Privacy Policy

Under Turkey's Personal Data Protection Law No. 6698 (KVKK), the data controller is Emir Eid (a natural person). You can reach us at [email protected] or through our contact page.

• Account data: your email address (if you register) and your sign-in method (Google or email).
• Service data: your travel preferences (destination, dates, number of travelers, budget, interests), the plans you create and save, and your plan history.
• Technical data: your IP address and request details (for security and abuse prevention), and cookie data.

Your personal data is processed for the following purposes, relying on the conditions set out in Article 5 of the KVKK:

• Creating travel plans and providing the service — establishment and performance of a contract.
• Account management and access to saved plans — performance of a contract.
• Price and travel notification emails — your explicit consent (you can opt out at any time).
• Security, abuse and spam prevention, and service improvement — legitimate interest.
• Analytics cookies — your explicit consent (via the cookie notice).

To provide the service, your data is shared with service providers acting as data processors whose infrastructure may be located abroad: application infrastructure (database, authentication, hosting and cache services), email delivery, map/place and flight/hotel data providers, and error-monitoring services. These transfers are necessary for the performance of the service and are carried out within the framework of the KVKK's provisions on transfers abroad, relying on your explicit consent where required. Your personal data is not sold to third parties for marketing purposes.

If you make an accommodation booking through Rotavi, your booking details (your name, contact details and stay dates) are transferred to the relevant property and to the travel agency selling the booking, so that the stay can be provided. The legal basis for this transfer is Article 5/2-(c) of the KVKK — being directly related to the performance of a contract — and it therefore does not require separate explicit consent. The information transferred is limited to what is necessary to provide the stay.

Your data is collected electronically through automated and partly automated means while you use the site and the survey flow.

• Plans created without signing in (as a guest) are automatically deleted after 24 hours.
• Account data and saved plans are retained for as long as your account is active; they are deleted when you request deletion of your account or data.
• Data subject to a legal retention obligation is kept for the relevant period.

Regarding your personal data, you have the right to: learn whether it is being processed, request information about it, learn the purpose of processing and whether it is used in line with that purpose, know the third parties to whom it is transferred domestically or abroad, request its correction if it is incomplete or inaccurate, request its deletion or destruction under the conditions set out in the KVKK, request that these actions be notified to the parties to whom the data was transferred, object to a result against you arising solely from automated analysis, and demand compensation if you suffer damage due to the unlawful processing of your data.

To exercise your rights, you can contact us at [email protected] or through our contact form. Your requests will be concluded within the period stipulated in the KVKK.

Essential cookies are used for session management. Analytics cookies are activated only with the consent you give through the cookie notice. Your consent or refusal is recorded in a permanent audit log together with the date and the version of the text shown. This log never stores your IP address itself; only an irreversible, salted digest (hash) of it is kept.

This policy may be updated from time to time. The current version is always published on this page.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) — or the UK GDPR / Swiss FADP, as applicable — applies to the processing of your personal data described in this policy, in addition to the Turkish Personal Data Protection Law (KVKK) under which we operate as data controller.

Legal bases: our processing purposes and their legal bases are the same as described in Section 3 above (contract performance, your explicit consent, and our legitimate interests), which correspond to Article 6 GDPR.

Your rights under the GDPR: in addition to the rights described in Section 7, you have the right to data portability (receiving your data in a structured, commonly used format) and the right to object to processing based on our legitimate interests. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. Generating a travel plan involves AI-assisted processing, but it does not produce legal effects concerning you or similarly significantly affect you; it is not a decision under Article 22 GDPR, though you may always request human review of how a plan was generated.

International transfers: our database and authentication provider (Supabase) stores data in the EU (Ireland). Our analytics provider (PostHog) processes data on EU servers. Where data is transferred outside the EEA — for example to Google (Gemini AI processing, sign-in) or Vercel (hosting) — these providers rely on the European Commission's Standard Contractual Clauses and/or the EU-US Data Privacy Framework. Smaller service providers (e.g. flight and accommodation data sources) are bound by contractual data-protection obligations; details are available on request.

Right to lodge a complaint: you may lodge a complaint with your local data protection supervisory authority, or with the Turkish Personal Data Protection Authority (KVKK Kurumu), without prejudice to any other administrative or judicial remedy.

EU representative: we are currently evaluating the appointment of a representative in the EU under Article 27 GDPR as our user base in the EEA grows. In the meantime, you can exercise any of the rights described above, or raise any question or concern, directly via [email protected] or our contact form — we will respond within the timeframes required by applicable law.