Privacy policy

• We process the data our customer enters only on their instruction, in order to deliver the service.
• We do not sell data, use it for advertising or train AI models on it.
• Data is hosted in Türkiye.
• Brands cannot see each other’s data; isolation is enforced at the database level.
• When a subscription ends, data is not deleted by itself; it is deleted on the written request of the account administrator.

Our customer enters data about their staff, their customers and their operations into Flactrum. For that data the customer is the data controller: they decide which data is processed for which purpose, they inform their own staff and customers, and they obtain explicit consent where it is required.

Blurpx is the data processor for that data. We process it only on the customer’s instruction and within the subscription agreement, in order to deliver the service; we do not use it for our own purposes.

It varies with the modules the customer uses, but typically:

• Staff records: name, role, shifts, leave, pay and payroll details.
• Customer and loyalty records: name, contact details, points and wallet balance, order history.
• Operational data: orders, payments, stock movements, counts, audit forms.
• Device data: pairing and status information for register and kiosk devices.

Payment card data is not part of this; card details never pass through our system.

Access follows the role and permission structure the customer sets up. Permissions are separated at brand, region and branch level; a branch manager cannot see another branch’s data.

On our side access is limited to the staff needed for support or fault-fixing and is logged. Our access to customer data is exceptional and purpose-bound; there is no routine access.

The application server, the database and the backups are hosted in data centres located in Türkiye. Backups are taken daily and stored encrypted.

• All traffic is encrypted with TLS; the panel opens over HTTPS only.
• Passwords are hashed irreversibly and never stored in plain text.
• Every write is recorded in the audit log: who, when, at which branch, and which value they changed.
• API access is scope-based; keys can be restricted and revoked.
• Rate limiting and session controls are applied against unauthorised access attempts.

We work with a limited number of providers in order to deliver the service. We have an agreement covering data processing obligations with each of them:

If our list of sub-processors changes we update this page and notify active customers in advance.

We do not use customer data to train AI models and do not give it to third parties for that purpose. Our product decisions are based on aggregate usage statistics that cannot be traced to an individual.

If we detect a personal data breach we notify the affected customer without delay in our capacity as data processor; as the data controller, the customer then notifies the Board and the data subjects. For data where we are the controller ourselves, we make the notification directly.

When a subscription ends or is cancelled your data is not deleted by itself; if you subscribe again you carry on where you left off. The account administrator may request an export or deletion of the data in writing at any time. A deletion request is carried out on production systems within 30 days at the latest; copies in backups disappear as the backup cycle completes, within 30 days at the latest. Records subject to a statutory retention obligation (invoices, for example) are kept for the duration of that obligation.

Flactrum is a service for businesses and is not designed for use by anyone under 18. We assume that the person opening a panel account is authorised to act on behalf of the business.

Questions about this policy can be sent to info@blurpx.com.tr.