Turny — Privacy Policy

1. Who is responsible for your personal data?

Turny provides queue management, ticket issuance/tracking, and marketer/referral features. This Policy covers the customer app, administration dashboard, marketing website, APIs and associated communications.

Service operator: Ahmed Hafez Taha Eliwa, acting in a personal capacity, not through an incorporated company. Turny is the product/brand name, not a separate incorporated legal entity.

Correspondence address: 3 Ebad El Rahman Street, off El Sharee El Gedid, Shubra El Kheima, Qalyubia, Egypt. This renders the owner-supplied Arabic address.

Turny's administrators handle privacy inquiries and individual rights requests through privacy@turn-y.com, under the operator's responsibility. support@turn-y.com handles general support and payment disputes.

The operator is responsible for processing whose purposes they determine within Turny. Each organization is responsible for information it collects or enters to deliver its services to visitors and for explaining that use. Turny and the organization cooperate on rights requests according to their respective roles, agreements and applicable law, without releasing either from its own duties.

2. Who this Policy covers

This Policy addresses:

• Registered Customers and Guests using the mobile experience or queue/ticket functions;
• organization owners, administrators and staff;
• marketers, referred marketers and people invited to join the platform;
• website visitors and people requesting a demo or submitting an inquiry;
• people whose contact details or names are supplied in organization, staff, marketer, guest-ticket or referral workflows;
• people who submit support requests or issue reports and those whose details may appear in submitted screenshots.

Customer and Guest services are intended for individuals aged 18 or over.

3. What personal data we may collect or generate

We collect information users provide, information generated through platform activity, and limited information received from authorized providers or organizations, where those functions are used.

Do not submit passwords, full card numbers, financial secrets, medical information, national identity documents, or information about other individuals unless a specific authorized workflow clearly requests it and provides an appropriate notice. Users and organizations must take care not to include unnecessary personal/sensitive details in free-text fields or screenshots.

4. How information reaches Turny

• Directly from users through registration, sign-in, profile edits, guest onboarding, booking and tracking, wallet payments, notification settings, issue reports, contact forms and support communications.
• From organizations and their staff when issuing or managing visitor tickets, inviting coworkers, entering contacts, creating requests or administering organization accounts.
• From marketers and invited/referring parties in marketer registrations, invitations, referral relationships and acquisitions.
• From payment processors through payment intentions, confirmations, failures or webhook callbacks.
• From authentication and delivery providers such as Google Sign-In and Firebase Cloud Messaging (FCM), limited to the supported functions.
• Automatically through site/application operation such as API diagnostics, limited rate-limit records, transaction/activity histories, page-view measurement and campaign attribution.

Guests can track tickets using their public codes. Tickets they choose to track are saved on the device; tracking does not associate a ticket with the Guest identity on the server.

5. Why we use personal data

Processing purposes include:

1. Account creation and access: registration, authentication, account recovery, role permissions, age eligibility and account settings.
2. Queue services: listing organizations/queues, issuing and tracking tickets, displaying/communicating queue progress and detecting duplicate or unauthorized ticket use.
3. Payments and accounting: initiating and confirming top-ups, debiting eligible ticket charges, showing balances, processing organization-wallet entries, preserving payment history and managing disputes or necessary reconciliations.
4. Operating organizations: verifying and approving organization registration, managing staff invitations, supporting operational administration and tenant-specific reporting.
5. Marketer program: managing enrollment/invitations/referrals, attributing acquisitions, calculating eligible commissions, maintaining payout information and handling withdrawals/disputes.
6. Communications: identity verification, security notices, transactional emails, push notifications about tickets, wallet receipts and support replies; user-controlled preferences apply where available.
7. Service security and integrity: preventing fraud, abuse, account takeover and unauthorized access, investigating incidents, rate limiting, and keeping appropriate operational/audit records.
8. Customer support and product improvement: handling demo requests, issue reports and optional screenshots, investigating faults and understanding how public marketing pages and CTAs perform.
9. Lawful compliance: responding to legitimate rights requests, preserving required financial records and meeting duties lawfully applicable to the operator.

We do not describe the above as a blanket permission to process data for any unrelated purpose. Materially new purposes must have an appropriate notice and, where required, a separate valid consent or legal condition.

Legal conditions for processing

Processing is subject to applicable law, its consent requirements and permitted exceptions. We seek consent where required and limit processing to the disclosed purpose and necessary information. Publishing this Policy does not itself constitute consent to every type of processing.

Withdrawing an optional consent should stop the activity governed by that consent, subject to another lawful obligation; it need not cancel necessary transactional or security messages.

6. Who may see the data

Access should be limited to the role and purpose necessary:

• The relevant customer/guest, via supported authenticated or securely verified functions.
• The relevant organization and authorized staff, for the queues/tickets, visitor names and operational records they legitimately administer; this does not grant access to unrelated organizations' private data.
• Authorized Turny operators/Super Admins, when needed for approvals, operational support, reports, security, disputes or financial oversight.
• Marketers, for their own program profile, acquisitions, commissions, wallet, referrals and aggregate reporting. The product is not intended to give ordinary marketers another person's private ticket or payment-level records.
• Service providers, on an appropriately restricted basis as described below.
• Competent authorities or claim parties, only when lawfully required or justified and subject to applicable procedural protections.

Some organizational details and ticket lookup information are intentionally displayed or accessible in the relevant public-facing product flow. A public ticket code can enable lookup of certain operational ticket details; it is not intended to authorize broader profile access.

7. Service providers and third parties

Paymob is the only electronic payment-service provider currently used by Turny. It receives transaction and payment-method details required by the selected payment method and its terms.

Turny also uses technical providers for hosting, databases, storage, email, sign-in, notifications and website measurement. Integrations include Google Sign-In, Google's Firebase Cloud Messaging and Vercel. They may process account, contact, device, notification or visit information according to the function used. Service providers have a different role from organizations delivering their own services to visitors.

The current services are not intended to sell customer information or use it for targeted advertising networks. Website measurement described here is separate from direct marketing messages.

8. Cookies, local device storage and analytics

The customer application and administration dashboard necessarily use authentication tokens/session mechanisms and application storage or preferences to maintain sign-in, language, guest identity, locally tracked tickets and similar functions. These are different from advertising trackers.

The marketing-site implementation currently uses Vercel Web Analytics on production pages. Its integration is configured without an analytics cookie or campaign-attribution persistence on the visitor's device; UTM values are read into page memory. Vercel may still receive page-view, referrer/campaign and permitted CTA-event information, depending on live deployment configuration.

9. Notifications, emails and marketing preferences

Turny may send account-verification, password-reset, staff/marketer invitation, transaction-confirmation, ticket/queue and security messages needed to provide or protect the service.

Where implemented, users can select language, ticket-alert thresholds and optional wallet receipt preferences. Push delivery depends on device permissions, token registration and the external push network.

Turny sends operational/service messages only, such as account security, verification, invitations, wallet receipts and queue/ticket notices. It does not send direct promotional/marketing emails, SMS or promotional push notifications under the present policy. This restriction does not disable the separately disclosed production Marketing Website page-view/CTA analytics or user-initiated demo-request replies. Any future direct marketing would require an updated notice and an appropriate lawful permission/opt-in before launch.

A preference to stop optional messages does not necessarily disable critical payment/security correspondence.

10. Data retention

The general retention period is up to five years, calculated from when the data is entered into, or collected and recorded in, Turny's system.

Information may be deleted sooner when no longer needed or following an accepted erasure request. Retention may continue where required by law or where limited retention is necessary for an existing obligation, dispute or continuing service, only to the extent and duration justified by the purpose and law.

This rule covers accounts, tickets, transactions, requests, reports and attachments, subject to those exceptions. Some backup copies may remain until their retention cycle ends, and providers' retention is subject to their applicable duties. Deleting an account does not immediately erase every financial or operational record; the following section explains its effects.

11. Account deletion — what happens

Registered Customer

A Registered Customer may start account deletion from the supported in-app process and must complete the required identity verification and final confirmation.

If there is a pending or unresolved payment, deletion may be temporarily blocked until it is resolved; the customer can retry. In the product-approved behavior, existing Waiting/Serving tickets do not block deletion: once deletion succeeds, associated registered tickets are marked Skipped and queue progression is updated. Eligible direct account/ticket identity fields are removed, and sessions and push-device registrations are invalidated. Financial records and a limited deleted-account record may remain linked by a stable internal identifier. This is minimization and replacement of some identifiers, not a guarantee that every retained record is anonymous or impossible to link to the person.

After deletion, the same email may be used to register as a new account, including through Google. This does not restore the deleted identity, balance, tickets or permissions, or associate the new account with historical financial records. Older deletion records may retain protected email fingerprints; these are not used to prevent new registration and remain subject to retention necessity and applicable rights.

If a positive prepaid wallet balance remains, the app displays the amount and clearly warns that completing account deletion permanently forfeits it. Deletion requires separate, express acknowledgment of losing the displayed amount, which the server checks against the current balance. On completion the balance is set to zero and a debit is recorded, while necessary financial records are retained. Accepting the Terms alone is not that separate acknowledgment. Pending payments still block deletion, and mandatory rights and correction of errors remain protected. See sections 6 and 11 of the Terms of Service.

Guest

Guest identity details and acceptance of the legal documents are retained on the server. The Guest session, tracked-ticket list and walkthrough choice are stored locally on the phone; tracked tickets are restored when the app reopens on the same device. Tickets are not associated with the Guest identity on the server, and no ownership token is issued. The app offers neither Guest data deletion nor clearing the Guest session.

Organization staff enter the visitor name and the system generates a ticket code. Ticket records, statuses and operational history are independent of the local tracked list; the organization continues serving or skipping tickets under its queue rules. A name, code, service location or time may identify a person, so privacy rights and lawful retention requirements continue to apply. Verified data-related requests may be submitted to privacy@turn-y.com for assessment; a common name or public code alone is not sufficient to attribute a record to a person.

Access to deletion

If sign-in or the deletion flow is inaccessible, including because of the age-verification screen, a request can be sent to privacy@turn-y.com. Turny's administrators review it after verifying the requester, taking account of legal duties and others' rights. An unverified name or email submitted by someone is insufficient to trigger deletion.

12. Other privacy rights and choices

Subject to applicable law and lawful exceptions, individuals may request:

• Information about processing, access and an appropriate copy of their data.
• Correction or completion of inaccurate information.
• Erasure, cessation or restriction of processing where the conditions are met.
• Objection to particular uses and withdrawal of consent for optional processing where applicable.
• Legally required information and notices concerning disclosures or incidents.
• Complaints and other rights provided by law.

Turny's administrators handle requests through privacy@turn-y.com or the correspondence address below. Describe the relevant account/request and provide necessary verification without passwords or unnecessary payment information.

Requests are reviewed and answered within applicable legal procedures and time limits. Proportionate identity/authorization evidence may be requested. Any lawful refusal or limitation and available next steps will be explained. Requests concerning organization services may require coordination with that organization without releasing Turny from its own duties.

13. Security

Turny uses controls to protect accounts and information and limit access to authorized people according to their role and necessary purpose, with session protection and review of unauthorized use.

Absolute security cannot be guaranteed. Data incidents are assessed and handled with the measures and notifications required by law.

14. International transfers and hosting locations

Some technical providers may process information outside Egypt, depending on the service, settings and terms. Possible locations include the United States under Vercel's terms, while services such as Firebase Cloud Messaging operate on global infrastructure. The primary database location alone does not determine every processing location.

International transfers are subject to applicable protection, safeguards and legal permission requirements. Service-provider processing may include locations outside Egypt; this Policy does not promise that all processing is restricted to Egypt.

15. Data about other people; reports and attachments

An organization or staff member may enter a visitor name or other authorized contact details to administer a ticket. The organization must have an appropriate right and reason to collect and share that information and must comply with its own notice requirements.

Issue-report screenshots and attached payment proofs can contain personal or financial details of others. Submit only what is relevant, obscure unnecessary information where possible, and avoid including passwords, identification numbers or full card information. Authorized support/administrative personnel may review those files for the relevant purpose.

Attachments are subject to the general retention limit, necessity criteria, rights and exceptions described in section 10.

16. Contact and complaints

Privacy and rights requests: privacy@turn-y.com.\ General support and payment disputes: support@turn-y.com.\ Service operator: Ahmed Hafez Taha Eliwa, acting in a personal capacity.\ Correspondence address: 3 Ebad El Rahman Street, off El Sharee El Gedid, Shubra El Kheima, Qalyubia, Egypt.

Turny's administrators handle correspondence and requests under the operator's responsibility. Individuals may complain to the Egyptian Personal Data Protection Center or the legally competent authority through the available legal procedures. Contacting Turny does not prevent exercise of that right.