Your customers' data, handled properly
Everything on this page is something turnda does today.
Every business is isolated at the database level
turnda uses Postgres row-level security, forced on tenant data. That means the isolation is enforced by the database itself rather than by application code remembering to add a filter — the usual way this kind of thing goes wrong. An automated check runs in the release gate every change has to pass, and it refuses to pass if a tenant table is ever added without that protection — so it cannot quietly regress.
We collect only what a queue needs
Every visitor field — name, email, mobile number, party size, a note — is a switch the merchant controls. Out of the box the join page asks only for a name and an email address, and the kiosk asks nothing. If your front desk does not need an email address, switch it off. Customer names are deleted two days after the visit by default; you choose one day to one year. turnda does not ask for clinical, financial or identity data about your customers; if your team types it into a note or a question, it is kept like any other detail and deleted on your schedule.
Privacy on the lobby TV is enforced, not hidden
A display set to numbers-only is never sent the names in the first place — the restriction is applied where the data is read, not by hiding text in the page. That matters in a waiting room, where a screen is visible to everyone in it.
Secrets and personal data stay out of the logs
Our own logs are scrubbed before they are written: values that look like an email address, a phone number or a key are redacted, and sensitively-named fields are removed at any depth. Crash reports sent to our error monitor are separately restricted — its personal-data collection is switched off and the variables inside a stack frame are never transmitted. So the operational trail your data passes through does not accumulate copies of it.
One channel failing does not take the product down
The tracking page is the primary way a customer sees their turn; WhatsApp and email updates are extras on top. If a messaging channel has an outage, the tracking page keeps working, so nobody is left without a way to know it is their turn.
PDPA and GDPR-shaped, with real deletion
We support data-subject requests, and the things you put in — your business details, your branding — can be cleared by you rather than only by us. If you stop paying, the business moves to the Free package and keeps its data; a Free account nobody signs in to and no visitor joins for 12 months is deleted after two warning emails, and anything can be removed on request.
A pasted logo link is loaded from someone else's server
If you upload your logo, it is stored by us and served by us, and nobody else is involved. If instead you paste a link to your logo on another website, your customers' browsers fetch that image directly from that website — which means that website can see your customers' IP addresses. We do not choose it and have no agreement with it, so it is not on our sub-processor list and cannot be. Uploading avoids this entirely, and it is the option we recommend.
One list, kept in one place
The complete list of companies that process data on turnda's behalf — what each one does, what it can see and where it is — lives on its own page. We update it before adding anyone, and email every business at least 14 days ahead.
What we don't offer
Trust pages usually list only the wins. Here is the other half: what turnda does not offer. If any of it is a blocker for you, tell us and we will give you a straight answer rather than a roadmap promise.
Ask us a security question- Our Data Processing Agreement is part of what every business accepts at sign-up, and we will sign a copy on request. We do not offer a negotiated enterprise agreement or a security-questionnaire process.
- We have no uptime SLA. The product is designed to degrade gracefully rather than to promise a number we cannot yet stand behind.
Security questions we get asked
Can one business ever see another's data?
No. Isolation is enforced by the database through row-level security, and an automated test fails the build if a tenant table is ever introduced without it. It is not left to application code to remember.
Where is our data stored?
In Frankfurt, in the EU. Your data is held in a managed Postgres database run by Supabase; the application itself runs on Fly.io in the same region. If your regulator requires a specific region, tell us before you sign up rather than after — we would rather say no than mislead you.
Do you store card details?
No. Payment details go directly to Stripe. turnda keeps only the last four digits, the card type and the month the card expires, never the full number.
What happens to our data if we leave?
That depends on how you leave. If you close the account yourself, you can reverse it for 7 days — after that it is permanently deleted. Before you close, take what you need: your setup exports as a file at any time, and every report downloads as CSV, Excel or PDF. Individual visit records are not in the export, because we delete customers' details on the retention window you set rather than storing them long-term. If you simply stop paying, the business moves to the Free package and keeps its setup. A Free account is deleted only if nobody signs in and no visitor joins for 12 months, after two warning emails. Either way you can ask us to delete it sooner. Nothing is sold, and nothing is used to train anything.
How long is visitor data kept, and do backups follow the same clock?
You choose the window — anything from 24 hours to a year, and it is 48 hours unless you change it. When it expires the name and contact are erased and any notes or flags are deleted outright. Backups are the honest exception: we take one nightly, keep 14 daily and 8 weekly copies, and automatically place an encrypted second copy of each verified nightly backup in a private store at Cloudflare, so a copy can survive for around eight weeks after it is gone from the live system. Backups are private, used only to recover from a disaster, and never for anything else.
If we send you a screenshot with a support report, what happens to it?
It is stored privately, and only we can see it — it is not public and not shared. We said here that support reports never expired and promised to tell you when that changed. It changed on 19 August 2026: the screenshot and the technical details attached to a report are now erased 30 days after it is made, and a closed report is deleted in full after a year. Both happen automatically. One part is still true and we would rather say it: erasing a customer's data does not reach a support report you sent us weeks earlier — the 30-day window is what limits how long such a screenshot exists at all. So it is still worth avoiding a screenshot that shows a customer's details.
Can we get our data out?
Yes, from inside turnda: your setup exports as a file at any time and every report downloads as CSV, Excel or PDF. Customer details are deleted on the window you set, so individual visits are not kept to export. For one customer, an owner can find and erase everything we hold in one step.
Do you have a security contact?
Yes — email security@turnda.com and it reaches a person, not a queue. It is the address published in our security.txt (at /.well-known/security.txt), and it is for vulnerability reports and nothing else. If you believe you have found a vulnerability, please tell us before disclosing it publicly and we will work with you.
Also see our privacy policy and terms.