Skip to content

Legal

KVKK Privacy Notice

Last updated: ·Version 1.0-taslak

Türkçe

This privacy notice has been prepared by [Şirket Unvanı] (the "Company"), as data controller, to inform users of the Hani website and mobile apps ("Hani") in accordance with Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK").

For a plainer explanation, see our Privacy Policy.

The Turkish version prevails in case of conflict.

Contents
  1. 1.Data controller
  2. 2.Categories of personal data processed
  3. 3.Purposes and legal bases
  4. 4.How personal data is collected
  5. 5.Transfers of personal data
  6. 6.International transfers
  7. 7.Retention periods
  8. 8.Your rights under KVKK Article 11
  9. 9.How to apply

1.Data controller

Legal name
[Şirket Unvanı]
MERSİS No
[MERSİS No]
Address
[Adres]
KEP address
[KEP adresi]
Email
[e-posta: privacy@…]
VERBİS record
[VERBİS kaydı]

2.Categories of personal data processed

  • Identity

    Data
    First and last name (only if you sign in with Apple or Google, as provided by them)

  • Contact

    Data
    Email address (from the sign-in provider; may be an Apple relay address)

  • Customer transaction

    Data
    Scan records (date, country, recognised product, recognition method, barcode/brand/model number), product feedback, clicks on seller links, price alerts, Premium membership and purchase information, preferences

  • Visual records

    Data
    Product photos taken or selected for scanning and the text read from them

  • Transaction security

    Data
    Random device ID, account and session identifiers (hash of the session key), IP address, browser/app information (user agent), server logs, error reports

  • Marketing

    Data
    Not processed. No advertising ID, advertising or analytics cookies are used.

No special categories of personal data (health, biometric data, etc.) are processed. No face or person recognition is performed on photos; photos are expected to show only the product.

3.Purposes and legal bases

  • Recognising the product in the photo and listing seller prices

    Data category
    Visual records, transaction security (device ID)
    Legal basis
    Directly related to the establishment or performance of a contract (Art. 5/2-c)

  • Searching Google for the photo via SerpApi when the product is not recognised

    Data category
    Visual records
    Legal basis
    Explicit consent (Art. 5/1) — Explicit Consent

  • Storing photos to measure and improve recognition quality (optional)

    Data category
    Visual records
    Legal basis
    Explicit consent (Art. 5/1)

  • Membership, sign-in and syncing across devices

    Data category
    Identity, contact, transaction security
    Legal basis
    Establishment or performance of a contract (Art. 5/2-c)

  • Providing price alerts, price history and Premium features

    Data category
    Customer transaction
    Legal basis
    Establishment or performance of a contract (Art. 5/2-c)

  • Information security, preventing abuse and overload (request limits)

    Data category
    Transaction security
    Legal basis
    Legitimate interest of the data controller (Art. 5/2-f)

  • Detecting errors, measuring and improving the service

    Data category
    Transaction security, customer transaction
    Legal basis
    Legitimate interest of the data controller (Art. 5/2-f)

  • Tracking affiliate revenue

    Data category
    Customer transaction (click records)
    Legal basis
    Legitimate interest of the data controller (Art. 5/2-f)

  • Responding to requests from competent authorities, statutory obligations

    Data category
    All relevant categories
    Legal basis
    Expressly provided by law and legal obligation (Art. 5/2-a, ç)

  • Establishing, exercising and protecting rights in disputes

    Data category
    All relevant categories
    Legal basis
    Establishment, exercise or protection of a right (Art. 5/2-e)

4.How personal data is collected

  • Electronically and by automated means through the app and website: when you scan, change settings or click a seller link.
  • Through the identity token (ID token) that Apple or Google send us when you sign in with them.
  • Through the transaction information provided by the app stores (App Store, Google Play) when you buy Premium.
  • When you write to us by email or KEP.
  • Through strictly necessary cookies and browser storage on the website (Cookie Policy).

5.Transfers of personal data

Your personal data may be transferred to the following groups of recipients, limited to the purposes above and in accordance with KVKK Articles 8 and 9:

  • Service providers (data processors): Companies providing us with image processing and AI, web search, storage, hosting, error monitoring and authentication services (table below).
  • App stores: Apple and Google, for Premium purchases and subscription management.
  • Competent public authorities: Upon request from legally authorised bodies and limited to the scope of the request.
  • Legal and financial advisers: Where necessary to protect rights and meet legal obligations, under a duty of confidentiality.

  • Google Cloud Vision (Google LLC)

    Data received
    Scan photo (max. 1024 pixels)
    Purpose
    Reading text (OCR), detecting logos and locating the product in the photo
    When
    Photo scans not resolved by barcode
    Location
    USA and Google's global infrastructure

  • Modal Labs, Inc.

    Data received
    Scan photo
    Purpose
    Computing a visual similarity vector (recognising the product by appearance)
    When
    Photo scans not resolved by barcode
    Location
    USA

  • Google Gemini API (Google LLC)

    Data received
    A downscaled copy of the photo (512 pixels) and the text read from it
    Purpose
    Extracting product attributes such as brand, model and capacity
    When
    When the product cannot be identified by barcode or model number
    Location
    USA

  • Anthropic PBC

    Data received
    A downscaled copy of the photo (512 pixels), the text read from it and candidate products; text only for web search
    Purpose
    Choosing the right product among candidates
    When
    When the visual match is ambiguous
    Location
    USA

  • SerpApi LLC → Google (Lens, Shopping)

    Data received
    Only with your explicit consent: the photo cropped to the product (max. 500 KB). Always: search text such as product name and model number
    Purpose
    Searching the wider web for the product and its cheapest price
    When
    Photo: when the product is not recognised and you consented. Text: during web search
    Location
    USA

  • Cloudflare, Inc. (R2 storage)

    Data received
    Photos you chose to share for quality improvement
    Purpose
    Storing those photos
    When
    Only if you turned this option on
    Location
    [R2 storage location]

  • [Hosting provider]

    Data received
    Account, device ID, scan, click and alert records (database and cache)
    Purpose
    Hosting our servers
    When
    Always
    Location
    [Server location]

  • Apple Inc. / Google LLC (sign-in)

    Data received
    Authentication: Apple or Google sends us your name, email and account identifier
    Purpose
    Letting you sign in to your account
    When
    When you sign in with Apple or Google
    Location
    USA

  • Functional Software, Inc. (Sentry)

    Data received
    Error reports: error message, page address, app version, browser/device type. IP address, cookies and device ID are removed before sending
    Purpose
    Detecting and fixing errors
    When
    When an error occurs
    Location
    [USA or EU — Sentry data region]

  • Apple App Store / Google Play

    Data received
    Premium purchase and subscription information (we never receive your card details)
    Purpose
    Processing payment and managing the subscription
    When
    When you buy Premium
    Location
    USA / Ireland

No personal data is transferred to sellers or affiliate networks; your identity and device ID are not added to seller links.

6.International transfers

Some of the service providers above have servers abroad, primarily in the United States. Your personal data is therefore transferred abroad under KVKK Article 9:

  • Transfers necessary to perform the service (processing photos for product recognition, hosting, error monitoring, authentication) are made under the standard contracts published by the Personal Data Protection Board, which are notified to the Authority within five business days of signature (Art. 9/4).
  • Transferring your photo to Google via SerpApi for a web search is additionally based on your explicit consent. If you don't give consent, your photo is not transferred abroad for this purpose.

7.Retention periods

Your personal data is kept for as long as required by the purpose of processing and by the relevant legislation; at the end of that period it is deleted, destroyed or anonymised in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data. Details are set out in the [Personal Data Retention and Destruction Policy].

  • Scan photos (default)

    Retention period
    Not stored. Processed in memory only while the scan runs.

  • Cropped photo, extracted text and IP address held for web search

    Retention period
    At most 10 minutes (so the search can start if you consent), then deleted automatically.

  • Photos you shared for quality improvement

    Retention period
    Until you delete your account or your data, at most [24 months]; then deleted automatically. Removed from storage within an hour of a deletion request.

  • Cached scan and web search results

    Retention period
    24 hours.

  • Scan, feedback and click records

    Retention period
    [24 months], then anonymised (unlinked from account and device). Anonymised immediately when you delete your account or your data without an account.

  • Device ID and linked preferences (use without an account)

    Retention period
    Deleted after [24 months] of inactivity (kept until an active Premium period ends). You can delete it right away with "Delete my data" in the app.

  • Account details (name, email, sign-in method), price alerts, Premium status

    Retention period
    As long as your account exists. Deleted immediately when you delete the account.

  • Session records (IP address, browser/device info)

    Retention period
    For the life of the session (max. 180 days); ends when you sign out or delete the account, and the record is deleted within an hour.

  • Security log (time and IP address of sign-ins, sign-outs, consent changes and deletions)

    Retention period
    [1 year], then deleted automatically. Kept for that period for security and abuse detection even if you delete your account; contains no name or email.

  • Rate-limit and daily usage counters (IP address, device)

    Retention period
    Between 1 and 26 hours.

  • Server logs (request path, status code, duration)

    Retention period
    [30 days].

  • Error reports (Sentry)

    Retention period
    [90 days].

  • Consent records (when given / withdrawn)

    Retention period
    Each grant and withdrawal is kept for evidence purposes for [10 years] (limitation period), even if you withdraw consent or delete your data, then deleted.

  • Suspended sign-in identity record (sign-in provider + one-way hash of the sign-in ID)

    Retention period
    If a suspended account is deleted, kept for the same period as consent records, at most [10 years], to stop a suspended user from bypassing the suspension by re-registering. No email, name or other personal details are kept; deleted immediately if the suspension is lifted.

  • Requests and correspondence

    Retention period
    [10 years] (limitation period).

8.Your rights under KVKK Article 11

By applying to the data controller, you have the right to:

  1. learn whether your personal data is processed,
  2. request information if your personal data has been processed,
  3. learn the purpose of processing and whether the data is used in line with that purpose,
  4. know the third parties in Türkiye or abroad to whom your personal data is transferred,
  5. request correction if your personal data is incomplete or inaccurate,
  6. request deletion or destruction of your personal data under the conditions set out in KVKK Article 7,
  7. request that correction, deletion and destruction be notified to the third parties to whom your data was transferred,
  8. object to an outcome against you arising from analysis of the processed data exclusively by automated systems,
  9. claim compensation if you suffer damage due to unlawful processing of your personal data.

9.How to apply

You can submit requests about your rights, together with information identifying you, in accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller, by one of the following means:

  • In writing with a wet signature, delivered by hand or through a notary to [Adres],
  • By registered electronic mail (KEP) to [KEP adresi],
  • With a secure electronic signature or mobile signature,
  • From the email address associated with the account you use to sign in to Hani, to [e-posta: privacy@…].

Your application should include your full name, (if you are a Turkish citizen) your T.R. identity number, an address or email for notifications, phone number and the subject of the request. If you don't have an account, please also include your device ID so we can find your data; you can see and copy your device ID on the website on the My account page and in the app in the "Device ID" row of the Account screen. You can also delete your data without an account yourself from the same places with "Delete my data" (Delete Account & Data).

Your application will be concluded free of charge within thirty days at the latest, depending on the nature of the request. If the request involves an additional cost, the fee set in the Board's tariff may be charged. If your application is rejected, the response is insufficient or no response is given in time, you can lodge a complaint with the Personal Data Protection Board within thirty days of learning the response and in any case within sixty days of the application date (KVKK Art. 14).

Data controller: [Şirket Unvanı] · MERSİS [MERSİS No] · [Adres]

Questions about this document: [e-posta: privacy@…] · KEP: [KEP adresi]