Privacy and personal data
Updated: 17 October 2026
Controller and contact
Rezerve is provided by the Orvixa company identified below. Orvixa controls account service data. Businesses are separately responsible for their customer records, appointments and communication permissions. Contact support@orvixa.com about your data.
Data and purposes
We process your name, email, phone, password hash or Google identity to provide accounts, together with business, service, customer, appointment, calendar and income/expense records. Google or Apple sign-in processes the selected provider’s account identifier and the profile/email information it supplies; we do not access Gmail or Drive content. Active Google/Firebase authentication SDKs may also process user/device identifiers, general location inferred from IP, usage and diagnostic data for authentication, security and SDK analytics. Documents and map links submitted for business verification are used for review.
Meta connections and WhatsApp data
The Meta connection is currently a limited pilot preparation; it is not yet generally available and live WhatsApp verification codes are not enabled. When this feature is enabled, WhatsApp account and phone identifiers authorized by the business owner, relevant message content, contact/phone details and delivery status may be processed to provide the connection, message centre, phone verification and appointment notifications. Campaigns and bulk marketing are not offered. Permission to import message history or contacts is not inferred from connecting an account; a separate sharing choice is required. Access tokens and temporary Meta data copies are encrypted on the server; temporary message and synchronization inboxes are regularly cleaned under a seven-day retention rule. Meta data is not used for advertising targeting or sold. Meta and WhatsApp process data within their own services under their own privacy policies: facebook.com/privacy/policy and whatsapp.com/legal/privacy-policy.
Healthcare appointments
When you book with a clinic or another healthcare business, the provider, service, date/time and related appointment notes may contain health-related information. These records are processed to manage appointments and are not sent for advertising targeting. Rezerve does not provide diagnosis, treatment recommendations or clinical decision services.
Permissions and advertising
Contacts are read on your device with permission; unselected contacts are not uploaded in bulk. When enabled, an encrypted device token is used with Firebase Cloud Messaging for delivery. Google AdMob in individual accounts and free businesses may process IP addresses, device/advertising identifiers and ad interactions. Google consent screens appear where required; change your choice in Privacy and security.
Location service
If you allow location access, your device’s latitude and longitude coordinates and the IP address of the network request are sent to BigDataCloud to identify your city. These coordinates may reveal a location more precise than city level. The provider may anonymously aggregate these signals to improve the accuracy of its own location data. Location permission is optional; you can select your country and city manually. Independently of device location permission, the Android advertising SDK may infer approximate location from IP and process ad interactions and performance/diagnostic data.
Legal grounds and recipients
Account and appointment processing supports a contract; security and abuse prevention rely on legitimate interests; mandatory records on legal obligations; optional advertising/device permissions on consent where applicable. Records are available only to the relevant user, authorized business and administrators. Providers such as Google/Firebase and the location service may operate abroad; applicable transfer requirements must be observed. Google’s practices: policies.google.com/privacy. We do not offer your data for sale to third parties.
Retention and security
Necessary records remain while the account service is in use. Notification tokens are detached at logout; unused tokens expire after 30 days and the delivery queue after 7 days. Daily server backups rotate over 7 days. Business documents and notification tokens are encrypted with restricted access. After deletion, records required for legal, dispute or security purposes may remain only for the necessary purpose and period; any exception is explained in the response.
Your rights and requests
Depending on applicable KVKK/GDPR law, you can request access, correction, deletion, restriction, objection, portability and withdrawal of consent. Use Account and data deletion in the app or support@orvixa.com. We may need to verify your identity securely. You may complain to the competent data protection authority. Rezerve is not directed at children; parents can report inappropriate collection of children’s data.
Korkutreis Mah. Sezenler Cad. Güneş Apt. No: 1, İç Kapı No: 15, Çankaya / Ankara, Türkiye
support@orvixa.com
MERSİS: 0648177473300001