Privacy policy

This translation is provided for your convenience. The Turkish version is the authoritative one.

This policy explains which data the teamplanOS web app (app.teamplanos.com) and the iOS and Android apps process, why, and what rights you have over that data. In short: we do not sell your data, we do not use it for advertising, and there are no tracking or advertising tools in the app.

Who is responsible?

teamplanOS is human-resources software provided by Belgin Atasoy (natural person; Fikirtepe Mahallesi, Kadıköy / İstanbul, Türkiye; support@teamplanos.com). You are invited to the app by the company you work for. Who is responsible depends on the purpose for which the data is processed:

• Data your employer is responsible for: your employee record, leave, expense and advance requests, payslips, documents, check-in records and similar information that your employer puts into teamplanOS for its HR processes, or that you enter. For this data your employer is the data controller; teamplanOS processes it only on the employer's behalf and instructions (data processor). For requests about this data you can first contact your employer's HR department.
• Data teamplanOS is responsible for: sign-in and audit records we keep for the security of the service, abuse prevention and report (moderation) reviews, support correspondence, and the contract and billing records we hold with the customer company. Because we decide the purpose and means of these activities, we are the data controller for them.

Which data do we process?

• Account data: first name, last name, email address, an irreversible hash of your password, two-step verification set-up and session information.
• Employee record: the job information your employer keeps (position, department, start date and so on) and your profile photo, if any. For highly confidential personal data such as national ID number, IBAN and pay, and for special categories of personal data such as health information (for example a medical report requested by your employer), additional technical and organisational measures apply: they are encrypted separately in the database and only authorised people can see them.
• Requests and records: leave, expense and advance requests, approvals, payslips, documents, check-in records, shuttle attendance, bonus entries, tasks.
• Messages, calls and radio: your in-app chat messages and the files you share. Video meetings, voice calls and push-to-talk radio are not recorded; audio and video are only transmitted to the participants at that moment. For voice calls we keep only who called whom, when and for how long; this also appears in the direct chat between the two of you.
• Guests in link meetings: for a person from outside the company who joins through a meeting link, only the name they type is kept (no account is created); chat inside the meeting is not stored. Guest names are deleted after 30 days.
• Device information: your phone's notification token, the app version and the device model, so that we can send notifications.
• Security records: who did what and when (audit log), sign-in attempts and the connection (IP) address.

What are the phone permissions for?

The app asks for a permission only when you use the feature that needs it; none is mandatory, and if you refuse, the app keeps working apart from that feature.

• Camera: to check in with a QR code, photograph an expense receipt or a profile photo, and join a video meeting.
• Location (only while the app is open): to confirm you are at the workplace when checking in with the wall QR code. The location at the moment of the scan is stored with that check-in record. The app does not track your location in the background and does not follow you continuously. HR may also use its own location when saving the position of a site or a shuttle stop.
• Microphone: to speak in a video meeting, a voice call and on the radio. On the radio your microphone transmits only while you hold the button.
• Photos / files: to attach an expense receipt, a document, a profile photo or an Excel file; only the file you choose is read. An audio file you choose as your ringtone stays on your phone and is not uploaded.
• Notifications: for requests awaiting approval, the outcome of your request, payslips, announcements, messages and incoming calls. You can turn them off at any time in your phone's settings.

Who can see it?

Your information is visible only inside your own company, according to role: employees see their own information and their own team, managers see their team, and HR sees the company. Another company cannot see your data.

Profile photo: the photo added to your record is visible to all users in your company so that colleagues can recognise each other (team list, chat, approval screens). Adding a photo is optional and you can remove it at any time.

Chat messages: in normal use your direct messages are not viewed by HR or the teamplanOS team. Group chats can also be seen by your company's HR administrators if the company has turned that setting on; the app states this inside the group. When a user reports a message as inappropriate, only the reported message and the limited context needed for review (sender, time sent, reason for the report) are passed to your company's authorised HR administrators and the teamplanOS moderation team.

Service providers and transfers abroad

Your data is not sold and not shared for advertising. It is passed to the following service providers only as far as needed for the service to work:

• Hostinger (Germany, Frankfurt): server hosting and email delivery. All of the app's data is kept on our servers in this data centre. Video meetings, voice calls and radio also run through our own server.
• Google Drive (Google): a copy of the backups for disaster recovery. Backups are encrypted before they leave our server; only we hold the key, and Google cannot see the content.
• Apple Push Notification Service and Google Firebase Cloud Messaging: phone notifications. Notifications about leave, expenses, advances and payslips contain no details such as leave type, amount or description (for example "A leave request is waiting for your approval"); chat notifications contain the sender's name and a short preview of the message.
• Anthropic (USA): only when you use receipt reading, the photo of the receipt is sent to Anthropic's AI service to read the amount and date. Anthropic does not use this data to train models; it may retain it for a limited time solely to prevent abuse. You always confirm the amount that was read.

Some of these providers are located outside Türkiye, so your data is transferred abroad. Transfers abroad are based on standard contracts, one of the appropriate safeguards provided for in Article 9 of the Turkish Personal Data Protection Law (KVKK). Where the law requires it, data may be shared with the competent public authorities.

How long do we keep it?

• Data your employer is responsible for: for as long as the employer's teamplanOS subscription lasts and for the period the employer determines. Records of employees who have left are kept by the employer for the periods required by employment and tax law. When a company account is closed, the data is deleted, except where the employer has legal retention duties.
• Trial accounts that are not purchased: deleted with all their data 90 days after the trial ends.
• Security records (sign-in records, IP addresses): 12 months.
• Names of guests who joined a link meeting: 30 days.
• Excel files uploaded for data import: deleted as soon as the import finishes.
• Backups: at most 14 days on the server and at most 30 days in the encrypted remote copy; older backups are deleted automatically after that. Deleted data therefore disappears from backups at the latest by the end of these periods.

Security

All connections are encrypted (HTTPS). Highly confidential and special-category personal data is additionally encrypted in the database. Two-step verification is mandatory for administrator accounts. Data is backed up every 15 minutes. In the apps the session token is stored in your phone's secure key store (iOS Keychain, Android Keystore).

Deleting your sign-in account

You can delete your sign-in account yourself at any time: in the app under Daha fazla → Giriş hesabımı sil, on the web from the Şifre ve hesap page (how to do it). This deletes your sign-in account: the account closes immediately, your sessions and device notification records are deleted, and your employer's HR department is informed. The personnel file kept by your employer (leave history, payslips, documents) is not deleted because of the retention duties in employment and tax law and stays with the employer; to have that data deleted you apply to your employer as the data controller. If you cannot reach your employer or your request was not met, you can write to us; we will pass your request to your employer and follow it up.

Your rights

Under Article 11 of the Turkish Personal Data Protection Law (KVKK) you have the right to learn whether your personal data is processed and to request information about it; to learn the purpose of processing and whether the data is used accordingly; to know the third parties in Türkiye or abroad to whom it is transferred; to have incomplete or incorrect data corrected; to have data erased or destroyed under the conditions of Article 7; to have these corrections and deletions notified to third parties to whom the data was transferred; to object to a result against you arising from analysis solely by automated systems; and to claim compensation if you suffer damage from unlawful processing.

If you are in the European Union or the European Economic Area, you also have the rights granted by the General Data Protection Regulation (GDPR), including access, rectification, erasure, restriction of processing, data portability and objection, and you may lodge a complaint with your local data protection authority.

You can send your request in writing to Fikirtepe Mahallesi, Kadıköy / İstanbul, Türkiye, or from the email address registered in our system to support@teamplanos.com. Please state your first and last name, your contact details and your request clearly. We answer as soon as possible and within 30 days at the latest, free of charge; if the request involves a separate cost, the tariff set by the Turkish Data Protection Board may apply.

Children

teamplanOS is a service for workplaces and is not directed at anyone under the age of 16.

Changes

If we change this policy, we publish the current version on this page; we also announce important changes inside the app.

Last updated: 2 October 2026