Who is the data controller?
Dakik is the data controller, under the personal data protection legislation, for the personal data it collects through the dakik.studio marketing site, studio signup, the demo studio and platform accounts (studio owner and staff sign-ins).
For the member and staff data your studio enters into the application (name, contact details, package and class history, health notes, payment records) the data controller is that studio; Dakik is the data processor, handling those records on the studio's behalf and on its instructions. If you are a member or a staff member of a studio, you need to send requests about your own data to your studio first; Dakik helps the studio fulfill your request.
Requests to the data controller: [email protected]
Which personal data do we process?
What is processed depends on the role you use the application with. No data outside the categories below is collected, and fields the forms do not require may be left blank.
| Data category | Sample values | Source |
|---|---|---|
| Account data | Name, email address, phone number, password (only its hashed digest), role, last sign-in time | Studio signup, accepting an invitation, a studio's trial class page, or signing in with Google |
| Member data | Level, enrollment date, class types, packages and class credits, booking and attendance history, freeze records, referring member, studio note | Entered by studio staff |
| Staff data | Specialties, class types, availability and blocked hours, the pay definition and the pay calculated from it | Entered by the Owner or an Admin |
| Financial records | Payment amount, payment method and account, the installment plan and its due dates, income and expense records, the user who entered the record | Entered by studio staff |
| Notification data | Notification preferences, push subscription, the delivery status of the messages sent | In-app settings and the delivery log |
| Usage and technical data | IP address, browser and device type, audit records, error records | The server and the browser |
| Marketing site data | The email address and studio name you leave when opening a demo studio; anonymous usage statistics where consent was given; the campaign source (utm parameters); the code of the studio's referral link, if that is how you arrived | Your visit to dakik.studio |
| Contact form data | Name, email address, the topic and the text of your message; the studio name and phone number if you filled them in; the language you wrote in and the campaign source (utm parameters) | The contact form on dakik.studio |
Card details are never collected: Dakik takes no card payments from a member, and payments are recorded by the studio by hand.
How is health data protected?
The 'Health Notes' field on a member record is special category personal data and is processed only with the member's explicit consent. Consent is collected through the privacy and explicit consent text the studio shows the member. The member can change or delete the field from their own profile in the application at any time, and it is deleted when the member is made inactive.
- Within the studio a health note is seen only by users with the Owner, Admin or Staff role; the instructors who teach the classes sign in with one of these roles too. The note is shown in the Members list, on the member's Member Details page and in the member form, and in the participant list of a session's detail. A member sees only their own note.
- When a member changes their own note, the instructors of their upcoming classes get an in-app notification; it does not contain the note and takes the instructor to the member's Member Details page.
- Other members, the people on a waitlist and nobody outside the studio can see this field; health data is never included in notification texts, in global search results, in exported CSV files or in emails.
- The field is used for class safety alone; it is never used for profiling, for advertising or for transfer to third parties.
- Every access passes a role-based permission check, and the field is sent only to the roles allowed to see it.
What do we process the data for?
Your personal data is processed on the legal grounds the legislation lists (entering into and performing a contract, fulfilling a legal obligation, legitimate interest and, where it is needed, explicit consent) and for the purposes below alone.
- Creating your studio account, letting you sign in and keeping your account secure
- Applying membership packages, class credits, bookings, and the make-up and freeze rules
- Calculating instructor pay from attendance, and the studio's cash flow
- Delivering booking confirmations, class reminders, cancellation notices and waitlist notices over the in-app, push and WhatsApp channels
- Where the studio has switched the WhatsApp Assistant on, answering the messages members write to the studio's WhatsApp number and carrying out the changes a member confirms (canceling or moving a class, using a make-up credit, the waitlist, a freeze)
- Sending invitation, email verification and password reset emails
- Opening a demo studio of your own and sending information about Dakik to the address you left
- Answering the message you send through the contact form
- Fixing errors, preventing abuse and fulfilling legal obligations
- Measuring how the marketing site is used, and the sign-ups and demo starts it brings, with anonymous statistics, where you have consented
Who do we share the data with?
Your data is not sold and is not shared with third parties for advertising. To provide the service we work with the data processors below, only for the stated purpose and within the stated scope; each of them acts on our instructions alone and under a data processing agreement.
| Data processor | What it does | Data transferred | Note |
|---|---|---|---|
| Resend | Sending email | The recipient name and email address, and the content of the email (invitation link, verification, password reset) | Only at the moment of sending; no marketing list is built |
| The WhatsApp Evolution API provider | Sending WhatsApp notifications | The member's phone number and the notification text (member name, class name, date) | The studio connects its own WhatsApp number; with no connection, no message is sent |
| An artificial intelligence service provider | Answers of the WhatsApp Assistant: understanding the member's message and writing a reply from the studio's records | The messages the member writes to the assistant and what the reply needs (name, classes, packages, credits left and payments); health notes are not sent | Only where the studio has switched the WhatsApp Assistant on and the member writes to it; the assistant makes no change without the member confirming it |
| Browser push services (Google, Apple, Mozilla) | Delivering push notifications | The push subscription and the notification text | Only to the devices that granted permission |
| Google Analytics | Measuring use on the marketing site; counting the studio sign-ups and demo starts it brings | A pseudonymous visitor identifier, page and click events, and the sign-up and demo start events; Google Analytics stores no IP addresses | Only where cookie consent was given on dakik.studio. The application loads no Google Analytics script and sets no analytics cookie; our server reports a studio sign-up or a demo start to Google Analytics once, without an IP address or a user ID |
| Cloudflare Turnstile | An invisible bot check on the sign-up, sign-in, password reset, demo, trial class and contact forms | The IP address and browser and device signals; nothing typed into the form is sent | Only while one of these forms is being submitted; it sets no cookie on our sites and is not used for advertising |
| Sentry (Functional Software, Inc.) | Recording and tracking the errors that occur on the application server and in its background jobs | The error message and stack trace, the step it occurred in and the ID of the studio involved; where the error occurred in a request, its method and address, with one-time keys such as an invitation token masked. The request body, cookies and headers, the IP address and user details are not sent | Only when an error occurs on the server; it loads no script in the browser, sets no cookie and does no performance monitoring |
| The hosting provider | Server, database, file storage and backups | Every record in the application | Data travels over an encrypted connection; access is limited to authorized Dakik personnel |
Resend, Google (Analytics, push, Google sign-in and the WhatsApp Assistant's AI model), the Apple and Mozilla push services, Cloudflare, Sentry and the hosting provider operate outside Türkiye, so data passed to them is transferred abroad.
Your data is shared with nobody else unless a legal obligation, or a duly made request from an authorized public authority, requires it.
How long is your data kept?
Data is kept for as long as the purpose of processing needs it and for as long as the legal retention obligations run. The table below sets out how long each kind of data is kept and when it is deleted; data due for deletion is deleted, destroyed or anonymized.
| Data | Retention period |
|---|---|
| Studio account and application data | For as long as the account exists; a locked studio or a closed account deletes no data. Deleted within 30 days of the studio owner's written deletion request, at the latest |
| Member health notes | Deleted when the member is made inactive. The member can delete the note from their own profile, and the studio from the member record, at any time; it is also deleted on request |
| Financial records | Together with the studio account; these records do not take the place of the studio's statutory books and accounting records |
| Audit and access records | For as long as the studio account exists; deleted together with the account when it is deleted on request |
| WhatsApp Assistant conversations | 90 days; expired conversations are deleted automatically |
| Daily backups | 30 days; a backup is deleted automatically once it expires |
| Demo studio data | 24 hours; after that the studio and every record in it is deleted completely |
| The contact address left when opening a demo | Until you ask us to delete it |
| The message and contact details sent through the contact form | Until you ask us to delete it |
| Cookie consent | 12 months; after that you are asked for your choice again |
| Google Analytics data | At most 14 months (anonymous statistics) |
What are your rights over your personal data?
By applying to the data controller you can exercise the following rights over your personal data.
- Learning whether your personal data is being processed
- Requesting information about the processing where your personal data has been processed
- Learning the purpose of the processing and whether the data is used in line with that purpose
- Knowing the third parties, in the country or abroad, the data is transferred to
- Asking for the data to be corrected where it has been processed incompletely or inaccurately
- Asking for the data to be deleted or destroyed within the conditions the legislation sets
- Asking for a correction, deletion or destruction to be notified to the third parties the data was transferred to
- Objecting to an outcome against you that arises from analyzing the processed data solely through automated systems
- Claiming compensation where you suffer damage because the data was processed unlawfully
You can send your request to the address below, from an email address we can verify your identity with. Requests are concluded free of charge within 30 days at the latest; if you are a member or a staff member of a studio, your request is passed to the studio that controls the data and answered together with it.
Request email address: [email protected]
Data security
Your data is protected with the appropriate technical and administrative measures the legislation requires.
- Passwords are never stored in plain text; they are hashed with the bcrypt algorithm.
- Isolation between studios is enforced in the database with row-level security; one studio's query technically cannot reach another studio's rows.
- Every connection is encrypted with HTTPS; secrets such as the WhatsApp connection key are held encrypted in the database.
- Access is role-based (Owner, Admin, Staff, Member); an action the Owner or an Admin takes outside the rules is written to the audit record together with its reason.
- The database is backed up every day; a backup is kept for 30 days and deleted once it expires.
- Sign-in attempts are rate limited; session keys are short-lived, and changing the password closes the other sessions.
How are cookies used?
dakik.studio uses the essential browser records, the marketing cookies that hold the campaign or referral link you arrived through and - where 'Accept' was chosen on the cookie bar - the analytics cookies. The essential records are needed for the site to work and require no consent; your choice is stored for 12 months and can be changed at any time. The application (app.dakik.studio) loads no Google Analytics script and sets no analytics cookie; if you accepted the analytics cookies on dakik.studio, our server reports a studio sign-up or a demo start to Google Analytics once.
The full list of cookies used, how long they last and how to manage them: Cookie Policy
Contact
For questions about the privacy policy and the privacy notice you can reach the Dakik team by email. This text is updated when it needs to be; significant changes are notified to the email address registered to your account, and the "Last updated" date at the top of the page is refreshed.
Privacy requests: [email protected]
General contact: [email protected]