US Privacy Notice

This Notice is published in Turkish and English with the same content. If you are located outside Türkiye, this English version is the authoritative version for you (see Section 16).

Company Information

• Company: Mobiza Teknoloji
• Brand / service: Planfly
• Privacy requests: legal@planfly.com.tr
• Customer support: destek@planfly.com.tr
• Phone: +90 850 307 90 23
• Address: Ovaakça Santral Mah. Ovaakça Fatih Sultan Mehmet Cad. No: 86/2, 16335 Osmangazi, Bursa, Türkiye
• Website: planfly.com.tr

1. Scope of This Notice

This US Privacy Notice (the "Notice") applies to residents of the United States. It describes how Mobiza Teknoloji ("we" or "us"), which operates the Planfly online appointment platform, collects, uses, discloses and retains personal information when you visit our website, create or use a business account, the dashboard or the Planfly mobile app, are invited to a business's team, contact us, purchase a subscription, receive our messages or take part in our partner program.

This Notice is our notice at collection and privacy policy under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its regulations ("CCPA"), and provides the information required by the comprehensive consumer privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island (together with the CCPA, the "State Privacy Laws"). These laws apply to companies that meet certain thresholds, such as annual revenue or the number of consumers whose information they process, and some of them do not cover information collected in a business-to-business context. Whether or not a particular law applies to us, we honor the rights and requests described in this Notice for all residents of the United States, including residents of California and of each of the states listed above.

Appointments booked with businesses: If you book an appointment with a business through its booking page or booking widget, or a business records you as its customer, the business decides how your information is used, and we process it only on the business's behalf as its service provider and processor (Section 12). The business's privacy notice is linked on its booking page. Staff profiles that a business creates for its team are also processed on the business's behalf.

Relationship with other documents: This Notice complements the Privacy Policy, which describes our processing in more detail and applies to everyone who uses Planfly. If you are a resident of the United States and this Notice differs from the Privacy Policy, this Notice prevails.

2. Personal Information We Collect (Notice at Collection)

In the past 12 months we have collected, and we continue to collect, the following categories of personal information, named as in the CCPA (a detailed list is given in Section 4 of the Privacy Policy):

Where no fixed period applies, we keep personal information only for as long as needed for the purposes for which it was collected, using the criteria in Section 12 of the Privacy Policy (account duration, legal retention duties, limitation periods for claims and the need to prove consents), and then delete or de-identify it. We do not collect characteristics of protected classifications, biometric information or education information, we do not draw inferences to build profiles about you, and we do not process health information for our own purposes.

3. Why We Use Personal Information

We use personal information for the following business and commercial purposes:

• providing the service: creating and maintaining accounts, the dashboard, the mobile app, booking pages and notifications,
• processing purchases: selling and invoicing purchases in Turkish lira, activating and managing subscriptions purchased through Paddle, the App Store or Google Play, and handling refunds and chargebacks,
• customer support and communication, including the chat assistant on our website, and service messages about your account, security and billing,
• security and integrity: authentication, phone verification for the free trial, logging and preventing fraud, spam, bots and misuse,
• debugging, producing aggregated statistics and improving the service, and showing prices in your local currency,
• with your consent, measuring our marketing pages with Google Analytics and sending marketing messages about Planfly,
• running the partner program,
• complying with the laws that apply to us, including Turkish tax, commercial and internet laws, and establishing, exercising or defending legal claims.

4. Disclosure of Personal Information

In the past 12 months we have disclosed, and we continue to disclose, personal information for business purposes to the following categories of recipients:

The sub-processors we use for businesses' customer data are listed in Annex 3 of the Data Processing Agreement. Paddle, Apple, Google and iyzico process the information they collect for payments under their own privacy policies; Paddle's is available at paddle.com/legal/privacy. Orders paid in currencies other than Turkish lira on our website are processed by our online reseller Paddle.com: Paddle.com Market Limited and the Paddle group companies named in Paddle's buyer terms ("Paddle") are the seller and Merchant of Record for these orders and handle payment and billing inquiries, returns and refunds; we receive from Paddle only order data (order and subscription ID, plan, amount, currency, country, tax status, name, email address, payment status and refund or chargeback status), never your card details.

5. Sale, Sharing and Sensitive Personal Information

We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not process personal information for targeted advertising or for profiling in furtherance of decisions that produce legal or similarly significant effects. We have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age. We use sensitive personal information only for the purposes permitted by section 7027(m) of the CCPA regulations (providing secure access to your account and ensuring security and integrity), and not to infer characteristics about you. We do not offer financial incentives, or different prices or services, in exchange for personal information.

6. Your Privacy Choices

• Sale and sharing: Because we do not sell or share personal information, you do not need to opt out. If you send us an opt-out request anyway, we record it and apply it, and we will not start selling or sharing personal information without first updating this Notice and giving you the choice to opt out.
• Global Privacy Control and Do Not Track: We treat a Global Privacy Control signal sent by your browser as a valid request to opt out of the sale and sharing of personal information and of targeted advertising, for that browser and, if you are signed in, for your account. While your browser sends a Global Privacy Control or Do Not Track signal, Google Analytics does not run, and the "Cookie preferences" window shows that the signal is being honored.
• Cookie preferences: Analytics cookies (Google Analytics 4) are used only after you consent in the cookie notice; you can change your choice at any time through the "Cookie preferences" link on our pages or in your browser settings. Details are given in the Cookie Policy.
• Marketing emails: We send marketing messages about Planfly only with your consent. You can opt out at any time using the opt-out link or instructions included in each message or by writing to legal@planfly.com.tr; we will still send the messages necessary for your account, security and billing.
• Your rights: To access, delete, correct or port your personal information, or to make any other request described in Section 7, follow the steps in Section 8.

7. Your Rights

Depending on the state you live in, and in all cases under our policy of honoring these requests for all residents of the United States, you have the right:

• to know what personal information we collect, use and disclose, including the categories of personal information, their sources, the purposes and the categories of recipients, and to access the specific pieces of personal information we hold about you,
• to receive your personal information in a portable and, to the extent technically feasible, readily usable format,
• to request deletion of personal information we have collected from you, subject to legal exceptions (for example, records we must keep for tax purposes),
• to request correction of inaccurate personal information,
• to opt out of the sale or sharing of personal information, of targeted advertising and of profiling in furtherance of decisions that produce legal or similarly significant effects (we do not carry out these activities),
• to limit the use and disclosure of sensitive personal information (we use it only for the permitted purposes described in Section 5),
• where your state's law provides for it, to obtain a list of the third parties, or categories of third parties, to which we have disclosed your personal information,
• not to receive discriminatory treatment or retaliation for exercising your rights: we will not deny you services, charge you different prices or provide a different level or quality of service because you exercised them.

8. How to Submit a Request

Submitting a request: Because we offer Planfly only online and have a direct relationship with our users, we accept requests by email at legal@planfly.com.tr, preferably sent from the email address registered to your Planfly account. Please tell us which right you wish to exercise and your state of residence. You can also view and correct much of your information, and delete your account, in your account settings.

Verification: We verify your identity by matching the information you provide with the information in our records, for example by asking you to confirm the request from the email address registered to your account. For requests to access specific pieces of personal information or to delete sensitive information, we may ask for additional information to reach a higher degree of certainty. We use this information only for verification; we do not ask for your Social Security number, a government ID number or a signed paper letter. Requests to opt out do not require verification. If we cannot verify your identity, we tell you why.

Authorized agents: You can use an authorized agent to submit a request on your behalf. We may ask the agent to provide your signed permission and ask you to verify your identity directly with us or to confirm that you gave the agent permission, unless the agent holds a power of attorney valid under the law of your state. A parent or legal guardian may submit requests on behalf of a child.

Timelines: We confirm receipt of your request within 10 business days and tell you how we will process it. We respond within 45 calendar days of receipt; if reasonably necessary, we may extend this period once by an additional 45 days, in which case we tell you within the first 45 days and explain why. We process requests to opt out or to limit as soon as feasible and no later than 15 business days after receipt. Requests are free of charge; we may decline, or charge a reasonable fee for, requests that are manifestly unfounded, excessive or repetitive, as permitted by law, and we tell you why.

Appointments with businesses: If your request concerns information processed on behalf of a business (Section 12), please send it to the business. If it reaches us, we forward it to the business and help it respond.

9. Appeals

If we decline to take action on your request, in whole or in part, you can appeal by writing to legal@planfly.com.tr with "Appeal" in the subject line within a reasonable period after receiving our decision; we accept every appeal received within 90 days of our decision. Please describe your request and why you disagree with our decision. We respond to your appeal in writing within 45 days of receipt and explain the reasons for our decision; where your state's law allows it and it is reasonably necessary, we may extend this period by the additional time that law permits, telling you about the extension and the reasons within the first 45 days. If we deny your appeal, our response explains how you can contact the attorney general of your state to submit a complaint. Residents of California can also contact the California Privacy Protection Agency (cppa.ca.gov) or the Attorney General of California.

10. Children

Planfly is intended for businesses and is not directed at children under 13. We do not knowingly collect personal information from children under 13 for our own purposes, and we do not sell or share the personal information of consumers under 16. If you believe that a child has provided personal information to us, please contact us at legal@planfly.com.tr and we will delete it. Appointments booked for children are handled by the business with which they are booked (Section 17 of the Privacy Policy).

11. California Shine the Light

Under California Civil Code section 1798.83, California residents can ask whether we have disclosed personal information to third parties for their direct marketing purposes. We do not make such disclosures.

12. People Who Book Appointments and Consumer Health Data

If you book an appointment with a business through Planfly, the business is responsible for your information as the "business" or "controller" under the State Privacy Laws, and we are its "service provider" or "processor": we process your information only on the business's instructions, to provide the Planfly service and under the Data Processing Agreement. We do not sell this information, share it for cross-context behavioral advertising or use it for our own marketing. Please send requests about this information to the business; if we receive one, we forward it to the business.

Some businesses, such as therapists, dietitians or clinics, may collect information that is consumer health data under the Washington My Health My Data Act (RCW 19.373) or similar laws, such as Nevada's consumer health data law. For this data, the business is the regulated entity responsible for its consumer health data privacy policy and for obtaining any required consent, and we act only as its processor.

Planfly is not a "covered entity" under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), does not sign business associate agreements and is not designed to meet the obligations HIPAA imposes. Under the Data Processing Agreement, businesses that are covered entities or business associates under HIPAA agree not to use Planfly to create, receive, maintain or transmit protected health information (PHI).

13. Where Your Information Is Processed and How We Protect It

We are established in Türkiye. Your personal information is processed in Türkiye and, through our service providers, in the United States and other countries, under contracts that require them to protect it. We protect personal information with reasonable security measures appropriate to its nature, including encrypted connections (TLS), access controls, hashed passwords, optional two-factor authentication, encryption of sensitive fields and regular encrypted backups (Section 13 of the Privacy Policy). If a security breach affects your personal information, we notify you as required by applicable state law.

14. Contact Us

If you have questions about this Notice or our privacy practices, write to legal@planfly.com.tr, call +90 850 307 90 23 or write to Ovaakça Santral Mah. Ovaakça Fatih Sultan Mehmet Cad. No: 86/2, 16335 Osmangazi, Bursa, Türkiye.

15. Changes to This Notice

We update this Notice at least once every 12 months and whenever our practices change. This version was last updated on October 10, 2026. We do not use personal information collected earlier for a materially different purpose without notifying you and, where the law requires, obtaining your consent.

16. Language of This Notice

This Notice is published in Turkish and English with the same content. For people located outside Türkiye, the English version is authoritative.