Privacy Policy
This policy applies to all Zabiris software, apps and games and to the zabiris.com website. First you will find the general rules that apply to all of them, then product-specific information under each product's own heading.
1. Scope and who we are
Zabiris is a software business based in Turkey. This policy covers the following services:
- Software for businesses: Zabiris Kids, Zabiris Go (including its Windows printing app, Zabiris Köprü) and the WhatsApp Order & Appointment Bot.
- Apps and games: riBi and Water Garden Pro, published on the App Store and Google Play.
- Website: zabiris.com and its blog.
The data controller's identity, the legal grounds for processing and how to exercise your rights under Turkish data protection law (KVKK) are set out in the KVKK Personal Data Notice.
2. Core principles
- We collect only the data needed to provide the service.
- Data is processed only to provide the relevant service; it is never sold or rented to third parties for marketing.
- Data is shared only where the service requires it (for example, a platform integration) and with competent authorities where the law requires.
- Zabiris does not process or store credit card or bank details.
3. Whose data, and who is responsible?
Our software for businesses involves two kinds of data:
- The business's own account data (business name, authorised person, contact details): Zabiris is the data controller for this data.
- Data about the business's own customers (e.g. child and parent details in Kids, the ordering customer's details in Go and the Bot): the business itself is the data controller. Zabiris processes this data on the business's behalf and only to provide the service (data processor). Requests about this data should first be sent to the business concerned; any such request we receive is forwarded to the business.
In our apps and games: riBi collects no personal data. In Water Garden Pro, signing in with Google/Apple is optional; the game contains advertising and in-app purchases, and Zabiris is the data controller for this data. Details are under each product's heading.
4. What data we process, and why
- Website visitors: visit statistics such as page views and device/browser information (Google Analytics); if you write to us, your message and contact details.
- Business accounts: account, transaction and technical data — to provide the service, invoice, give support and keep the service secure.
- Customers of businesses: the information a business needs to serve them (visits, orders, appointments).
- App and game users: only the information listed under the product's heading, needed for the app to work or to fix problems.
Exactly which data each product processes is set out under the product headings below.
5. Hosting and international transfers
- Our servers are located in the data centres of our hosting provider, GoDaddy, in the United States. Data is backed up regularly.
- Some providers we use as part of the service (Google Analytics and reCAPTCHA, Firebase and Google AdMob, RevenueCat, Meta/WhatsApp, AI services, Apple and Google notification services, the App Store, Google Play and the Microsoft Store) may process data on their own servers abroad.
- AI service used by the WhatsApp Bot: Anthropic (Claude), USA. Messages are not used to train AI models.
- These transfers take place only to the extent the service requires and in line with Article 9 of the KVKK (appropriate safeguards such as standard contracts). Details under Turkish law are in the KVKK Personal Data Notice.
6. Security
- All communication with our server-based services is encrypted with HTTPS/TLS, and browsers are told to use secure connections only (HSTS).
- Every database query is limited to the signed-in business's own records; branch users only see the branches and pages they are allowed to. Platform API keys are stored encrypted.
- Failed sign-in attempts are rate-limited, sign-in and sign-up forms are protected against bots, session cookies are secure and HttpOnly, and personal details are masked in technical logs.
- Passwords are stored irreversibly using the bcrypt algorithm.
- Protection against common attacks such as SQL injection, XSS and CSRF is applied.
- Data is accessed only by authorised people and only when needed to provide the service.
7. Cookies
- Strictly necessary cookies: Zabiris web applications (the Kids and Go panels) use necessary cookies to keep you signed in.
- Analytics cookies: the zabiris.com website uses Google Analytics for visit statistics only if you choose "Kabul et" (Accept) in the cookie banner; if you decline, Google Analytics is not loaded at all. You can change your choice any time via "Çerez tercihleri" at the bottom of the page. Details: Çerez Politikası (Turkish).
- Security: Google reCAPTCHA is used on the Zabiris Kids sign-in and sign-up screens.
- No advertising or profiling cookies are used on our website or panels. Our mobile apps and games do not use cookies; Water Garden Pro uses the device's advertising identifier for ads (see the Water Garden Pro heading).
- You can delete or block cookies in your browser settings; if necessary cookies are blocked, you will not be able to sign in to the panels.
8. Children's privacy
- riBi is designed for children and collects no personal data from them; details are under the riBi heading.
- In Zabiris Kids, children's details are entered by the play-area business; this data is the business's responsibility and is processed by Zabiris only to provide the service.
- Water Garden Pro is not directed at children under 13; we do not knowingly collect personal information from children under 13.
- Our products for children (riBi) show no advertising and build no profiles.
9. Retention
- Zabiris Go: the ordering customer's name, phone number, address, directions, door code and order note are automatically deleted 90 days after the order is closed; raw platform order data after 60 days.
- Zabiris Kids: child names, parent names and phone numbers are automatically anonymised 2 years after the visit or event; the business can erase a parent's details at once on request.
- Technical logs: 30 days (personal details masked); sign-in attempt records: 1 day; audit records: 1 year.
- Business account data is kept for as long as the service continues, plus a 30-day export period; invoice and accounting records for the statutory period (up to 10 years). Full table: Saklama ve İmha Politikası (Turkish).
- When an account is closed, the business may first export its data; the data is then deleted.
- App data kept only on the device (e.g. riBi) stays on your device until you delete it and never reaches Zabiris.
10. Your rights
You can ask at any time to access, correct or delete your data. In services provided to businesses, the data entered into the system belongs to the business concerned. For apps that keep data only on the device (e.g. riBi), Zabiris holds no data about you; deletion is done within the app or by uninstalling it. The full list of your rights under Turkish law is in the KVKK Personal Data Notice.
For requests and questions: destek@zabiris.com
11. Changes to this policy
We update this policy as our products change. The current version is always published on this page and the "Last updated" date at the top changes. We also notify our business customers of significant changes.
12. Contact
For any privacy question or request, you can reach us at:
13. Software for businesses
Services that businesses use through a subscription or licence.
13.1 Zabiris Kids
Cloud-based management software for children's play areas and indoor playgrounds (zabiris.com/kids).
Data we process
- Account data: business name, name of the authorised person, phone number, email address.
- Customer data entered by the business: child's name and age, parent's name and phone number.
- Transaction data: visit records, duration and amount, payment method (the payment details themselves are not stored).
- Technical data: IP address, browser/device information, session logs.
Who is responsible
- For the customer data (children and parents) that a business enters into the system, the business is the data controller. Zabiris processes this data on the business's behalf, only to provide the service (data processor).
Where data is kept
- Data is stored on the servers of our hosting provider and backed up regularly (see "Hosting and international transfers" above).
Cookies and advertising
- The panel uses only strictly necessary cookies for session management.
- Zabiris Kids shows no advertising.
Third-party services
- WhatsApp: parent notification features run on WhatsApp infrastructure and are subject to Meta's own terms.
- Google reCAPTCHA: protects the sign-in and sign-up screens against automated attacks; Google's Privacy Policy and Terms of Service apply.
Retention
- Child names, parent names and phone numbers and notes are automatically anonymised 2 years after the visit or event; fees and durations remain in reports.
- If a parent asks for deletion, the business can erase that parent's personal details from all records at once under Ayarlar › KVKK, using the phone number.
Closing an account
- A business can request closure of its account and deletion of its data by email. Before closing, the business may request an export of its data for at least 30 days.
13.2 Zabiris Go
A web-based order management panel (zabiris.com/go) for restaurants and ghost kitchens selling on several food delivery platforms, plus an iOS/Android mobile order-tracking app.
Data we process
- Account data: business name, name of the authorised person, phone number, email address.
- Order data received from the platforms: the ordering customer's name, phone number and delivery address.
- Order records, amounts, discounts and payment method (the payment details themselves are not stored).
- Platform integration credentials (API keys) that the business provides; these are stored encrypted.
- Menu, product, recipe and cost information entered by the business.
- Technical data: IP address, session logs; in the mobile app, the model and operating system of the signed-in device (for the session list and support) and the device notification token used to deliver order notifications (deleted on sign-out).
- The mobile app shows no ads and does no analytics or user tracking; it does not access location, camera, photos or contacts.
Who is responsible
- For the data of the business's own customers (people who place orders), the business is the data controller. Zabiris processes this data on the business's behalf, only to provide the service (data processor).
Third-party services
- Platform integrations: order data is retrieved from the Trendyol Go, Getir, Yemeksepeti and Migros Yemek accounts that the restaurant has authorised.
- Mobile notifications: order notifications are delivered through Google Firebase Cloud Messaging (FCM) and the Apple Push Notification service (APNs); only the device notification token and the notification text are sent to these services.
Retention
- The ordering customer's name, phone number, address, address directions, door code and order note are automatically deleted 90 days after the order is closed; raw order data received from the platform is deleted after 60 days. Items, amounts and statuses remain for reports.
Account deletion
- Accounts are created by Zabiris. Account deletion can be requested in the mobile app under Ayarlar › Gizlilik ve hesap › "Hesap silme talebi" or by email to destek@zabiris.com. Requests are processed within 30 days: the account, licence, device sessions, notification tokens, store, product and order records are deleted; invoice records that must be kept by law are retained for the statutory period.
13.3 Zabiris Köprü (Windows printing app)
A Windows program for Zabiris Go users that prints order and kitchen receipts on the printers connected to the computer, without a print dialog.
Data the program sends
- The pairing key obtained with the code shown in the Zabiris Go panel (stored on the computer encrypted with Windows data protection).
- Computer name, program version, the names of the printers installed in Windows and the printers chosen for orders and the kitchen.
- Print results (printed / error message), so the panel can show that printing works and report problems.
Data the program receives
- Only the content of the receipts to print (order code, items, amounts, order note and the order details printed on the receipt, such as the customer's name). Receipt contents are not kept on the computer; only job numbers are kept so the same receipt is not printed twice.
Sharing and security
- The program contains no advertising, tracking or analytics. It communicates only with zabiris.com over HTTPS; data is not sold or shared with third parties.
- The Microsoft Store version is distributed and signed by Microsoft.
Removal
- Pairing can be removed with "Remove pairing" in the program or in the panel under Profile › Settings › Printer bridge › Remove. Uninstalling the Microsoft Store version also deletes its settings.
13.4 WhatsApp Order & Appointment Bot
A module that takes orders and appointments with AI through a business's own WhatsApp number.
Data we process
- Account data: business name, name of the authorised person, phone number, email address.
- The name and phone number of the customer who places an order or books an appointment, and (for orders) the delivery address.
- Message data: the messages exchanged between the customer and the bot in order to create an order or appointment.
Who is responsible
- For the data of the business's customers, the business is the data controller; Zabiris processes it on the business's behalf (data processor).
Third-party services
- WhatsApp: the bot runs on WhatsApp infrastructure and is subject to Meta's own terms.
- Artificial intelligence: the Anthropic (Claude) AI service is used to interpret messages, solely for the purpose of creating orders and appointments; messages are not used to train AI.
Retention
- Zabiris servers do not keep message contents, only a customer summary (phone, name, last address, number of orders/appointments, total spent), deleted 2 years after the last conversation. Phone numbers in usage records are deleted after 90 days.
14. Apps and games
Our apps and games published on the App Store and Google Play.
14.1 riBi: Math Game
An iOS and Android math game for children in grades 1–4. No ads, no internet required, no account.
Summary
- riBi collects no personal data and sends no data to any server. Zabiris receives no data from this app.
Information kept on the device
- The name the child enters, the chosen grade, colour and animal, and the number of correct/incorrect answers and answer times are stored only on the device.
- This information is used only for the app to work (topic progress and review schedule).
- The parent PIN is stored on the device in a form that cannot be reversed (as a hash).
Backups
- If your device's own backup feature is on (iCloud backup, Google account backup), this information may be backed up to your own account. Zabiris cannot access these backups.
Purchases
- The full-version purchase is processed by the Apple App Store or Google Play. Your payment details are not shared with Zabiris; the app only learns from the store whether the purchase was made.
Third parties
- The app contains no advertising, analytics, crash reporting or similar third-party services.
Children's privacy
- The app is designed for children; no personal data is collected from children.
- Purchases, settings and external links are behind a PIN-protected parent area.
Retention and deletion
- Data stays on the device until you delete it. You can delete a profile from the parent area, or delete all data by uninstalling the app.
14.2 Water Garden Pro
A puzzle game for iOS and Android. Signing in with Google or Apple is optional; the game contains advertising and in-app purchases. It is not directed at children under 13.
Information we collect
- When you sign in with Google or Apple: display name, email address and profile picture.
- Game progress and scores.
- Collected automatically: device information (device type, operating system version); game usage data (scores, levels, play time); the advertising identifier (for personalised ads); anonymous analytics data.
How we use information
- To provide and improve the game experience.
- To save your game progress and scores and to show leaderboards and rankings.
- To show advertisements (including personalised ads).
- To process in-app purchases.
- To analyse app usage and improve performance.
Third-party services
- Google AdMob — advertising (policies.google.com/privacy).
- Firebase (Google) — authentication, database and analytics (firebase.google.com/support/privacy).
- RevenueCat — management of in-app purchases and subscriptions (revenuecat.com/privacy).
- Sign in with Apple / Google Sign-In — user authentication (apple.com/legal/privacy, policies.google.com/privacy).
Advertising
- Ads are shown through Google AdMob, which may use your device's advertising identifier to show personalised ads.
- You can opt out of personalised ads in your device settings — iOS: Settings → Privacy & Security → Tracking → turn off "Allow Apps to Request to Track"; Android: Settings → Google → Ads → opt out of ads personalisation (or delete the advertising ID).
- VIP subscribers and players who bought the "No Ads" option do not see advertisements.
In-app purchases
- The game offers gold coin packs, power-ups, ad removal and VIP subscriptions.
- All purchases are processed by the Apple App Store or Google Play; we do not store any payment or credit card information.
Data storage and security
- Game data is stored on your device and in Firebase Realtime Database (Google Cloud). Appropriate security measures are applied, but no method of electronic storage is 100% secure.
Problem reports
- If you send a problem report from within the game, the subject and message you write are sent together with the game version, platform, device model, operating system version, language, your user identifier (only if you are signed in), the game state, the most recent game events and your IP address.
- Reports reach Zabiris by email and are used only to investigate and fix the problem; they are not used for any other purpose or shared with third parties.
Children's privacy
- The game is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will delete it.
Retention and deletion
- Game data is kept for as long as your account is active.
- Uninstalling the game removes the data on your device; to delete data stored in the cloud, email us.
Your rights
- Depending on where you live, you may have the right to access your personal data, request its deletion, opt out of personalised advertising and export your data.
Contact for the game
- Email: watergardengame@gmail.com (or destek@zabiris.com).