Solinflow Privacy Policy

1. What this policy covers

Solinflow is a mobile application that brings a company's human resources processes to its employees' phones. This policy explains which personal data is processed when you use the app, why it is processed, who it is shared with, and what rights you have.

It is written under Turkish Personal Data Protection Law No. 6698 (KVKK).

Effective date: 14 September 2026

2. Who does what

• Data controller: your employer. Your employer decides which of your data is processed and for what purpose. Your account is created by your employer's HR team; there is no sign-up step in the app.
• Data processor: DataSolin Yazılım. We build and host the application and process your data only on your employer's instructions and for the purposes written here.

Requests about your personal data should first be addressed to your employer's HR department. For technical questions about the app itself, contact us at https://solinflow.datasolin.com.tr/destek.

3. What data is processed

Identity	First and last name, national identity number (may be used to sign in), employee number, date of birth, start date, department, job title, worker category
Contact	Corporate e-mail address, internal extension; with your explicit consent, personal e-mail address and mobile phone number
Images	Profile photo; photos of documents you upload such as medical reports and expense receipts
HR records and requests	Leave requests and balances, expense and advance requests and amounts, payroll and document requests, approval steps and approvers; your IBAN as entered by HR (shown only to you)
User content	Survey answers, training and quiz results, ideas and votes, suggestions and complaints, FAQ questions, emergency and occupational safety reports
Health	The medical report you upload for sick leave (special category personal data; processed under KVKK art. 6 to fulfil legal obligations relating to employment and occupational health and safety)
AI and voice	If your employer enables the related features: questions you type or ask by voice to the AI Assistant and the research assistant, files you attach, voice recordings you upload for transcription and their text
Technical	Session data (access and refresh tokens), device push token used to deliver notifications, app version and platform (iOS/Android)
Attendance (timekeeping)	If your employer has enabled Attendance Tracking and included you in it: the date and time of your check-ins and check-outs at the workplace, the name of the terminal and of the workplace location, the verification method (QR code and/or location), the location taken from your device at the moment of the check-in/out (latitude, longitude, accuracy, distance to the workplace area, mock-location flag; including, if your employer so chooses, the location at the moment of a QR code scan), IP address, platform and app version; if your employer enables phone verification, the mobile phone number defined by HR, verification code records, the random device key given to the verified phone (only its hash is stored on the server) and, on Android devices, line information used to detect a change of SIM (operator code and the line’s local sequence ID on the device); working time, late arrival, early leave, overtime and absence information calculated from these records; and the reason for and author of manual corrections
Usage statistics	General in-app path of the screen viewed (e.g. "/leave/new"; never record numbers, names, national ID numbers or e-mail addresses), session start and duration, automatic events such as the first opening, update and removal of the app, a randomly generated installation identifier specific to the app, device type, brand and model, operating system, screen resolution, language and approximate location no more precise than city level (country, region, city) derived from the IP address; in the web version, cookies used for this purpose. This data is collected from the first time the app is opened, including before you sign in.

Not collected: Your device location (GPS) is taken only in the cases described in section 5 (App permissions), at the moment of an action you start; no location is collected in the background and there is no continuous location tracking. The usage statistics service derives an approximate location no more precise than city level from the IP address and does not store the IP address. No advertising identifier (Android Advertising ID / iOS IDFA) is collected. The app contains no advertising network. Usage statistics are not linked to your account and are not used to track you across other apps or websites. Your data is not used for advertising and is not sold to third parties for advertising.

4. Purposes and legal grounds

• Performance of the employment contract (KVKK art. 5/2-c): receiving leave, expense, payroll and document requests, running approval workflows and informing you of the outcome; recording workplace check-ins, check-outs and working time.
• Legal obligation (KVKK art. 5/2-ç): occupational health and safety reports, mandatory training records, statutory retention of personnel records; recording working time and overtime (workplace attendance / timekeeping records).
• Legitimate interest (KVKK art. 5/2-f): account security, prevention of unauthorised access, fault diagnosis through error logs, internal announcements; statistical measurement of which screens of the app are used, and improving the app; verifying, with the location taken at that moment, that a check-in or check-out is made at the workplace; if your employer so chooses, recording where a QR code check-in/out was made; ensuring that check-ins and check-outs are made from your own phone verified by an SMS code.
• Explicit consent (KVKK art. 5/1): only for your profile photo, personal e-mail address and personal mobile phone number (except the number defined by HR for phone verification). Withholding consent does not prevent you from using the core functions of the app; you may withdraw consent at any time.

5. App permissions

The app asks for a permission only at the moment you use the related feature, and only for that purpose:

• Camera: taking a profile photo, photographing a medical report or an expense receipt; scanning the attendance QR code shown on the terminal at the workplace entrance (the camera image is not recorded; only the scanned code is sent).
• Photos: choosing an existing image from your device for the same purposes.
• Microphone: if your employer enables the related features, asking the AI Assistant or the research assistant a question by voice.
• Location: if your employer has enabled Attendance Tracking with location verification, verifying at the moment you check in or out that you are within the workplace area; if your employer so chooses, recording the location at the moment you scan a QR code (not used for verification); on the travel screens, sorting customers from the nearest (the location is sent only for sorting and is not stored) or saving a customer’s location using your device’s location. Location is taken only while the app is open and you are on the related screen.
• Notifications: informing you about the approval status of your requests, new announcements and approvals assigned to you. You can change which topics you are notified about inside the app; however, notifications about official announcements, emergencies/OHS, leave, expense and document (payroll) requests, and tasks assigned to you cannot be switched off.

SMS verification code: if your employer enables phone verification, the verification code arrives on your mobile phone by SMS. On Android the app does not ask for permission to read SMS; it reads only that SMS, and only if you approve it in the window shown by your phone. On iOS the code is entered from the keyboard suggestion.

None of these permissions run in the background, and the rest of the app keeps working if you decline them. If the verification method chosen by your employer requires location, check-in/out cannot be made from the app without location permission; HR can record it manually.

6. Anonymous submissions

For anonymous submissions — suggestions and complaints, anonymous surveys and FAQ questions — your identity, IP address and device information are never stored with your submission and your submission is never linked to you. Because only signed-in employees can make these submissions, your session information and IP address technically reach the server; they are used only at that moment to verify your session and are not stored with the submission. Opening these screens is included in usage statistics like any other screen, without the content of your submission. You can read the reply to an anonymous suggestion or complaint only with the tracking code issued at submission time and kept on your device. If you lose that code there is no way to recover access to your submission; this is a deliberate design choice that protects anonymity.

7. Who your data is shared with

• Inside your company: the details of your requests are visible to the people in your approval chain (your manager, their deputy if any, and HR). Once your leave is approved, your name and leave dates (without the leave type) are sent as a notification to colleagues reporting to the same manager and are shown, with your profile photo, on the team calendar. Your attendance and timekeeping records are visible to HR and to your department manager and their deputy (within the departments they manage); the location taken at check-in/out is visible to them only in the record details and is not sent to service providers abroad.
• Hosting: application servers and the database run on infrastructure managed by DataSolin.
• SMS service: if your employer enables phone verification, your mobile phone number and the verification code are sent to the SMS service provider established in Türkiye (Netgsm) for sending the SMS.
• Notification infrastructure: push notifications are delivered through the Expo notification service (650 Industries, Inc., USA) to Apple (APNs) and Google (Firebase Cloud Messaging). These services receive the device token, the notification title and text, the unread notification count, and the screen and record number opened when the notification is tapped. For system-generated leave request and approval notifications this text contains no name, leave type or dates; the details are shown only on the Notifications screen in the app.
• Usage statistics: screen usage statistics are processed through the Google Analytics for Firebase service provided by Google LLC and Google Ireland Limited, whose servers are located abroad, including in the United States. Your name, national ID number, e-mail address and record numbers are never sent to this service; no advertising identifier is collected, and linking with Google accounts (Google signals) and ad personalisation are turned off.
• AI services: every receipt image you upload with an expense report is sent via OpenRouter, Inc. (USA) to the provider of the selected AI model (e.g. Google, OpenAI) so that the amount and date can be read automatically. If your company enables the related features, your questions to the AI Assistant and the research assistant, attached files and other content required for the task are sent the same way; depending on the selected model, voice questions go either directly to that provider or to ElevenLabs (USA) for transcription. For voice recording transcription, recordings do not leave the country when the local engine is used and are sent to ElevenLabs only if your company selects the ElevenLabs engine. How these providers keep and use that content is governed by each provider’s terms of service and the privacy settings of the account held by DataSolin, which operates the service. If the AI Assistant, research assistant and transcription features are disabled, no data from those features reaches these providers.
• Training videos: training videos are played through YouTube (Google LLC, USA); when a training video screen is opened the player loads from YouTube servers, your IP address and device and browser information are sent to Google, and YouTube may place cookies and similar identifiers on your device.
• Bot protection: Cloudflare Turnstile is used on the web admin panel login and the public account deletion page; your IP address and browser information are sent to Cloudflare, Inc. (USA).
• Legal requests: with competent public authorities where required by law.

Transfers to these service providers located abroad are carried out under Article 9 of the KVKK by signing the standard contracts published by the Personal Data Protection Board with the relevant service providers and notifying them to the Personal Data Protection Authority. Beyond these, your data is not shared, sold or rented to third parties.

8. How long data is kept

• HR and request records (leave, expenses, payroll, approvals): for the duration of the employment relationship and, afterwards, for the retention and limitation periods required by law.
• Attendance (timekeeping) records and their correction records: for the duration of the employment relationship and, afterwards, for the retention and limitation periods required by legislation on working time and wages.
• Notification records and session tokens: short-lived by nature; session tokens are invalidated on sign-out, password change or account closure.
• Anonymous submissions: not linked to an identity, therefore not retained as personal data.
• Usage statistics: event-level and user-level records are deleted in the service provider's monthly automatic deletion run once the 2-month retention period has expired; aggregated reports that contain no name, national ID number, e-mail address or installation identifier may be kept longer. The installation identifier stays on the device until the app is removed or its data is cleared, and the expiry of analytics cookies in the web version is renewed on each visit, so they stay in the browser for 13 months after your last visit.
• Once the period ends, data is deleted or irreversibly anonymised.

9. Security

• All traffic between the app and the server is encrypted with HTTPS.
• In the mobile app, session data is stored in your device's secure storage (iOS Keychain / Android Keystore); in the web version, it is stored in your browser's local storage.
• Your password is stored as an irreversible hash; nobody can read it.
• Open sessions are invalidated immediately on password change, account deactivation or role change.
• Each company's data is isolated at database level; a user of one company cannot see another company's data.
• The details of your requests are visible only to authorised approvers; the dates of your approved leave (without the leave type) are visible to colleagues reporting to the same manager.

10. Closing your account and deleting data

You can ask for your account to be closed by contacting your employer's HR department or through https://solinflow.datasolin.com.tr/destek. If your employer has enabled it, you can also close your account yourself from Profil (Profile) → Ayarlar (Settings) → Hesabımı Sil (Delete my account) inside the app. Your session ends immediately and you can no longer sign in.

HR and request records your employer is legally required to keep (leave, expenses, payroll, approval history) are retained for the statutory retention period; this obligation arises from employment law and is not removed by your request. Those records are deleted once the period expires.

You can also send a deletion request through https://solinflow.datasolin.com.tr/destek.

11. Your rights

Under KVKK art. 11 you have the right to learn whether your personal data is processed, to request information if it is, to learn the purpose of processing and whether the data is used accordingly, to know the third parties to whom it is transferred in Turkey or abroad, to request correction of incomplete or inaccurate data, to request erasure or destruction, to request that correction and erasure be notified to third parties the data was transferred to, to object to a result against you produced solely by automated analysis, and to claim compensation for damage caused by unlawful processing.

To exercise these rights, apply to your employer's HR department as the data controller. For technical support about the app: https://solinflow.datasolin.com.tr/destek · datasolinsoftware@gmail.com

12. Children

Solinflow is a corporate employee application and is not intended for anyone under 18. It can only be accessed with an account created by your employer.

13. Changes to this policy

When the policy is updated a new version is published on this page. You are informed through the app about significant changes, and where your consent is required the app asks for it explicitly.

14. Contact

About the app and this policy: https://solinflow.datasolin.com.tr/destek · datasolinsoftware@gmail.com

For requests about your personal data, please contact your employer's HR department first.