Grace VIP Aesthetics & Beauty Center

Legal

Privacy and Cookie Policy

This translation is provided for information only. In the event of any discrepancy or dispute, the Turkish version shall prevail.

Last updated: 06.10.2026

At Grace VIP Aesthetics & Beauty Center, we care about the privacy of everyone who visits our website. This policy explains what information is collected when you use our site, how it is used and how it is protected. For detailed information on the processing of personal data, please see our Personal Data Protection Notice (KVKK).

1. Information collected

  • Information you provide: the full name, phone, email, address and message content you enter in the appointment, order or contact forms.
  • Automatically collected information: server logs such as IP address, browser and device type, pages visited and time of access; these are kept solely for security and error tracking.

2. Cookies and browser storage

The cookies and browser storage strictly necessary for the site to work are:

  • Cart: the products you add to your cart in the online shop are kept in your browser's local storage (localStorage); they are sent to the server only when you place an order.
  • gv_member (member session): keeps you signed in after you sign in with a WhatsApp code or with Google; it lasts 30 days and is deleted when you sign out.
  • gv_google_state (Google sign-in security): used to verify that a “Sign in with Google” request came from you; it lasts 10 minutes and is deleted once sign-in is complete.
  • gv_google_pending (Google sign-in — phone verification step): temporarily holds your Google account information after Google sign-in until you verify your phone number; it lasts 15 minutes and is deleted once verification is complete.
  • gv_lang (language preference): remembers the site language you chose (Turkish/English); it lasts 1 year.
  • gv_admin (administrator session): a session cookie used only when authorized business staff sign in to the admin panel; it lasts 14 days.
  • gv_gads_state (Google Ads connection security): used only to verify the request while an authorized staff member connects the Google Ads account from the admin panel; it lasts 10 minutes and is deleted once the connection is complete.

Ad measurement cookies are used only with your explicit consent (see below). Cloudflare, which provides access to our site, may place its own strictly necessary cookies for security purposes. If an analytics tool is added in the future, this policy will be updated and your consent will be requested where necessary. You can delete or block cookies at any time in your browser settings; in that case, some features such as the cart may not work.

Ad measurement (only with your consent)

On your first visit a cookie preference window is shown. If you choose “Accept”, the Google Ads conversion tag is loaded and Google places cookies in your browser (e.g. _gcl_aw, _gcl_au) to measure whether visitors who clicked our ads used the phone, WhatsApp or appointment steps on our site. This measurement only lets us see the results of our ad spend; it is not used for personalized advertising or remarketing. If you choose “Decline”, the tag is never loaded and no data is sent to Google for this purpose. Your choice is stored in your browser's local storage (gv_consent) and can be changed at any time:

3. Use of information

The information we collect is used only to fulfill your appointments and orders, respond to your requests, keep the site secure and meet our legal obligations. Your information is never sold or rented to third parties for marketing purposes.

4. Third-party links and service providers

  • WhatsApp: WhatsApp links on the site redirect you to the WhatsApp application operated by Meta Platforms; conversations are subject to WhatsApp's privacy policy.
  • Map and social media links: address and Instagram links redirect to the relevant provider's website; our site does not load embedded content from these pages.
  • WhatsApp transaction notifications: appointment request, confirmation and reminder messages, order status updates and the member sign-in verification code are sent to your phone number via WhatsApp.
  • Cloudflare: access to our site is provided through the Cloudflare content delivery network (CDN) and security service; in this context your IP address and request information are processed by Cloudflare. If Cloudflare Turnstile verification is enabled on the contact form, browser and device signals are sent to Cloudflare for verification.
  • Sign in with Google: only if you use this option are you redirected to Google; your Google account identifier and email address are sent to us to be matched with your membership.
  • Artificial intelligence providers (DeepSeek, Google Gemini, Groq): only when enabled in the admin panel, the content of the messages you write in the site chat window and to our WhatsApp line is sent to these providers to generate automatic replies.
  • Hosting: our site and database are hosted on servers located in Germany.

5. Google user data

Our site accesses Google account data only in the two cases below and only with your explicit permission (Google consent screen).

Sign in with Google (members)

  • Data accessed: your Google account identifier, name and email address (openid, email, profile scopes). We do not access your Google password, contacts, emails or files.
  • Purpose of use: solely to verify your identity and match your Google account with your membership on our site so that your appointments and orders can be shown to you.
  • Storage: the Google account information matched with your membership is stored in the database on our own server; no Google access token is stored.

Google Ads connection (authorized business staff only)

  • Data accessed: when an authorized staff member connects the business's own Google Ads account from the admin panel, only the campaign, ad and performance data of that Google Ads account is accessed (https://www.googleapis.com/auth/adwords scope). The Google data of site visitors or members is not accessed this way.
  • Purpose of use: solely to view and manage the business's own advertising campaigns in the admin panel.
  • Storage: the refresh token needed to maintain the connection is stored in the database on our own server; only the authorized administrator account can create or remove this connection.

Sharing, retention and deletion

  • Google user data is not sold, rented or transferred to third parties; it is not used for ad targeting, profiling or training artificial intelligence models. No Google user data is sent to artificial intelligence providers.
  • Data is retained for as long as your membership or the connection continues. You can request deletion of your membership and the Google account match via our contact page.
  • You can remove the access you granted to our site at any time from the third-party access page of your Google account. When the Google Ads connection is disconnected from the admin panel, the authorization on Google's side is revoked and the stored token is deleted.
  • The use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Data security

Your data is transmitted over an encrypted connection (HTTPS); access to the admin panel is password-restricted and regular backups are made. Your card details are never collected or stored on our site.

7. Children's privacy

Our site is not aimed at users under 18. Appointments and treatments for guests under 18 are planned only when accompanied by a parent or guardian.

8. Changes

This policy may be updated when necessary; the current version is always published on this page.

9. Contact

For questions about our privacy policy, you can use our contact page.

Last updated: 06.10.2026.