Last updated: 25 July 2026
This policy explains how personal data is processed through ilhankaymak.com, KAiMAK Hair Studio's customer communications, and the first-party support application connected to the business's Instagram professional accounts.
Your personal data is processed by İlhan Kaymak / KAiMAK Hair Studio under Turkish Personal Data Protection Law No. 6698 ("KVKK"). Privacy and data requests: [email protected].
Data is processed to answer service requests, prepare human-reviewed reply drafts, manage appointment enquiries, prevent duplicate processing, secure and troubleshoot the service, and comply with legal obligations. Processing relies on fulfilling your request, legitimate interests, legal obligations and consent where required.
Where necessary, data may be processed by Meta Platforms (Instagram/Facebook infrastructure), hosting/VPS and network-security providers, OpenAI (reply drafting), Anthropic/Claude (reply drafting and classification), and Telegram (human-approval notifications to the owner). These providers may use infrastructure in other countries. Transfers are limited to the stated purposes and handled with data minimisation and appropriate safeguards. Private message data is not sold or used for unrelated advertising targeting.
AI may classify a request or prepare a reply draft. Instagram customer replies are not sent automatically; an authorised person reviews them. Complaints, payments or refunds, legal matters, health or allergy concerns, and unclear or sensitive requests are escalated for manual handling.
Data is retained only as long as needed to resolve the request, maintain service continuity and security, and meet legal obligations. It is then deleted, anonymised or access-restricted. Records subject to a legal retention duty may be retained for that period; backup copies expire through the normal backup lifecycle.
Access is restricted, credentials are kept server-side, and operational records are monitored for security and auditing. No internet transmission can be guaranteed absolutely secure, but reasonable technical and organisational measures are applied.
Under KVKK Article 11, you may ask whether and how your data is processed, request correction or deletion, learn the recipients, object to automated analysis and request compensation where applicable.
Send an e-mail to [email protected] with the subject "Data Deletion Request", your Instagram username and a clear description of the request. We may request reasonable verification to protect account ownership. Valid requests are assessed within 30 days; data without a legal retention requirement is deleted or anonymised in active systems and relevant processors. For step-by-step instructions, see the Data Deletion page.
Instagram, Facebook, WhatsApp and Telegram are also governed by their providers' own terms and privacy policies. This policy may be updated when our processes or applicable law change; the current version and date are published here.
Analytics and advertising tracking start only with your choice. Rejecting them does not block WhatsApp or booking requests. Your choice is stored in this browser for 180 days. Changing it reloads the page.
Analytics consent enables Google Analytics to measure page use and WhatsApp clicks. Advertising consent enables Google Ads and Meta Pixel measurement and storage of advertising click, source and journey identifiers, which may be added to booking forms or WhatsApp messages. Device, connection and interaction data may be sent to these providers, whose infrastructure may be abroad.
Your preference lasts 180 days; local ad source records last up to 90 days. Google and Meta determine their own cookie and server retention periods. Withdrawal clears accessible local ad records and site cookies; it does not delete data already sent, cookies on other domains or HttpOnly cookies.
Hosting and network security logs, external fonts and Cloudflare measurement at the network layer are not managed by this choice. WhatsApp has its own terms when you open it. Use the contact details on the privacy page for data requests.