Privacy Policy

1. Data we collect

To provide the Service, we process the following data:

• Account details: first name, last name, email address and a secure (hashed) form of your password.
• Dealer/tenant details: business name, logo and credit balance.
• Content data: the vehicle photos/videos you upload and listing details (make, model, plate, year, color, notes).
• Transaction data: background removal, plate replacement, video and 360° operations, and credit movements.
• Purchase data: records of your subscription and package purchases (product, amount, date, payment provider's transaction ID). Your card details never reach us; payments are collected by iyzico on the web and by the Apple App Store or Google Play in the mobile app.
• Billing details: when you buy on the web, we collect your full name or company name, Turkish ID or tax ID number, tax office, billing address and mobile phone to issue your invoice. Purchases in the mobile app are invoiced by Apple or Google and these details are not requested there.
• Technical data: IP address, browser/device information (device model and operating system version in the mobile app) and service-usage log records.

2. Why we use the data

• To provide the Service: photo processing, listing generation and account management.
• To manage your credit balance and apply per-operation deductions/refunds.
• Security, abuse prevention and service-quality improvement.
• To communicate with you (transaction notifications, support requests).

3. Third-party service providers

We work with the following providers to deliver the Service. Some of them are located abroad; your data is only transmitted to the extent the relevant service requires:

• Hosting and storage: Amazon Web Services (EU - Sweden/Stockholm region). Your account data, database backups and uploaded images are stored there.
• Image processing: the images you upload are transmitted to AI providers such as remove.bg, Photoroom and xAI for background removal, scene and video generation.
• Payments: iyzico on the web; the Apple App Store and Google Play in the mobile app. RevenueCat, Inc. (USA) is used to manage mobile subscription and purchase records; only your account ID and purchase information are sent to RevenueCat.
• Measurement and crash reporting: Google Analytics 4 on the website, Google Firebase Analytics and Firebase Crashlytics in the mobile app (Google Ireland Limited / Google LLC). See section 4 for details.
• Email: account verification and password reset emails are sent via Resend.

4. Cookies and analytics

We use strictly necessary cookies for session management, language preference and security (e.g. your sign-in session). The Service does not work without these cookies and no consent is required for them.

In addition, we use optional analytics cookies through Google Analytics 4 to understand which screens are used and where flows are abandoned. These cookies are only written if you select "Accept" in the cookie banner shown on your first visit; if you reject, no analytics cookie is written.

We do not send directly identifying data such as your email address, name, licence plate or uploaded images to analytics; only data such as account identifiers, screen names and operation counts is processed.

To change your preference, clearing the site data (cookies) in your browser is enough and the banner will be shown again. The preference is stored for 180 days.

In the mobile app, we use Google Firebase Analytics to understand how the app is used. The data sent is your account ID, screen names, operation counts and device information. The advertising identifier (IDFA/AAID) is not collected, and the data is not used or shared with third parties for advertising, profiling or cross-app tracking.

When the app crashes, a crash report is sent through Firebase Crashlytics so we can find and fix the error. The report contains technical details of the error (stack trace, app version, device model, operating system version and a random identifier assigned to this installation of the app); your account ID, email address and images are not included. Reports are deleted automatically after 90 days.

5. Retention period

We retain your data for as long as your account is active and for as long as our legal obligations require.

When you delete your account, your access closes immediately; your vehicles, photos and account details are permanently deleted within 30 days at the latest, and your account record is anonymized.

Payment and invoice records are excluded from this deletion: Turkish tax law requires them to be kept for 5 years (KVKK art. 5/2-a). For web purchases these records also include the name or company name, ID or tax number and billing address on the invoice; apart from these, they retain no data that directly identifies you.

Database backups: we take daily backups to protect against data loss. Daily backups are kept for 90 days and monthly backups for 365 days, after which they are deleted automatically. During this period, data from your deleted account remains only in backups and is not used for any purpose other than restoring from backup.

Deleting your account in the mobile app does not cancel your App Store or Google Play subscription; you must cancel the subscription separately in your store account settings.

6. Data security

Passwords are stored securely (bcrypt), connections are encrypted with SSL/TLS, and access is restricted through authorization. Although no method is 100% secure, we take reasonable technical and administrative measures to protect your data.

7. Your rights

To exercise your rights under KVKK, you can reach us at info@cartelier.ai. For details, see the KVKK Disclosure Notice.

8. Contact

For questions about this policy: info@cartelier.ai.