-specific Expo notification token (push token) generated at app installation
• Notification content (appointment reminders, system alerts)

Architecture note: This reflects Trimsy's current Expo managed workflow architecture. If Trimsy migrates to a direct APNs/FCM integration in a future release, Expo would no longer be in the notification delivery chain. This policy will be updated accordingly if that change occurs.

More information: https://expo.dev/privacy

6.7 Sentry (Error Monitoring)

Trimsy uses Sentry (Functional Software Inc., USA) to detect and report application errors and crashes. Sentry may collect:

• Device and OS information
• App version and build number
• Stack traces and error context at the time of a crash
• A pseudonymous account identifier and the workspace identifier, used only to find and fix errors affecting that account

Crash and error reports do not include your name, email address, phone number or IP address. Sentry data is used solely to diagnose technical issues.

Feedback you send from the app. If you use "Send feedback", we receive the message you write and, if you attach one, the screenshot you choose, together with the app version, your device platform, the screen you last used, your account's email address and the account and workspace identifiers. Sending feedback is optional, and we use it only to answer and fix what you report. It is stored with Sentry in the EU. It is also kept in Trimsy's own database so you can see your past feedback in the app, and a copy is emailed to our support inbox (support@trimsy.co). A screenshot is sent as it is, so crop out anything you don't want to share, such as customer details, before sending.

More information: https://sentry.io/privacy/

6.8 Apple App Store & Google Play

When you purchase or download Trimsy through the Apple App Store or Google Play, Apple and Google act as independent data controllers for the transaction. Their respective privacy policies govern that processing:

• Apple: https://www.apple.com/legal/privacy/
• Google: https://policies.google.com/privacy

6.9 Google Gemini API (AI Contact Import and Voice Assistant)

Trimsy uses Google's Gemini API (Google LLC, USA) for two optional AI features: AI-assisted contact import (this section) and the voice assistant (§6.10). Google acts as a sub-processor for these features and is involved only when you use them.

When you use the "Use AI to organize" option during contact import, the text fields of the contacts you select (first and last name, company/organization, job title, and notes; never phone numbers) are sent to the Gemini API to extract customer and pet information. With "Import without AI", nothing is sent to Google.

In short: Trimsy uses the paid Gemini API tier; Google does not use this data to train its models and keeps logs for a limited period only to prevent abuse. For details and how Google handles this data, see §9.

More information: Gemini API terms · Google Privacy Policy · Google Data Processing Addendum

6.10 Google (Voice Assistant — Gemini API)

The optional voice assistant also runs on Google's Gemini API (Google LLC, USA), and data is sent to Google only when you ask the assistant a question. The Gemini API transcribes a spoken question, writes the answer from the records Trimsy looks up for your question, and voices the spoken reply. Google receives your question (a short audio clip or the text you typed), the records needed to answer it, the earlier questions and answers in the same conversation, and customer and pet names from your account for name recognition. The assistant reads records with the same permissions your role has in the app.

For the full list of what is sent and when, and how Google handles this data, see §9 and §6.9.

More information: Gemini API terms · Google Privacy Policy · Google Data Processing Addendum

6.11 PostHog (Product Analytics)

Trimsy uses PostHog (PostHog, Inc., USA) to understand, in aggregate form, how features are used, and to improve the product. Your analytics data is hosted in the EU (Frankfurt) region (PostHog EU Cloud). PostHog processes:

• Usage events (which screens/features are used, conversion-funnel steps)
• Device and app information (operating system, app version)
• A user/installation identifier, linked to your account's email address

More information: https://posthog.com/privacy

6.12 Resend (Email Delivery)

Trimsy sends account emails (sign-in and verification links, team invitations, account-related notices) and the support reports you send from the app through Resend (Resend, Inc., USA). Resend processes the recipient's email address and the content of the email.

More information: https://resend.com/legal/privacy-policy

7. Data Retention

We retain your data for as long as your Trimsy account is active or as necessary to provide the Service.

Deleting your account

To delete your account in the app or request deletion by email without the app, see Delete your account and data. Before deleting, you can download all your data (JSON + photos, as a ZIP) from Settings › Backup.

Deleting your account does not cancel a store subscription; cancel it separately in the App Store or Google Play.

When the account owner requests deletion, the account enters a 14-day recoverable grace period. During this window the account is deactivated but not yet erased: if you sign back in and choose to restore, your workspace, team, customers, pets, and appointments are recovered intact. After 14 days the deletion becomes permanent and cannot be reversed.

When deletion becomes permanent, we permanently erase your personal data — including customer and pet records, appointments, messaging data, uploaded photos, and your own contact details — and we delete the sign-in identities of the account's members. This is a genuine erasure, not a hidden deactivation.

Copies in backups. Data deleted from active systems can remain in backups for the following periods and is then deleted automatically:

• in Supabase's daily database backups, for up to 7 more days;
• in the nightly server copies of your workspace (ZIP; the last 14 copies are kept), until the account is permanently deleted; these copies are removed during permanent deletion;
• in the backup copies on Cloudflare R2: for pet photos, within 30 days after a photo is deleted or the account is permanently deleted; for the nightly workspace ZIPs, within 30 days after the account is permanently deleted.

Financial records are the one exception. Turkish tax and commercial law require us to keep payment, subscription, and transaction records for up to 10 years. We keep these records with their personal identifiers removed and severed from the erased data, anchored to a minimal, personal-data-free record of the business that exists only to satisfy this legal obligation. They are not used for any other purpose.

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• All data in transit is encrypted using TLS 1.2+
• All data at rest is encrypted in Supabase-managed storage
• Row-Level Security (RLS) ensures strict tenant isolation — no user can access another business's data
• Authentication tokens are stored securely on-device using Expo SecureStore
• Access to production systems is restricted to authorised personnel only

No system is 100% secure. If you discover a security vulnerability in Trimsy, please report it to support@trimsy.co.

9. Artificial Intelligence Features

Trimsy includes optional features that use artificial intelligence. They process your data only when you choose to use them, and you can change or revoke that choice at any time in the app under Settings → Data & Privacy.

AI-Assisted Contact Import

Trimsy can help you turn your existing phone contacts into Trimsy customer and pet records. When you tap "Import from contacts" and grant the operating system's contacts permission, Trimsy imports the contacts from your device's address book. You then select which contacts to import; only the contacts you select are processed.

During import, you choose how those contacts are organised:

• Use AI to organize — the text fields of the imported contacts (first and last name, the company/organization field, job title, and notes) are sent to Google's Gemini API (Google LLC, USA) to parse out owner names, pet names, breeds, and grooming-relevant health or behaviour flags. Groomers often store a pet's name in the company/organization field, which is why that field is included.
• Import without AI (basic mode) — nothing is sent to Google. The selected contacts are sent to Trimsy's servers and parsed there without AI.

Phone numbers are never sent to Google. They are held on our backend and re-attached to your records after parsing. As an additional safeguard, phone-number-like sequences are stripped out of the text fields before they are sent, so a number typed into a note is not transmitted either.

This AI processing applies only to the phone-contacts import.

If you choose to, Trimsy can also add your customers to your phone's contacts or update the contacts with the same phone number (customer name, pet names, phone number, and "Trimsy Client" in the company field when it is empty); you pick each change before it is made, and it can be undone.

Troubleshooting logs. Troubleshooting logs for contact import are off by default. Only Supastack can switch them on, to fix a specific problem; while on, the logs are kept for at most 7 days and then deleted automatically. These logs cannot be opened from the app.

Google handles this data as described in "How Google handles this data" below: no model training, and logs kept for a limited period only to prevent abuse.

AI Voice Assistant

Trimsy offers an optional voice assistant that lets you ask questions about your schedule, customers, pets, and revenue by speaking instead of tapping through the app. It is off until you turn it on (long-press the dashboard action button and choose "Enable voice assistant"), and you can revoke it at any time in Settings → Data & Privacy.

When you ask a question, your data is handled by a single sub-processor, Google's Gemini API (Google LLC, USA). Nothing is sent to Google until you ask. Each question goes through up to three steps:

• Speech-to-text: a short audio clip of what you said is sent to Google's Gemini API and transcribed into text. If you type your question instead, the text is sent and this step is skipped.
• Answer generation: Trimsy looks up the records needed to answer your question in your account and sends them to the Gemini API, which writes the answer. For example, if you ask about this week, it sees this week's appointments; if you ask about one pet, it sees that pet's details. The earlier questions and answers in the same conversation are included so follow-up questions make sense.
• Text-to-speech: the Gemini API voices the spoken reply you hear. Typed questions get a written reply only.

For spoken questions, a list of up to 300 customer and pet names from your account is sent with the audio so the assistant recognises which pet or person you mean. To recognise names better next time, Trimsy also saves a few sound-alike spellings of each name with that customer or pet record. While a question (spoken or typed) is being handled, a small batch of names that do not have them yet is sent to the Gemini API, which creates the spellings from the names alone.

What the assistant can see. The assistant reads your records with the same permissions your role has in the app. If your role cannot see revenue or phone numbers, or sees only your own appointments, the assistant cannot see more than that either.

What is kept. Trimsy does not store your voice recordings. Troubleshooting logs for the assistant are off by default. Only Supastack can switch them on, to fix a specific problem; while on, the written question, the answer and the records used for it are kept for at most 7 days and then deleted automatically. These logs cannot be opened from the app.

What the assistant does and does not do. The voice assistant only reads your records: it answers your questions, opens the relevant record, or can open a prefilled appointment form for you. It never creates, changes, or cancels an appointment or any other record itself; you review the form and save it. We will update this policy before letting the assistant write records on its own.

Google handles this data as described in "How Google handles this data" below: your prompts (audio or text) are not used for model training, and logs are kept for a limited period only to prevent abuse.

How Google handles this data

This section applies to both features above (AI-assisted contact import and the voice assistant).

Trimsy uses the paid Gemini API tier. On the paid tier, Google does not use the submitted data, your prompts (audio or text), or the responses to train or improve its models, and processes the data under Google's Data Processing Addendum for Products Where Google is a Data Processor. Google logs inputs and outputs for a limited period, solely to detect and prevent abuse and keep the service safe and secure, and for any required legal or regulatory disclosures. See the Gemini API terms, the Google Privacy Policy, and the Data Processing Addendum for Products Where Google is a Data Processor.

Google acts as a third-party sub-processor for these features. We will update this policy and notify you before introducing any materially different AI processing of your data.

10. International Data Transfers (Cross-Border Transfer)

Supastack is based in Turkey. However, Trimsy's core infrastructure and some of its features run on service providers (data processors) listed in §6, some of which are based abroad. Your personal data is therefore transferred abroad in order to provide the Service. The providers and countries involved:

Legal basis. Article 9 of the KVKK requires regular cross-border transfers to rest on an adequacy decision or on appropriate safeguards such as the standard contracts announced by the Personal Data Protection Board. We are in the process of signing the standard contracts announced by the Board with the providers above and notifying them to the Personal Data Protection Authority, and we will update this section as each step is completed. Explicit consent is used as a basis only for the occasional (non-regular) transfers that Article 9(6) of the KVKK allows.

When you join the Service, we also ask in the app for your explicit consent to cross-border transfer; you can withdraw it at any time in Settings → Data & Privacy. Until the move to standard contracts is complete, if you withdraw that consent we may be unable to keep providing the Service to you because the core infrastructure is abroad; in that case the app directs you to the account deletion step.

Which data is transferred to which provider is set out in §6 and in the KVKK Notice.

11. Your Rights

11.1 Under KVKK (Turkish Law)

Under KVKK Article 11, you have the right to:

• Learn whether your personal data is being processed
• Request information about how your data is processed
• Learn the purpose of processing and whether data is used for its intended purpose
• Know the third parties to whom your data is transferred, domestically or abroad
• Request correction of incomplete or inaccurate data
• Request deletion or destruction of your data where the conditions of KVKK Article 7 are met
• Request that corrections, deletions, and destructions be notified to third parties to whom your data was transferred
• Object to a result against you that arises from the analysis of your processed data exclusively through automated systems
• Request compensation for damages caused by unlawful processing

You can download all your data (JSON + photos, as a ZIP) at any time from Settings › Backup.

To exercise your rights under KVKK, contact us at support@trimsy.co. We will conclude your request within 30 days at the latest. You also have the right to lodge a complaint about our processing with the Turkish Data Protection Authority (Kişisel Verileri Koruma Kurumu — https://www.kvkk.gov.tr). The application procedure is detailed in the KVKK Notice.

11.2 Under GDPR (EU/EEA Users) — Short Note

Although our primary framework is the KVKK, if you are in the EU or EEA you also have the GDPR rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), and — where processing is based on consent — withdrawal of consent. To exercise these rights, contact support@trimsy.co; we will respond within 30 days (or within 1 month as required by GDPR Article 12). You may also lodge a complaint with your local data protection authority (edpb.europa.eu).

12. Children's Privacy

Trimsy is a professional business tool intended for adults operating pet grooming businesses. We do not knowingly collect personal data from individuals under 18 years of age. If you believe we have inadvertently collected data from a minor, please contact us at support@trimsy.co and we will delete it promptly.

13. Cookies and Tracking

Trimsy is a native mobile application and does not use browser cookies. We use device-level identifiers (notification tokens (push tokens), device IDs) solely for the operational purposes described in §3.5. We do not use cross-app tracking or advertising identifiers. Cookie use on the trimsy.co website is described separately in our Cookie Policy; the website uses only a single functional cookie that remembers your language preference.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Notify you via in-app notification or email to the address on your account
• Update the "Last Updated" date at the top of this page
• For significant changes, provide at least 14 days' advance notice before the changes take effect

Your continued use of Trimsy after the effective date of any changes constitutes your acknowledgement of the revised policy.

15. Contact Us

For any questions, requests, or complaints regarding your personal data or this Privacy Policy, please contact:

Supastack Teknoloji Limited Şirketi Esentepe Mh. Talatpaşa Cd. No:5/1 Şişli, İstanbul, Türkiye 🌐 https://trimsy.co 📧 support@trimsy.co

We will acknowledge your request within 5 business days and respond fully within 30 days.

This Privacy Policy was prepared in accordance with Turkish Personal Data Protection Law (KVKK) No. 6698 and the EU General Data Protection Regulation (GDPR) 2016/679.