MarifetTwo different kinds of information
Your business's client names, visit notes, photos and consent records live in the app's local storage. If you enable iCloud backup with an eligible plan, these records also go to the business owner's Apple CloudKit account. In a Salon team, invited members can access the shared salon book. These client records and images are not uploaded to the Marifet API. Separately, Marifet processes account, membership and subscription information to operate its service.
The business decides how to record its clients
The business decides which clients to record, for what service and for how long. Marifet does not store this content in its API, use it for advertising or AI training, or provide a support panel that reads the business's private iCloud book. Device security, Apple account access, sharing invitations and required permissions are under the business's control. Apple's iCloud terms apply separately. Marifet processes its own account, subscription, security and support information within the separate scope described below; this distinction does not remove statutory responsibilities.
Account and service data
If you choose Sign in with Apple, the API processes Apple's account identifier, and the name and email supplied for your account; an Apple private relay address is supported. For teams it stores the business name, owner and member identifiers, roles, CloudKit user identifiers and joining dates. It also stores subscription product and original transaction identifiers, plan expiry and numerical client/photo counts and activity dates. Authentication sessions use hashed bearer tokens and expiry dates. Apple handles payment details; Marifet does not receive your card number.
Why we process it
Account and membership data are used to provide the service you request, authenticate you, manage teams and determine access to paid features. Subscription records are used to validate purchases and maintain access. Technical records are used to maintain security, diagnose failures and protect the service from abuse. Support correspondence is used to answer your request. Where applicable, these activities rely on performance of our agreement, legitimate interests in a secure service, legal obligations, or consent for an optional activity. Business operators must separately identify a lawful basis for their own client records.
Providers and international processing
Apple provides Sign in with Apple, App Store payments and CloudKit. Our account API and this website are hosted on a Hostinger VPS in Frankfurt, Germany. Support email is received through Apple's email service. Providers may process information in other countries under their own infrastructure and applicable terms. Using the owner's iCloud does not mean information stays in Türkiye or the EU. Applicable transfer safeguards and contractual requirements must be assessed for the processing concerned. We do not use advertising SDKs or third-party analytics on this website.
Client records and team access
The professional business decides why it records clients, how long it needs them, and who in its team may access them. Direct requests about a haircut, treatment, visit, photo or consent record to that business. Marifet cannot retrieve client records from the business's private iCloud for you. Salon roles are app-level controls; CloudKit sharing provides broader read/write permissions, so owners should invite only trusted staff.
Retention and deletion
Local client records remain until the business deletes them. Photo-consent withdrawal removes that client's photos through the app; deletion and remote propagation require the relevant devices to sync. Account and team records are kept while needed to provide your account and membership; account deletion removes the active server account, sessions and associated memberships. Backups and technical records may persist until their operational rotation, and limited information may be retained where required for legal claims or obligations. We do not promise immediate removal from every backup. Ask us about the applicable retention of a particular record. The account-deletion guide explains the separate device, iCloud and subscription steps.
Your choices and rights
You may use individual Free/Pro features without creating a Marifet server account. Camera access is requested for capture and can be revoked in iOS Settings. Depending on your location and the processing involved, you can request access, correction, deletion, restriction, portability, or object to processing. You can withdraw consent for activities relying on it. Contact caglarergul@me.com; we may request proportionate identity verification. See Privacy rights for regional information and complaint routes. We do not sell personal information or share it for cross-context behavioural advertising.
Security, children and changes
The app uses iOS protected storage, Keychain for credentials and HTTPS for API traffic. No system guarantees absolute security. Marifet is a professional tool, not a service directed to children. Businesses remain responsible for any lawful guardian consent needed for minors and for handling sensitive or health-related records. We do not use client photos for AI training. This notice will be updated when service practices change; the date above identifies this version.