This Privacy Policy explains how Talya Global Lojistik Hizmetleri ("we", "us", "our") collects, uses, stores and shares personal data when you use AirScanner (the "Service"). We comply with the Turkish Personal Data Protection Law (KVKK) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Data we collect

We collect only what the Service needs to operate:

Account data: name, work email, company (optional), hashed password.
Billing data: billing address, plan, Stripe customer ID. Full card numbers are never stored on our servers — they live with Stripe.
Usage data: the searches you run (origin/destination airport pairs, weights and dimensions, product type), the air waybills you track, timestamps, and the plan the activity was metered against. Used to compute quota and improve the product.
Shipment data: where you book through the Service — consignor and consignee details, commodity description, piece count, weight and dimensions, special-handling declarations and the documents you attach. Some of this is personal data about your own counterparties, which you provide to us as their controller.
Technical data: IP address, browser user-agent, language, referring page. Used for security, abuse prevention and aggregate analytics.
Communications: support messages, feedback you submit in-app, and your replies to system email.

2. Why we collect it (legal basis)

Contract: to provide the Service you subscribed to — account, billing, rate search, booking and tracking.
Legal obligation: tax and accounting records; aviation security and customs requirements, including transmitting the shipment and party data an airline or authority is required to hold; sanctions and export-control screening.
Legitimate interests: security monitoring, fraud and abuse prevention, product analytics, customer support.
Consent: optional marketing email. We ask once, and opting out is one click in every footer.

3. How long we keep it

Account data: for the life of your account, then deleted within 30 days of closure (or anonymised where legal record-keeping requires).
Billing records: 10 years, as required by Turkish tax law (VUK).
Shipment and air waybill records: retained for the period applicable air cargo, customs and security rules require, and in any case no longer than needed to resolve claims.
Usage and access logs: 12 months rolling, then aggregated with personal identifiers removed.
Marketing consent: until you unsubscribe.

4. Who we share it with

Stripe — payment processing.
Buildfyio — application hosting.
Basefyio — application database.
Email delivery providers — transactional email (verification, password reset, milestone alerts, receipts).
Airlines, handling agents, air-cargo marketplaces and customs brokers — when you request a rate, the airport pair, dates and cargo characteristics are sent upstream to retrieve capacity and pricing; those requests are not tied to your account identifier. When you book, the shipment and party details necessarily go to the operating carrier, its ground handler and the relevant customs authority, because an air waybill cannot exist without them.
Authorities — only when compelled by a valid legal order, or where aviation security and customs law requires it, and only to the minimum extent required.

5. International transfers

Air freight is inherently cross-border: a shipment from Istanbul to New York means the shipment data reaches parties in both countries and any transit state. Where data leaves Türkiye or the EEA we rely on the transfer mechanisms available under KVKK and GDPR — standard contractual clauses, an adequacy decision, or the necessity of the transfer for performance of the contract of carriage.

6. Your rights

Subject to KVKK and GDPR you may request:

access to the personal data we hold about you;
correction of inaccurate or incomplete data;
deletion ("right to be forgotten"), subject to legal retention obligations;
restriction of, or objection to, certain processing;
portability — a machine-readable export of the data you supplied;
withdrawal of consent for activities that rely on consent.

Write to info@talyasmart.com. We respond within 30 days. Note that we cannot recall shipment data already transmitted to a carrier or authority where they hold it under their own legal obligation.

7. Security

Traffic is encrypted in transit (TLS). Passwords are stored hashed, never in plain text. Access to production data is limited to the people who need it, session tokens are short-lived, and administrative actions are recorded in an audit log. No system is perfectly secure; if a breach affects your personal data we will notify you and the competent authority as required by law.

8. Cookies

We use a small number of essential and functional cookies. See the Cookie Policy for the full list.

9. Children

The Service is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18.

10. Changes to this Policy

We may update this Policy. Material changes will be announced by email or an in-app banner before they take effect, and the "last updated" date above always reflects the current version.

11. Contact and complaints

General questions: info@talyasmart.com. Data protection requests: info@talyasmart.com. If you are unsatisfied with our response you may complain to the Turkish Personal Data Protection Authority (KVKK) or, in the EEA, your local supervisory authority.

This Policy describes our data practices in plain language. It is not legal advice.