Privacy notice

Operator and scope

Yonelio is operated by DOKTORLAR TEKNOLOJI VE SAGLIK YAZILIMLARI TICARET LIMITED SIRKETI, based in Türkiye, at the address below. This notice covers the website, manager accounts, resident access, property records and support. You provide account and support information directly. Your property manager can also enter information about you, your apartment and your financial records without creating an app account for you. The manager maintains those property records; the Yonelio operator provides the service and handles service-related privacy requests. Their precise controller and processor responsibilities still require documentation.

Information used

Manager accounts use names, email addresses, password hashes and account-verification records. Property records may contain names, owner or tenant roles, apartment links and their history, contact details, vehicle plates and parking details. Financial records contain charges, recorded payments, advances, currencies, dates and correction reasons. Messages, attachments, survey questions and votes contain the information users submit. Votes are linked to a person or apartment connection and are not anonymous. Uploaded files may retain embedded metadata; it is not automatically stripped. Network addresses and technical request information can be handled for delivery, access control and abuse prevention. The app does not ask for national identity numbers, bank-account details, profile photographs or precise device location. Do not include unrelated sensitive information in messages or files.

Purposes and processing grounds

Yonelio uses these records to verify accounts, enable sign-in, maintain buildings and apartments, assign charges, record payments received elsewhere, apply eligible person-specific advances, preserve financial history, and support resident requests and surveys. Contact information is used for requested verification and service support. Yonelio does not process online payments or connect to a bank account. The operator must identify the applicable legal ground for each purpose and the relevant country; that assessment is not yet complete. This notice is not a request for blanket consent, and adding a person to a property is not evidence of their consent. Yonelio uses content rules, reports and communication restrictions to prevent abuse. When you report content or an author, Yonelio records your account or resident access identifier, the selected reason, the reported item and the review status. Authorized Yonelio moderators can review the reported message, attachment or survey and take action. A report links to the original item and does not keep a separate copy of its content.

Resident access and who can see records

Adding a person does not send an invitation or require acceptance before a manager can record their charges. A manager may separately enable resident phone access; an SMS is requested when the resident asks for a code at sign-in or during verification. Managers see the properties they are authorised to manage. An owner can see the financial records of their linked apartment; a tenant can see only their own financial records. Internal management notes are not shown to residents. Ending an apartment link ends access through that link, while its property and financial history remains subject to retention and review.

Service providers and international processing

Cloudflare hosts the website and application traffic. Private attachments use Cloudflare R2 with the EU jurisdiction setting. Account and property records use Neon PostgreSQL deployed in Frankfurt, Germany. Resend, configured in Ireland, receives the destination email address and verification or password-reset message. Twilio Verify receives the phone number and verification information to deliver and check requested SMS codes; mobile carriers also handle SMS delivery. Support email can be routed to the operator’s support mailbox. These services can process technical, delivery or support information outside your country. An EU storage setting does not mean every provider operation stays in the EU. Applicable transfer safeguards and provider agreements still require confirmation; this notice does not claim they have been signed or approved.

Retention and the deletion target

For a verified deletion request, the company aims to remove eligible data from active systems within 7 working days of accepting the request. This is a handling target, not an automatic timer or confirmation that every copy has been erased. The company’s policy is to retain payment and collection records for 10 years for accounting purposes; it is not a claim that every country requires that period. That financial policy does not apply to resident messages or files. Applicable law, purpose and any justified legal hold must be assessed for each retained category. The financial retention period’s start and category-specific exceptions still require confirmation. Backups and provider-held records need separate retention and deletion handling; their exact schedules are not yet confirmed. Their removal is not confirmed by deletion from the active application.

Sign-in identity, property records and handover

Removing sign-in access is different from erasing all personal data. The person’s apartment links, debts, payments and advances are not automatically erased. A last manager, or a manager responsible for recurring charges, needs an accepted handover to an existing verified manager before the application can remove that manager identity. The recipient must accept explicitly. For residents, the verified request covers resident access associated with the verified phone number, not just the apartment currently open. Account settings show whether verified deletion requests can currently be accepted and whether a management handover is required. You can also submit a privacy request using the contact details below; the handover safeguard does not replace review of your legal rights.

Resident messages and files: deletion workflow

A newly accepted, verified resident deletion request removes sign-in access and the resident’s own messages, submitted request titles and categories, and attached-file details from active application records. Physical files are removed separately from private storage; content deletion is confirmed only after all targeted files have been confirmed removed or absent. These deletions cannot be undone. The thread’s person, apartment and date context, and management’s own messages and files, remain for separate retention review. Property, financial, vehicle and survey records are not automatically erased by this workflow. Provider records and backups require separate handling; complete data erasure is not confirmed by completion of the resident-content step.

Your rights and requests

Depending on the applicable law, you may ask whether and why your information is processed, request access or correction, learn about recipients, request deletion or restriction, request a portable copy, or object to processing and certain solely automated decisions. You may also withdraw consent where processing relies on it and complain to the relevant data-protection authority. Send your request to info@yonelio.com or the postal address below, identifying the account or property and the action requested. We may verify your identity and coordinate with the property manager; never send passwords or SMS codes. The company aims to respond as soon as possible and within 30 days. KVKK requests are subject to its 30-day deadline; where the GDPR applies, its one-month deadline and permitted, reasoned extensions apply. Any applicable earlier deadline takes priority; identity checks do not create an unrestricted new response period.

Security and session storage

The application uses encrypted connections, authentication, property-level permissions and private attachment access controls. These measures reduce risk; they do not guarantee that a service can never be compromised. Access tokens are held in memory rather than browser local storage, and reloading the web app requires sign-in. The current website and application code do not include advertising pixels or marketing analytics. Hosting and communication providers still process technical information needed for delivery and security. Financial corrections preserve the original entry and correction reason instead of silently replacing the history.

Updates and outstanding details

This notice will be updated when the service, provider arrangements or verified retention procedures change. The date above identifies this version. Legal grounds for each purpose, controller and processor responsibilities, international-transfer safeguards, and backup and provider retention details still need to be completed. Until then, this notice describes the verified service and the company’s stated targets; it is not a declaration of complete GDPR or KVKK compliance. Contact the operator below for the status of a request or clarification about a particular record.

Contact and privacy requests

Service operator: DOKTORLAR TEKNOLOJI VE SAGLIK YAZILIMLARI TICARET LIMITED SIRKETI

Company country: Türkiye

Registered address: Merkez Mahallesi, Hasat Sk. No:52, 34381 Şişli/İstanbul, Türkiye

Phone: +90 551 204 52 20

Support email: info@yonelio.com

Email routing is being set up. Please use the phone number until email support is confirmed.

Database deployment

Neon · Frankfurt, Germany (AWS eu-central-1)

The purpose-specific legal grounds, controller and processor responsibilities, international-transfer arrangements, and detailed backup and provider retention schedules still need to be specified and reviewed. This notice does not certify that those legal and operational arrangements are complete.