Privacy Policy

The short version

• To put you in a line we keep a ticket. If you join on WhatsApp we also keep your phone number and the language you write in.
• If you join on the web page we keep no phone number at all.
• We message you only about the line you joined. Reply STOP and the messages stop.
• Phone numbers are removed 30 days after your last message.
• We never sell personal data and never use it for advertising.
• You can delete your data yourself at any time.

Who is responsible

When you join a line, the business you are visiting is the controller of your data: it decides why it is needed. Turnly [legal entity name — to be completed] is its processor and handles the data on its behalf. For visitors of this website and for business owners who sign up, Turnly is the controller.

What we collect

Customers in a line

• The ticket: which service, when you joined, when you were called and served, and whether you checked in.
• If you joined on WhatsApp: your phone number, the language of your messages, and the messages you sent to the line.
• Answers to up to three short questions, only from a fixed list (first name, car plate, party size, a reason picked from a list). Clinics and pharmacies ask nothing.
• A rating, if you give one.

What we never collect from customers

• Age or date of birth, nationality, ID or passport numbers, religion, health details, photos or any other files.

Businesses

• Owner and staff names, email addresses, hashed passwords and two-step sign-in secrets (encrypted).
• Business details and a copy of the trade licence (encrypted, stored privately, visible only to our review team).
• The owner’s phone number, verified by a message the owner sends.

Website visitors

• Anonymous page-view counts in our own database. No third-party trackers.
• IP addresses are not stored; a salted hash is kept briefly to limit abuse.

How we use it

• To run the line and tell you when it is your turn.
• To answer your questions from the business’s own information. If the business uses the AI helper, the text of your question may be sent to an AI model provider; your phone number is not. These exchanges are kept for 30 days to investigate abuse.
• To give the business totals such as customers served and average wait.
• To keep the service safe: reviewing reports, moderating what businesses publish, and keeping an audit trail of sensitive actions.

How long we keep it

• Customer phone numbers, answers and message text: removed 30 days after the last message.
• Individual tickets: deleted after 90 days. Daily totals without personal data are kept.
• AI helper exchanges: 30 days.
• Audit log: 365 days.
• Evidence for an abuse report is kept until the report is resolved, or longer where the law requires. A legal hold overrides the schedule above.

Who else handles the data

See our sub-processor list. Data may be processed outside the country you are in. [Lawyer: confirm transfer mechanism wording under UAE PDPL]

Health information

Turnly is not a place for health information. Clinics, hospitals and pharmacies cannot ask customers any free-text question, and staff are told not to type patient details. This is deliberate: health information in the UAE is generally required to stay inside the country, and our hosting is outside it.

Children

Turnly is a tool for businesses and is not directed at children. We do not ask for or infer anyone’s age. See the Child Safety Policy.

Your rights

• Delete your data yourself: “Delete my data” on your ticket page, or send DELETE on WhatsApp from the same number.
• Stop messages: reply STOP.
• Ask for a copy or a correction: contact the business you visited, or us at [contact email — set CONTACT_EMAIL or MAILBOXES_LIVE].

Security

Connections are encrypted in transit. WhatsApp access tokens, two-step secrets and licence files are encrypted at rest. Staff screens show phone numbers masked.