BudBnB Privacy Policy and KVKK/GDPR Privacy Notice

Last updated: October 25, 2026

1. Introduction and Identity of the Data Controller

This Privacy Policy and KVKK/GDPR Privacy Notice (“Policy”) explains how personal data is collected, processed, stored, protected, and, where necessary, shared in connection with BudBnB Services provided by Milyem Digital Solutions.

This Policy applies to:

• The BudBnB website.
• The BudBnB web application.
• BudBnB iOS and Android applications.
• BudBnB browser extensions.
• Related account, subscription, support, and technical operations.

Data Controller Information

• Business name: Milyem Digital Solutions
• Address: Badener Ring 65, 75059 Zaisenhausen, Germany
• Email: info@milyemdigital.de
• Website: https://budbnb.com.tr

Milyem Digital Solutions operates in Germany.

BudBnB's primary backend and database infrastructure is hosted on OVHcloud servers located in Strasbourg, France.

This Policy distinguishes processing activities performed by BudBnB as an independent data controller from activities performed on behalf of accommodation operators as a data processor.

2. Applicable Data Protection Laws

Depending on the processing activity and the circumstances of the individual, the following laws may apply:

• The European Union General Data Protection Regulation — GDPR, Regulation (EU) 2016/679.
• The German Federal Data Protection Act — Bundesdatenschutzgesetz (BDSG).
• Turkish Personal Data Protection Law No. 6698 (“KVKK”).
• Applicable electronic communications, cookie, and information security regulations.

BudBnB aims to comply with applicable data protection and security obligations.

3. BudBnB's Data Protection Roles

3.1. Personal Data of BudBnB Users

Milyem Digital Solutions generally acts as an independent data controller for personal data relating to individuals who create an account or use BudBnB, including:

• Account and contact information.
• Authentication and security information.
• Subscription and payment records.
• Support requests.
• Technical information required to operate the Services.

3.2. Personal Data of Hosts' Guests

BudBnB Users may enter reservation and identity information relating to their own guests.

In such cases, the host or accommodation operator generally determines the purposes and legal grounds for processing guest personal data and acts as the data controller.

BudBnB acts as a data processor to the extent that it processes this information on behalf of and under the instructions of the User.

BudBnB does not enter into the accommodation agreement with the guest, originally collect guest information, or determine the legal basis on which the host initially processes that information.

However, BudBnB remains subject to its own applicable data security and processing obligations.

4. Categories of Personal Data We Process

4.1. Account and Authentication Information

When a BudBnB account is created or used, we may process:

• Name or account name.
• Email address.
• Password hash.
• Account identifier.
• Session and authentication tokens.
• Account creation and update timestamps.
• Language and display preferences.
• User permissions.

Passwords are not stored in plaintext.

4.2. Technical and Security Information

To maintain security and troubleshoot technical issues, we may process:

• IP addresses.
• Browser and device information.
• Operating systems.
• Application versions.
• Transaction timestamps.
• Session and access records.
• Technical error and security event information.

We seek to apply data minimization principles to these records.

4.3. Property and Reservation Information

Users may store:

• Property and listing details.
• Accommodation addresses.
• Booking guest names.
• Reservation numbers.
• Check-in and check-out dates.
• Guest counts.
• Reservation amounts.
• Payment and reservation statuses.
• Calendar blocks.
• Other relevant reservation information.

4.4. Guest Identity and KBS Information

The KBS features may process information provided by Users, including:

• First and last names.
• Turkish national identity numbers or other identity numbers.
• Passport or identity document information.
• Date of birth.
• Place of birth.
• Nationality.
• Gender.
• Accommodation address.
• Room information.
• Other relevant KBS fields.

These categories may constitute personal data under KVKK and GDPR.

They are not automatically classified as special-category personal data solely because they identify an individual.

BudBnB does not intend to collect document information that is unnecessary for the relevant service.

5. MRZ Scanning and Document Images

BudBnB provides MRZ scanning in supported mobile applications.

MRZ refers to the machine-readable zone of an identity document or passport.

When this feature is used:

• Document images are processed on the mobile device.
• MRZ reading takes place locally within the mobile application.
• Document images are not stored on BudBnB backend servers.
• Identity card or passport photographs are not stored in the BudBnB database.
• Only text information extracted from the MRZ is transferred to BudBnB when the User chooses to save it.

The MRZ feature is not available in the web application.

Users may review and correct extracted information.

BudBnB does not create a permanent archive of identity document photographs.

6. Forwarded Reservation Emails

BudBnB does not directly access the User's personal email account.

Users may forward reservation notifications to their assigned BudBnB email address.

When they do so, the following information may be processed:

• Sender email address.
• Email subject.
• Message content.
• Booking guest name.
• Listing or property details.
• Reservation number.
• Accommodation dates.
• Guest counts.
• Reservation amount.
• Reservation modification or cancellation information.

BudBnB processes only messages forwarded to its service and does not read the User's entire mailbox.

6.1. Email Receipt Through Cloudflare

Forwarded emails may be received through Cloudflare's email processing infrastructure.

This workflow may use Cloudflare Workers, R2 Object Storage, and Queues.

Messages may be held temporarily within the relevant infrastructure to support reservation processing and error handling.

Temporary message objects successfully processed are removed through the system's deletion mechanism after processing.

Processing failures and retry mechanisms may affect temporary retention periods.

6.2. Location of Email Data

BudBnB's Cloudflare R2 storage used for email objects is configured for a European Union location.

Other parts of Cloudflare's infrastructure may process information in different regions depending on the services used and the account configuration.

EU data residency for R2 does not mean that all Cloudflare Workers, Queues, network routing, or other technical operations necessarily take place exclusively within the EU.

Regional storage or processing restrictions for individual Cloudflare services apply only where those features have been enabled.

7. Automated Reservation Extraction Using OpenAI

BudBnB may use OpenAI API services to extract structured reservation information from forwarded booking emails.

Relevant information contained in an email may be processed by OpenAI, including:

• Booking guest name.
• Reservation number.
• Dates.
• Property or listing details.
• Guest counts.
• Prices and payment information.
• Modification or cancellation details.

Identity, passport, and other document fields separately stored for BudBnB's KBS functionality are not used as inputs to this automated reservation extraction feature.

However, Users should be aware that forwarded email messages may themselves contain personal information.

7.1. OpenAI Data Usage and Location

Information sent through the OpenAI API is processed under OpenAI's applicable contractual terms and data processing conditions.

According to OpenAI's published API data usage policy, customer content sent through the API is not used to train its models unless the customer explicitly opts in.

OpenAI provides European data residency and regional processing options. Availability depends on the account, project, model, endpoint, and applicable data retention configuration.

Unless European data residency is specifically enabled, BudBnB does not guarantee that information processed by OpenAI is stored or processed exclusively within the European Union.

Under standard API configurations, security and abuse monitoring logs may generally be retained for up to 30 days. Contractual, security, or legal exceptions may apply.

Further details are governed by OpenAI's current service and data processing terms.

8. Primary Server Infrastructure and OVHcloud

BudBnB's primary backend and database infrastructure is hosted on an OVHcloud server located in Strasbourg, France.

The primary application infrastructure may process:

• Account information.
• Reservation records.
• Property information.
• Encrypted KBS fields.
• Other relevant application records.

France is a member of the European Union and the European Economic Area.

Hosting the primary server in France does not mean that every processing activity performed by third-party service providers necessarily takes place in France or within the EU.

9. Data Processing by the KBS Browser Extension

The BudBnB browser extension is an optional tool designed to assist with completing supported KBS web forms.

The extension may:

• Allow Users to authenticate with their BudBnB account.
• Store necessary authentication tokens in browser-local storage.
• Retrieve relevant reservation and guest records through the BudBnB API.
• Fill the required fields in the open KBS form when the User initiates the relevant action.

The extension:

• Does not automatically sign in to KBS.
• Does not collect KBS passwords.
• Is not used to read or copy existing KBS records into BudBnB.
• Does not collect general browsing history.
• Does not perform the final submission of KBS forms.
• Does not independently verify official acceptance of a KBS submission.

Information necessary for automatic form filling may be processed temporarily in the browser environment.

This does not constitute direct submission of an official KBS notification by BudBnB's backend.

10. Encryption of KBS Data

Certain KBS identity and document fields stored in the BudBnB database are encrypted at the application level using AES-256-GCM.

This implementation:

• Uses a random initialization vector for each encrypted value.
• Uses authentication tags to verify data integrity.
• Manages encryption keys separately from encrypted database values.
• Rejects unauthorized or corrupted ciphertext during decryption.

The backend can decrypt relevant fields during authorized application operations.

Accordingly, this architecture is not described as end-to-end encryption.

Authorized Users may access or correct the guest information needed for their operations.

Appropriate security measures are applied to the transfer and storage of this information.

11. Retention and Deletion of KBS Data

Identity and document fields recorded specifically for KBS purposes are processed temporarily.

When the User confirms within BudBnB that the relevant KBS procedure has been completed, the corresponding KBS identity fields are deleted from the active database.

BudBnB does not independently verify the result of an official KBS notification through a government system response.

The deletion trigger is the confirmation performed by the User within the application.

The following reservation details may remain after the KBS-specific fields have been deleted:

• Booking guest name.
• Reservation number.
• Check-in and check-out dates.
• Reservation amounts.
• Reservation status.
• Forwarded reservation emails.

Information previously included in backups remains subject to the relevant backup retention and deletion cycles.

12. Purposes and Legal Bases for Processing

Where BudBnB acts as an independent data controller, personal data may be processed for the following purposes and on the applicable legal bases.

The applicable legal basis depends on the specific processing activity.

Where BudBnB processes guest information as a data processor, the relevant host or accommodation operator is generally responsible for determining the underlying purposes and legal grounds.

These descriptions do not constitute unrestricted authorization for processing that requires a separate legal basis.

13. GDPR Data Processing Principles

For activities subject to GDPR, BudBnB seeks to comply with the following principles:

• Lawfulness, fairness, and transparency.
• Specified, explicit, and legitimate purposes.
• Data minimization.
• Accuracy.
• Storage limitation.
• Integrity and confidentiality.
• Accountability.

Personal data is not processed indefinitely for purposes unrelated to the Services.

14. Categories of Data Recipients

BudBnB does not sell personal data to advertisers or data brokers.

Where necessary to provide the Services, personal data may be shared with:

Personal data may also be disclosed to competent public authorities where legally required.

Each service provider receives only the information necessary for its relevant service.

15. International Transfers of Personal Data

15.1. Transfers from Türkiye

As BudBnB operates from Germany and its primary server is located in France, personal data provided by Users in Türkiye may be transferred outside Türkiye.

Such transfers are subject to Article 9 of KVKK where applicable.

Depending on the specific transfer, relevant mechanisms may include:

• An adequacy decision.
• Appropriate safeguards.
• Applicable standard contracts.
• Binding corporate rules.
• Other mechanisms or limited exceptions provided by law.

The relevant host or accommodation operator remains responsible for its obligations as a data controller.

BudBnB is responsible for the applicable transfer obligations in its role as a processor and for cooperating with the User where required.

15.2. Transfers Outside the EEA Under GDPR

Where GDPR applies to a transfer outside the European Economic Area, Chapter V of GDPR governs that transfer.

Depending on the transfer, safeguards may include:

• An adequacy decision by the European Commission.
• Appropriate safeguards under Article 46 of GDPR.
• Standard contractual clauses.
• Other required transfer measures.

The location of BudBnB's primary server in France does not guarantee that all subprocessors operate exclusively within the EEA.

16. Retention Periods

Personal data is retained only for as long as necessary for the relevant purposes or as required by applicable law.

Account and profile information: For the duration of an active account.

KBS identity and document fields: Until the User confirms completion of the relevant KBS procedure, after which these fields are deleted from the active database.

Reservation records: For as long as the User maintains them for reservation management or until the relevant records are deleted.

Forwarded reservation emails: For the period necessary to manage the associated reservation. Temporary raw message objects are subject to deletion once processing and related error handling are completed.

Security records: For a limited period proportionate to security and operational requirements.

Invoices and accounting records: For periods required by applicable tax, accounting, or other laws.

Account deletion: After an account deletion request, associated information not subject to legal retention obligations is generally removed from active systems within 30 days under the normal deletion process.

Legal retention requirements, technical backup cycles, or security needs may require certain information to be retained for longer.

Data remaining in backups is not restored for ordinary operational use and remains subject to the relevant backup retention and deletion cycles.

17. Technical and Organizational Security Measures

BudBnB uses technical and organizational measures proportionate to the risks associated with its processing activities.

Depending on the relevant system, these may include:

• Secure password hashing.
• Session and access controls.
• Authorization restrictions.
• Encryption during transmission.
• AES-256-GCM encryption for certain KBS fields.
• Separate management of encryption keys.
• Data integrity controls.
• Security event monitoring.
• Appropriate error and logging practices.
• Measures designed to prevent unauthorized access.

No electronic system can be guaranteed to be completely secure.

18. Personal Data Breaches

If BudBnB becomes aware of a personal data breach, it will assess the nature and impact of the incident.

Where BudBnB acts as an independent controller, it will comply with applicable GDPR and KVKK notification requirements.

Where BudBnB acts as a processor, it will notify the relevant controller without undue delay after becoming aware of a personal data breach affecting the data processed on the controller's behalf.

The parties will cooperate to investigate the incident, mitigate risks, and make legally required notifications.

19. Cookies and Local Storage

The BudBnB web application may use essential cookies and local storage mechanisms to operate the Services.

These may support:

• Session management.
• Authentication.
• Security.
• Language preferences.
• Theme preferences.
• Application settings.

The browser extension may store authentication tokens and limited account information in the browser's local storage to maintain the User's session.

If non-essential analytics or marketing cookies are introduced, BudBnB will provide appropriate disclosures and consent mechanisms where required by law.

BudBnB does not sell personal data for behavioral advertising.

20. Children's Personal Data

BudBnB accounts are not intended for individuals under the age of 18.

However, reservation and accommodation records may include information relating to children or infants staying at a property.

Such data is not processed to provide BudBnB accounts or Services directly to children. It is processed in connection with the User's accommodation management activities and applicable legal requirements.

The relevant data controller is responsible for ensuring that any processing of children's personal data satisfies applicable legal conditions.

21. Your Rights Under GDPR

Where GDPR applies, you may have the following rights regarding your personal data:

• Right of access — Article 15: Obtain information about personal data being processed.
• Right to rectification — Article 16: Request correction of inaccurate or incomplete personal data.
• Right to erasure — Article 17: Request deletion where the relevant legal conditions are met.
• Right to restriction — Article 18: Request restricted processing in certain circumstances.
• Right to data portability — Article 20: Receive qualifying data in a structured, commonly used, machine-readable format.
• Right to object — Article 21: Object to certain processing based on legitimate interests or other relevant grounds.
• Rights concerning automated decisions — Article 22: Exercise applicable rights concerning solely automated decisions producing legal or similarly significant effects.
• Right to withdraw consent: Withdraw consent for consent-based processing at any time, without affecting prior lawful processing.

The availability and scope of these rights depend on the relevant legal requirements.

You also have the right to lodge a complaint with a competent data protection supervisory authority.

22. Your Rights Under Article 11 of KVKK

Where KVKK applies, data subjects may contact the relevant data controller to:

1. Learn whether their personal data is being processed.

2. Request information if their personal data has been processed.

3. Learn the purposes of processing and whether data is used in accordance with those purposes.

4. Learn the third parties to whom personal data is transferred domestically or internationally.

5. Request correction of incomplete or inaccurate personal data.

6. Request deletion or destruction where the legal requirements are satisfied.

7. Request notification of correction or deletion to third parties to whom the data was transferred.

8. Object to results arising against them from analysis carried out exclusively by automated systems.

9. Request compensation for damage caused by unlawful processing.

Requests are assessed according to KVKK and its applicable secondary legislation.

23. Exercising Your Rights and Contacting Us

For personal data processed by BudBnB as an independent data controller, please contact:

info@milyemdigital.de

Additional information may be requested to verify your identity and prevent unauthorized disclosure.

Requests under GDPR are generally answered within one month, subject to extensions permitted by law.

Requests under KVKK are handled within the applicable statutory period, generally no later than 30 days.

For guest data processed by BudBnB as a data processor, the relevant host or accommodation operator is generally the primary controller to whom a request should be addressed.

Where a request concerning such data is received by BudBnB, we may refer it to the relevant controller or provide assistance, subject to applicable law and technical capabilities.

24. Automated Decision-Making

BudBnB may use automated systems to extract information from reservation emails and create or update application records.

These functions are not designed to make solely automated decisions about individuals that produce legal or similarly significant effects within the meaning of Article 22 of GDPR.

25. Account Deletion and Data Management

Users may manage their accounts and perform supported deletion operations through the relevant BudBnB account settings.

Account deletion requests may also be submitted through the applicable web-based mechanisms or communication channels provided by BudBnB.

Deleting an account does not automatically require immediate deletion of invoices, accounting records, or other information subject to statutory retention requirements.

Requests are assessed according to applicable law, retention obligations, and technical deletion procedures.

26. Updates to this Policy

BudBnB may update this Policy to reflect:

• New product features.
• Changes to technical infrastructure.
• Changes to subprocessors.
• Legal or regulatory developments.
• Changes in personal data processing activities.

The current version will be published on the BudBnB website.

Material changes may be communicated through appropriate channels.

27. Contact Information

Milyem Digital Solutions

Badener Ring 65

75059 Zaisenhausen

Germany

Email: info@milyemdigital.de

Website: https://budbnb.com.tr

Terms of Service: https://budbnb.com.tr/terms

This Policy provides information about processing activities for which BudBnB acts as an independent data controller. It does not replace the privacy and data protection obligations that accommodation hosts owe to their own guests.