Privacy Policy

Under Turkey's Personal Data Protection Law No. 6698 (KVKK), the data controller is Emir Eid (a natural person). You can reach us at [email protected] or through our contact page.

• Account data: your email address (if you register) and your sign-in method (Google or email).
• Service data: your travel preferences (destination, dates, number of travelers, budget, interests), the plans you create and save, and your plan history.
• Technical data: your IP address and request details (for security and abuse prevention), and cookie data.

Your personal data is processed for the following purposes, relying on the conditions set out in Article 5 of the KVKK:

• Creating travel plans and providing the service — establishment and performance of a contract.
• Account management and access to saved plans — performance of a contract.
• Price and travel notification emails — your explicit consent (you can opt out at any time).
• Security, abuse and spam prevention, and service improvement — legitimate interest.
• Analytics cookies — your explicit consent (via the cookie notice).

To provide the service, your data is shared with service providers acting as data processors whose infrastructure may be located abroad: application infrastructure (database, authentication, hosting and cache services), email delivery, flight and accommodation data providers, and error-monitoring services. These providers process your data only on our instructions and for the purposes we determine. These transfers are necessary for the performance of the service and are carried out within the framework of the KVKK's provisions on transfers abroad, relying on your explicit consent where required. Your personal data is not sold to third parties for marketing purposes.

Some service providers, however, act not as data processors but as independent controllers: they process data not on our behalf but for purposes and by means they determine themselves, under their own privacy policies, and they are responsible for that processing. This applies to Google for map, place and route display (Google Maps Platform and Google Places), AI-assisted plan generation (Google Gemini) and Sign in with Google; Google's own data protection terms position each party as an independent controller that individually determines the purposes and means of its processing. When you use these features, Google's processing of the relevant data is subject to the Google Privacy Policy, which forms an integral part of this privacy policy. You may also exercise your rights directly against Google in respect of the processing Google carries out.

If you make an accommodation booking through Rotavi, your booking details (your name, contact details and stay dates) are transferred to the relevant property and to the travel agency selling the booking, so that the stay can be provided. The legal basis for this transfer is Article 5/2-(c) of the KVKK — being directly related to the performance of a contract — and it therefore does not require separate explicit consent. The information transferred is limited to what is necessary to provide the stay.

Some images shown on the website and in the mobile app — city and country photographs and accommodation images — are not served from our servers but are loaded directly from the servers of the relevant content provider. During this loading, your IP address and technical information about your browser and device are transmitted to that provider; the provider processes this information not on our behalf, but under its own privacy policy and for purposes it determines itself. These providers are Unsplash, Lorem Picsum, SerpApi, Expedia Group, Hotelbeds and Tripadvisor. The sources of images may change over time; the current list is maintained in this text.

Your data is collected electronically through automated and partly automated means while you use the site and the survey flow.

• Plans created without signing in (as a guest) are automatically deleted after 24 hours.
• Account data and saved plans are retained for as long as your account is active; they are deleted when you request deletion of your account or data.
• Data subject to a legal retention obligation is kept for the relevant period.

Regarding your personal data, you have the right to: learn whether it is being processed, request information about it, learn the purpose of processing and whether it is used in line with that purpose, know the third parties to whom it is transferred domestically or abroad, request its correction if it is incomplete or inaccurate, request its deletion or destruction under the conditions set out in the KVKK, request that these actions be notified to the parties to whom the data was transferred, object to a result against you arising solely from automated analysis, and demand compensation if you suffer damage due to the unlawful processing of your data.

To exercise your rights, you can contact us at [email protected] or through our contact form. Your requests will be concluded within the period stipulated in the KVKK.

Essential cookies are used for session management. Analytics cookies are activated only with the consent you give through the cookie notice. Your consent or refusal is recorded in a permanent audit log together with the date and the version of the text shown. This log never stores your IP address itself; only an irreversible, salted digest (hash) of it is kept.

This policy may be updated from time to time. The current version is always published on this page.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) — or the UK GDPR / Swiss FADP, as applicable — applies to the processing of your personal data described in this policy, in addition to the Turkish Personal Data Protection Law (KVKK) under which we operate as data controller.

Legal bases: our processing purposes and their legal bases are the same as described in Section 3 above (contract performance, your explicit consent, and our legitimate interests), which correspond to Article 6 GDPR.

Your rights under the GDPR: in addition to the rights described in Section 7, you have the right to data portability (receiving your data in a structured, commonly used format) and the right to object to processing based on our legitimate interests. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. Generating a travel plan involves AI-assisted processing, but it does not produce legal effects concerning you or similarly significantly affect you; it is not a decision under Article 22 GDPR, though you may always request human review of how a plan was generated.

International transfers: our database and authentication provider (Supabase) stores data in the EU (Ireland). Our analytics provider (PostHog) processes data on EU servers. Where data is transferred outside the EEA — for example to Google (Gemini AI processing, account sign-in, map and place services) or Vercel (hosting) — these providers rely on the European Commission's Standard Contractual Clauses and/or the EU-US Data Privacy Framework. For Google Maps Platform and Google Places, Google acts not as a processor but as an independent controller; that processing is governed by Google's own privacy policy, and you may exercise your GDPR rights in respect of it directly against Google. Smaller service providers (e.g. flight and accommodation data sources) are bound by contractual data-protection obligations; details are available on request.

Right to lodge a complaint: you may lodge a complaint with your local data protection supervisory authority, or with the Turkish Personal Data Protection Authority (KVKK Kurumu), without prejudice to any other administrative or judicial remedy.

EU representative: we are currently evaluating the appointment of a representative in the EU under Article 27 GDPR as our user base in the EEA grows. In the meantime, you can exercise any of the rights described above, or raise any question or concern, directly via [email protected] or our contact form — we will respond within the timeframes required by applicable law.