Last updated: October 21, 2026 NOTICE: This text is a draft and must be reviewed by a lawyer before it takes effect. It does not constitute legal advice. 1. Introduction CutieCure Salon (the "Platform", "we") is a management software for salon businesses covering appointments, customers, services and staff. This Privacy Policy explains how we collect, use and protect the personal data of both salon owners who use the Platform and the end customers whose data salon owners enter into the Platform. It should be read together with Turkey's Personal Data Protection Law No. 6698 (KVKK). 2. Data Controller For the data a salon owner provides when registering, CutieCure acts as data controller. For data that a salon owner enters about their own customers, the salon owner is the data controller and CutieCure acts as a data processor. Contact: support@cutiecure.app 3. Personal Data We Collect a) Salon owner / staff data: first name, last name, email address, phone number, salon name and address, subscription and payment status, login and usage logs. b) End-customer data (entered by the salon owner): full name, phone number, email address, appointment history, services received and amounts spent, and any notes. c) Technical data: IP address, browser information, cookies and session data. 4. Purposes of Processing - Account creation, authentication and session management - Providing appointment, customer, service and staff management features - Operating subscription and payment processes - Sending reminders and notifications - Improving service quality and providing technical support - Complying with legal obligations 5. Legal Basis Data is processed on the bases of performance of a contract, compliance with legal obligations, legitimate interests, and, where required, explicit consent (KVKK Art. 5 and 6). 6. Sharing of Data Personal data may be shared, only to the extent necessary, with the infrastructure, hosting and payment service providers we use to deliver the service. These providers process data solely on our instructions. Data may be disclosed to competent public authorities where legally required. 7. Retention Personal data is retained for as long as the processing purpose requires and for the statutory limitation periods set by applicable law. When an account is closed, data is deleted or anonymized within a reasonable period. 8. Data Security We apply technical and organizational measures such as encryption in transit, access controls and session management to protect data against unauthorized access, loss and alteration. 9. Data Subject Rights Your rights under KVKK Art. 11 are described in detail in the 'KVKK / Data Protection Notice' section. 10. Website Widget and Browser Extension a) Website widget: a salon can add the CutieCure booking and AI widget to its own website. When a visitor books through the widget, the name, phone number and any optional email address and note they enter are sent to CutieCure and added to that salon's account, as with a booking made on the salon's booking page. The AI features start only after the visitor ticks the consent box; the hand photo they upload is then used for the analysis, design suggestions and try-on. When the AI features start, the widget keeps a random visitor identifier in the browser's local storage for that website. Contact details in the optional "share your results with the salon" form are sent only if the visitor agrees to be contacted, and a salon may share a try-on design on social media only if the visitor ticks the sharing box, which they can untick later. For data collected through a salon's widget, the salon is the data controller and CutieCure acts as a data processor. b) QuickDesk browser extension: CutieCure Salon users can sign in to QuickDesk, our browser extension, to see their salon's day from the browser toolbar. The extension stores only its sign-in tokens, the chosen language and theme, and feature settings in the browser's extension storage, until the user signs out. It communicates only with the CutieCure API, cannot read or change other websites, and shows the salon's appointments and customers without storing them. The device's time zone name is sent so that "today" matches the salon's day. The password typed into the sign-in form is sent once to sign in and is not stored. 11. Contact For all privacy related requests and questions: support@cutiecure.app