Privacy Policy

The company that provides Hani and acts as the data controller for your personal data is: [Şirket Unvanı] (MERSİS: [MERSİS No], address: [Adres], KEP: [KEP adresi]). Data Controllers Registry (VERBİS) record: [VERBİS kaydı].

For any privacy question, contact us at [e-posta: privacy@…]. This policy should be read together with our KVKK Privacy Notice under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK").

Account

Optional. Without an account we only use a randomly generated device ID; we don't know your name or email.

Photos

Processed to recognise the product, then discarded. Stored only if you turn on "share for quality".

Sending to Google

If the product cannot be identified by barcode or model number and you have given permission, a version of your photo cropped to the product is searched on Google via SerpApi. You can withdraw that permission at any time.

AI and image processing

To recognise the product, your photo is processed on our behalf by our service providers such as Google Cloud Vision, Modal, Google Gemini and Anthropic. These providers may not use the photo for their own purposes.

Ads and tracking

We don't use advertising cookies, analytics cookies or third-party trackers. We don't sell your data.

Deletion

You can delete your account in one step in the app or on the web. Details: Delete Account & Data.

When you use Hani without an account

• Device ID: On first launch the app or browser generates a random identifier (e.g. 3f2b…) and sends it with every request. It does not contain your name, phone number or advertising ID; but because it links your scans, alerts and preferences together, we treat it as personal data.
• Scan photos: Up to 3 frames that you take or select. They are downscaled on your device to at most 1024 pixels and sent to our server.
• Information read on your device: In the apps, the barcode and text on the product (such as the model number) are read on your device first and sent along with the photo.
• Scan records: Date and country of the scan, the recognised product, the recognition method and confidence level, the barcode/brand/model number read, and processing times. The photo itself is not part of this record.
• Feedback: When you mark the right product with "Not this one?".
• Clicks: The listing you clicked to go to a seller, the related scan and the time.
• Preferences and Premium: Your choice to hide the sponsored listing, your web search permission and its date, your Premium membership period, and your price alerts (product and target price).
• Search queries: Text searches for products. Processed to show results; not stored against your account.

When you sign in

• Information from Apple or Google: Your account identifier, email address (if you choose "Hide My Email" with Apple, the relay address Apple provides), whether the email is verified, and your name (Apple only shares the name on first sign-in). Your password never reaches us.
• Session information: When the session was created and last used, the platform (iOS, Android, web), IP address and browser/app information (user agent). We store only a hash of the session key, not the key itself.
• When you sign in, the data from that device's anonymous use (alerts, Premium, scans, clicks) is moved to your account.

Processed for technical reasons

• IP address: Used briefly (1–26 hours) in per-minute and daily request limits to prevent abuse. IP addresses are not written to our server access logs.
• Server logs: Request path, response code, duration and request number.
• Error reports: When the app or website fails: the error message, page address, version and device/browser type. IP address, cookies and device ID are removed from the report.

What we don't collect

We don't collect your location (GPS), contacts, advertising ID (IDFA/AAID), health or biometric data. When you buy Premium, your card details stay with Apple or Google and never reach us. We don't run face recognition on your photos.

A photo is used to find out what the product is. This is the path a photo takes in Hani:

1. On your device: The barcode and text are read on your device where possible. If a barcode is read, the product is usually found directly.
2. On our server: The photo is processed in memory. If the product cannot be identified by barcode or model number, the photo is sent to our service providers to recognise the product (Google Cloud Vision, Modal; if needed, a downscaled copy to Google Gemini and Anthropic). These providers process it only on our instructions and only for this purpose.
3. Web search (only with your permission): If the product still isn't recognised and you have given the permission described in the Explicit Consent text, a version of your photo cropped to the product (max. 500 KB) is sent to Google Lens via SerpApi. If you haven't given permission, your photo is not searched on Google; a search may be run with text such as the product name only.
4. Afterwards: The photo is not stored. The only exception: when the product isn't recognised, the cropped photo, the extracted text and your IP address are held in temporary memory for at most 10 minutes so the search can start if you give permission, and are then deleted automatically.

Please don't scan photos that contain other people's faces, identity documents or other private information. Taking the photo close to the product both improves recognition and avoids sharing unnecessary data.

We don't use your data to build advertising profiles, sell it to third parties or make automated decisions that have legal effects on you. Price ranking does not change per person: everyone sees the same organic list (Our ranking principles).

We share your data only with the service providers below and only for the purpose stated in the table. These providers work on our instructions as data processors and are bound by confidentiality and security obligations under contract.

Who does not receive personal data

• Price sources (Zyte, Bright Data, Icecat, seller websites): To verify prices we only use the addresses of sellers' product pages; your information is not added to these requests.
• Sellers and affiliate networks: When you choose "Go to seller", you are redirected to the seller's website. We don't add your identity, device ID or scan information to the link. Once you are on the seller's website, that site's own privacy policy and cookies apply.

Other cases

• Competent authorities: In response to duly made requests from public authorities legally entitled to them (e.g. courts, prosecutors), and only to the extent requested.
• Corporate transactions: In a merger, acquisition or similar transaction, provided the safeguards in this policy are maintained.
• Our team: For support and security, only authorised employees can access data, with role-based access and every action logged.

Some of the providers above (Google, Modal, Anthropic, SerpApi, Sentry, Apple) process data mainly in the United States. We carry out these transfers in accordance with Article 9 of the KVKK:

• For transfers required to provide the service (e.g. sending a photo to Google Cloud Vision for product recognition), we sign the standard contracts published by the Turkish Personal Data Protection Board with the providers and notify the Authority within the required period.
• Sending your photo to Google via SerpApi for a web search is additionally based on your explicit consent; see the Explicit Consent text for details.

We minimise the data transferred: photos are downscaled and, where possible, cropped to the product, and your device ID and account details are not sent to these providers.

We keep data only for as long as needed for its purpose. When the period ends, it is deleted, destroyed or anonymised (so it can no longer be linked to you).

Database backups are overwritten on a rolling basis within [30 days]; deleted data also disappears from backups at the end of this period.

Under Article 11 of the KVKK you can apply to us to:

• learn whether your personal data is processed and, if so, request information about it,
• learn the purpose of processing and whether it is used for that purpose,
• know the third parties in Türkiye or abroad to whom it is transferred,
• ask for it to be corrected if it is incomplete or inaccurate,
• ask for it to be deleted or destroyed,
• ask that corrections and deletions be notified to the third parties to whom it was transferred,
• object to an outcome against you resulting from analysis exclusively by automated systems,
• claim compensation if you suffer damage due to unlawful processing.

You can exercise many of these rights directly in the app: withdraw your web search permission in settings, delete your alerts, delete your account, or, without an account, delete your device's data with "Delete my data". For other requests and how to apply, see the KVKK Privacy Notice. We respond to your request free of charge within 30 days at the latest.

• Web search permission: On the web, My account or Premium page → "Search the web too" ("İnternette de ara"); in the app, Settings. From the moment you withdraw it, your photo is no longer sent to Google.
• Sharing for quality: You can turn it off in the app settings. If you want previously stored photos deleted, write to us.
• Camera and photo access: You can turn these off at any time in iOS or Android settings; only text search will then be available.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

• All connections are encrypted with TLS (HTTPS).
• Session keys are stored in the database only as a hash (SHA-256); the web session cookie cannot be read by JavaScript (HttpOnly) and is sent only over secure connections.
• Only the minimum data needed is sent to our service providers; photos are downscaled, cropped and separated from the device ID.
• Access to the admin panel is role-based and every action is written to an audit log.
• IP address, cookies and device ID are removed from error reports before they are sent.

No system is completely secure. If a data breach occurs, we will notify the Board and affected people as soon as possible in accordance with the KVKK. If you have found a security vulnerability, please write to [e-posta: privacy@…].

Hani is intended for a general audience and is not specifically designed for children. Children under 13 should not create an account; people under 18 may only buy Premium or similar with the permission of a parent or guardian. If we learn that a child under 13 has given us personal data, we will delete it. Parents who notice this can write to us.

On the website we only use first-party cookies and browser storage that are strictly necessary for the site to work: the anonymous device ID (mercek_device_id) and, if you sign in, the session cookie (hani_session). We don't use advertising or analytics cookies. Our fonts are served from our own server; no request goes to Google Fonts. Full list: Cookie Policy.

We may update this policy as the service or the law changes. The current date is shown at the top of the page. We announce significant changes (e.g. a new data category, a new purpose or a new international transfer) in the app or on the website before they take effect; for changes that require explicit consent we will ask for your permission again.

[Şirket Unvanı] · [Adres] · KEP: [KEP adresi] · Email: [e-posta: privacy@…]

If you are not satisfied with our response, you can lodge a complaint with the Turkish Personal Data Protection Board (kvkk.gov.tr).