Privacy Policy

Last updated: July 11, 2026

Halı Yıkat Portal ("the App", "the Platform") is a B2B (business-to-business) software service built for carpet and upholstery cleaning businesses to manage their field and office operations. The App is not, on its own, a consumer application open to the general public — accounts are created only by the administrators of registered businesses. This policy explains how the personal data of business staff (managers, office staff, drivers/technicians) and of the business's customers is processed.

1. Data Controller

Under Turkey's Law on the Protection of Personal Data No. 6698 ("KVKK"), the data controller is:

Every business using the Platform is the data controller for its own employees' and customers' data; Halı Yıkat Portal acts as the data processor (service provider) with respect to that data.

2. Types of Data Collected

Category	Example Data
Identity & Contact	Full name, phone, email, username
Customer Information	Customer name, address, phone, order/appointment history
Location Data	Live GPS location of users in the field-crew (driver/technician) role, kept for up to 35 days
Financial Data	Order amount, payment record, payment type (card details are not stored by the App)
Device & Usage Data	Device push-notification token, login/logout time, app version
Call Log	On Android devices, with user consent, incoming/outgoing call history is synced (number and time only, never call content)
Image Data	Order/product photos (uploaded by the user)
Communication Consent	Commercial electronic message (SMS) consent — İYS (Turkey's Message Management System) records

3. Purposes of Processing Personal Data

• Running the business's internal order, appointment and payment collection processes
• Route planning and live tracking of the field crew
• User authentication and authorization
• Sending in-app and push notifications
• Keeping the legally required consent record (İYS) for commercial electronic messages
• Monitoring service quality, diagnosing issues and responding to support requests
• Fulfilling legal obligations (tax, accounting, commercial record-keeping)

4. Legal Basis

Personal data is processed under Articles 5 and 6 of the KVKK, on the basis that processing is necessary for the establishment or performance of a contract, for the data controller to fulfill a legal obligation, for the data controller's legitimate interest provided it does not harm the data subject's fundamental rights and freedoms, and — for commercial electronic messages — explicit consent.

5. Sharing with Third Parties

Your data is shared, solely for the stated purposes, with the following subprocessors necessary for the service to function. Data is never sold or rented to third parties for marketing purposes.

• Google Firebase (Cloud Messaging & Analytics) — push notification delivery and website usage analytics
• Google Maps Platform — route optimization and map display
• SMS/İYS operators — delivery of consented commercial messages and İYS consent verification
• Server hosting provider — secure storage of data

Where legally required (court order, official authority request), data may be shared with the competent authorities.

6. Data Retention Periods

• Location (GPS) records: kept for at most 35 days, then automatically deleted
• Order, customer and finance records: kept for the legally required retention periods (generally up to 10 years under Turkish Commercial Code and tax law)
• When an account is deleted (soft-delete), records become inaccessible; data with no legal retention obligation is permanently deleted upon request
• Call logs and session logs: kept for a limited period for operational and security purposes

7. Data Security

Data is transmitted over encrypted connections (HTTPS/TLS), access is restricted to authorized user roles only, and each business's data is logically isolated from every other business's (multi-tenant architecture). Passwords are stored in an irreversible (hashed) form. In the mobile app, data is held on the device while working offline and is securely synced to the server once a connection is available.

8. Mobile App Permissions

The Halı Yıkat Portal mobile app requests the following device permissions only for the stated purpose; declining a permission may disable that specific feature but will not prevent you from using the rest of the app.

Permission	Platform	Purpose
Location (GPS)	Android & iOS	Sends the live location of users in the field-crew (driver/technician) role to the business for route planning, and provides directions to the customer address. Not tracked continuously in the background — only while the app is in use.
Camera	Android & iOS	Taking order/product photos
Photos/Gallery	Android & iOS	Attaching order photos and saving to the gallery (on Android, the system photo picker is used — the app is not granted general gallery access)
Notifications	Android & iOS	Order/stage-change push notifications (Firebase Cloud Messaging)
Call Log	Android only	Matching incoming/outgoing calls to the relevant customer record — only the number and time are read, never the call content
Bluetooth	Android & iOS	Connecting to a thermal printer to print receipts/labels
Face ID / Biometric Lock	iOS only	Securely storing your session on the device (flutter_secure_storage)

The app does not access your contacts or microphone.

9. Children's Privacy

The app is a B2B business-management tool designed for business employees and is not directed at individuals under 18. We do not knowingly collect data from individuals under 18.

10. Your Rights Under the KVKK

Under Article 11 of the KVKK, as a data subject you have the right to:

• Learn whether your personal data is being processed
• Request information about it if it has been processed
• Learn the purpose of processing and whether it is used consistently with that purpose
• Know the third parties to whom it is transferred, domestically or abroad
• Request correction if it has been processed incompletely or incorrectly
• Request deletion or destruction once the legal conditions are met
• Request that corrections/deletions be notified to third parties to whom the data was transferred
• Object to a result that is to your detriment arising from analysis carried out exclusively through automated systems
• Request compensation for damage arising from unlawful processing

To exercise these rights, contact us through the channels on our Support page. Requests are resolved within 30 days at the latest, after identity verification.

11. Changes to This Policy

This policy may be updated to reflect changes to our services or to applicable law. Material changes will be communicated via this page or an in-app notice.

12. Contact

For questions: destek@haliyikat.com.tr or WhatsApp: +90 539 445 1615.