Privacy Notice
- We process your data to plan and carry out the transport and to keep in touch with you; marketing messages only with your permission.
- The driver's location is shared only during an active job; the customer's location is never collected.
- Location points are deleted automatically after 180 days, job photos 2 years after upload.
- You can delete your account yourself in the app.
Data controller
[ŞİRKET UNVANI], [ADRES], MERSIS: [MERSİS NO]. Contact: destek@[ALAN-ADI].
What we collect and why
| Data | When | Purpose |
|---|---|---|
| Name, e-mail address, language | Request form, sign-in, your profile | Contacting you, signing you in |
| The verified e-mail address, name and account ID from your Google, Apple or Microsoft account | When you sign in with one of them (customers, drivers and staff) | Signing you in and deciding your role (driver and staff accounts are recognised by their e-mail address). Apple's "Hide My Email" address is accepted too. |
| Mobile phone number | Not asked for or shown for now; older accounts may have one | Job SMS messages, if there is one. Accounts store a system-made placeholder number that belongs to no one instead; no SMS is ever sent to it. |
| Vehicle: make, model, year, colour, plate, an optional photo | "My vehicles", requests | Planning the transport |
| Pickup and drop-off addresses with their map position, dates, notes | Requests, jobs, season packages | Carrying out the transport, pricing |
| Optional marketing permission | Request form | Only if you tick it; you can withdraw it at any time |
| Driver location | Only while a job is active (see below) | Live tracking, arrival estimate, dispatch |
| Photos of the car with their time (and position, if the phone gives one) | At pickup and delivery, and of any damage | Evidence of the car's condition |
| Deposit payments: amount, status, the payment provider's reference | When you pay a deposit | Payment and accounting. Card details are entered on iyzico's page; we never see or store them. |
Device information
The app sends four values with every call to our server: the app version (X-App-Version), the
platform (X-Platform: iOS, Android or web), the operating system and its version
(X-OS-Version; on the web the browser and its version) and the device make and model
(X-Device-Model, for example "Apple iPhone15,2"; on the web only the browser name). We use them to
find and fix errors and to know which versions are still in use.
- Every call writes one line to the server log: time, address called, result, duration, your user number and role, and these four values. Phone numbers, e-mail addresses, IP addresses, codes and links are not written.
- Each sign-in (with Google, Apple or Microsoft, and when the app restores your session) is stored with these four
values and the time (
login_event); your latest values are also kept on your account. - We do not read advertising identifiers or any permanent device identifier.
- Your IP address is used only in memory, to limit too many requests; it is not stored.
Location
The driver app shares the truck's position only while the driver has an active job (from "on the way to pickup" until delivery). Positions sent outside an active job are discarded. Customers' locations are never collected.
Tracking link
When a driver is assigned the tracking link shows in the app; if your account has a real mobile number we also send it by SMS. Anyone who has the link can see the job's status, the truck on the map, the arrival estimate and the job photos, without signing in. The link stops working 7 days after delivery or cancellation, and our team can renew it (the old one then stops working at once). Do not share it with people who should not follow your car.
How long we keep it
- Location points: 180 days, then deleted automatically.
- Job photos: 2 years after upload (evidence of the car's condition), then deleted automatically.
- Sign-in records with device information (
login_event): 2 years, then deleted automatically. - SMS sign-in codes (SMS sign-in is currently off): one day (only a one-way fingerprint of the code is stored).
- Server log lines: as long as our hosting and monitoring providers keep logs. TODO(owner): confirm the retention of the Railway logs and of the New Relic plan.
- Jobs, payments and season packages: as long as tax and commercial law requires. TODO(owner): confirm the period with the accountant.
- Requests left without an account: until our team closes them. TODO(owner): decide a deletion period.
Service providers we share data with
| Provider | What for | What they receive |
|---|---|---|
| Netgsm | SMS messages (job updates, tracking link; only to a real number on file) | Phone number and the message text |
| Mapbox, or CARTO (OpenStreetMap) | Map tiles | Your device loads the map images directly: they see your IP address and the map area shown |
| Cloudflare R2 | Photo storage | Job and vehicle photos |
| iyzico | Deposit payments | Name, e-mail, phone number if on file, the address of the job, amount; card details you enter on their page |
| Railway | Hosting of the server and database | All data above, stored on their servers |
| New Relic (only if monitoring is switched on) | Error and performance monitoring | Server log lines (see "Device information") |
| Google, Apple, Microsoft | Signing in with your account | You sign in to that provider in its own window; we receive your verified e-mail address, name and account ID |
Some of these providers keep data outside Türkiye; the transfer is made for the purposes above. TODO(owner): legal basis of transfers abroad (KVKK article 9).
Legal basis
Performing the transport contract you request (KVKK article 5/2-c), our legal obligations (5/2-ç), our legitimate interest in security and evidence of the car's condition (5/2-f), and your explicit consent for marketing messages.
Your rights
Under KVKK article 11 you may ask whether we process your data, get a copy, ask for corrections or deletion, learn who it was shared with, object, and claim damages. Write to destek@[ALAN-ADI]; we answer within 30 days. You can delete your account yourself in the app (see Delete your account).