HelpSettings & accountData & privacy

Data & privacy

This page is your privacy control room — your agreement status, how long visitor details are kept before they're auto-deleted, exporting your setup, and handling a visitor's data request.

Owner & Manager Where: Settings → Data & privacy 5 min read

Your agreement

The data processing agreement card shows whether it's accepted, and when. The agreement itself is published at turnda.com/dpa. In plain terms, you are the data controller for your visitors' information and turnda is your processor — the standard relationship for a tool that handles data on your behalf. Every company that processes data on turnda's behalf, and where that data is stored, is listed at turnda.com/sub-processors.

Retention window

SettingDetail
Auto-delete after (days) How long a visitor's name and contact are kept after their visit before they're automatically deleted.
Default 48 hours (2 days)
Range you can set 1 day to 1 year
When a change applies Lowering it also reaches visits that have already ended and appointments already made, at the next clean-out. Raising it only applies to future visits.
Who can change it Owner only.

Short by design — turnda holds visitor personal data only as long as it's useful, then removes it for you.

Reports keep your visit history (without visitors’ personal details) for as long as your account is open; personal details are erased after your retention window (2 days by default).

What your visitors are told, and where

You do not have to write a privacy line for your visitors — turnda puts one on the pages that collect their details, at the moment they are asked.

It is a short sentence with Privacy and Terms next to it, both opening in a new tab so nobody loses what they were typing.

Where the privacy line appears — and doesn't

PageWhat it says
The join page “We use your details only to hold your place and show you on your phone when it’s your turn.” Shown whether or not you ask for a phone or email, so a tap-only join page still carries it. If a location has switched on the review request, the line adds that one review request email may follow, and does not say “only”.
An old WhatsApp poster link A visitor can no longer join by WhatsApp. An old poster link opens the normal join page for the same line, which carries the join sentence above.
The appointment page “We use your details only to hold your appointment and remind you about it.”
The counter tablet The same join sentence — but only if the tablet actually asks for something. A tap-only kiosk collects nothing, so it claims nothing. Under the sentence, Privacy is a real link to the English Privacy Policy and opens in a new tab; Terms is plain text there.
A visitor's own appointment page Nothing. It shows an appointment they already made and asks for nothing new, so there is nothing to disclose.
The tracking link Nothing either — that page asks the visitor for no details at all.
  • It never quotes a deletion period. That is your setting above, and any number here would be invented.
  • It links the published Privacy and Terms, not the versions inside the app — those are written for you as the business owner and would confuse a visitor.

Export & requests

Two more tools live here — Export my data downloads your account configuration as a JSON file or an Excel workbook, and Visitor data requests lets you look up or erase the data held on one person. Closing the account is also reached from here.

Retention field read-only? Data & privacy settings are owner-only — a manager sees them but can't change them: “Only the owner can change data & privacy settings.”

How your data is kept apart and safe

The plain-English promises behind your data.

What happensWhat it means
Can another business see my visitors? No. Each business's data is walled off by the database itself. If a request ever lacks a business, it gets nothing back, not everything.
Visitor links Visitor pages, the lobby TV and tracking links use a random code. Nobody can browse from one business to another by changing a link.
Practice visits Visits made in test mode are kept apart, so they never mix into real numbers or messages.
Encryption All traffic uses HTTPS, and stored data is encrypted by the database provider.
Where it is held The database, files, sign-in and the nightly backups are in Frankfurt, in the EU. The encrypted second copy of each backup is kept with a different supplier (see Backups below). Requests may pass through other places on the way.
Backups Backups run nightly, so in a severe failure up to 24 hours of data could be lost. Each verified nightly backup is also copied automatically, encrypted, to a separate private store at a different supplier, so one lost account cannot take everything. The Privacy Policy says so plainly.
Network addresses The address used to stop abuse is held for at most 15 minutes, and elsewhere only as a one-way fingerprint.
Outside AI No outside AI service is connected to turnda, and your data is never used to train one. Wait-time guesses use ordinary statistics from your own history.
What we do not promise There is no uptime guarantee. Backups are nightly, so in a severe failure up to 24 hours of data could be lost.

Where to read the rules, and when they change.

What happensWhat it means
Terms of Service and Privacy Policy Public pages, with key points in plain words and a version and date. Links to both sit in the footer of sign-in and public pages.
Who is behind turnda The company page says: Skandan Pte. Ltd., a Singapore company, with its registered details and contact. The footer links to it, and the company is named on legal pages, owner emails and receipts.
A visitor wants to see, fix or delete their details They email the privacy address on the Privacy Policy and get a reply within 30 days.
If the Terms or Privacy Policy change We email the owner and show a banner in the app, “We're changing our Terms and Privacy Policy on (date)”, at least 30 days before, unless the law requires otherwise. Once the new version is live, the owner is asked to Accept it (“We've updated our Terms and Privacy Policy”). Your line keeps working either way.
A new sub-processor We update the list before adding anyone, and email every business at least 14 days ahead.
A security breach The data processing agreement promises to tell you without undue delay, and within 72 hours.
Cookies on the website Visitors in the EU and UK are asked whether to allow analytics. This includes Cyprus, Ceuta and the EU's overseas regions (such as Réunion and Guadeloupe). The site works the same either way, and the choice is remembered in their browser.