KVKK Disclosure
Service provider
| Trade name | MRACLE Veri ve Bilgi Teknolojileri Sanayi ve Ticaret Limited Şirketi |
| Address | Meydan Mahallesi, Üniversite Yolu Sokak, No: 31/C, 31200 İskenderun/Hatay, TÜRKİYE |
| MERSİS no. | 0623211395700001 |
| Tax office / no. | Akdeniz Vergi Dairesi / 6232113957 |
| [email protected] | |
| Telephone | +90 532 705 79 50 |
Prepared under article 10 of Turkish Law no. 6698 on the Protection of Personal Data (KVKK).
1. Data controller
The company whose trade name, address, e-mail and telephone number appear on the contact page acts as data controller.
2. Personal data processed
2.1. Driver (no account)
| Data | Why |
|---|---|
| Location | Route calculation, nearby and on-route listings, weigh-station warning |
| Heading | Determining which carriageway a weigh station serves |
| Anonymous device hash | Preventing repeat reports from one device |
| Voice assistant question and route summary (no location) | Producing the voice assistant's answer; not stored |
| Device hash that changes daily | Daily question limit of the voice assistant (kept for 26 hours) |
| Location, heading, event type (road event report) | Warning other drivers |
| Location, heading, type of need, nickname from a fixed list (help call) | Passing it to drivers on the way |
| Notification token, platform, language, app version | Sending update notifications |
| Business-specific device hash, rating and tags | Preventing repeat ratings |
| Device hash and daily number of trips | Calculating navigation costs |
No name, phone number, e-mail or persistent identifier is processed on the driver side.
What you say to the voice assistant is turned into text by your phone's speech recognition service (Google on Android, Apple on iOS); the audio recording does not reach us.
2.2. Business / cargo poster
| Data | Why |
|---|---|
| Phone number | Authentication, notifications, contact in the listing |
| Trade name, tax number, address | Registration and invoicing obligations |
| Business location and photograph | Showing the listing to drivers |
| Listing text | Publication and translation |
| Consent records (IP, time, version) | Proving the contractual obligation |
| Credit ledger entries | Billing |
| IP address of verification code requests and sessions | Service security and preventing abuse |
| Hash of the purchase receipt and the order number | Verifying the payment and refunds |
3. Purposes
Providing the service, forming and performing the contract, meeting legal obligations, ensuring the security of the service and preventing abuse.
4. Legal grounds
- Formation and performance of a contract (art. 5/2-c).
- Compliance with a legal obligation (art. 5/2-ç).
- Legitimate interest: security of the service and prevention of abuse (art. 5/2-f).
- Explicit consent: showing a cargo poster's phone number to drivers.
- Voice assistant: giving the answer the driver asks for, performance of the contract (Art. 5/2-c).
- Legitimate interest (Art. 5/2-f): road events, help calls, ratings, error reports and usage counters. Performance of the contract (Art. 5/2-c): notifications and purchase verification.
5. Transfers
| Recipient | Location | Purpose | What is transferred |
|---|---|---|---|
| Map and navigation provider (Mapbox) | Abroad | Maps and navigation | Location and route points |
| WhatsApp Cloud API (Meta) | Abroad | Phone verification, notifications | Phone number |
| Translation provider (DeepL) | Abroad | Translating listing texts | Listing text |
| AI service provider (Anthropic PBC) | Abroad (USA) | Producing the voice assistant's answer | Voice assistant question, language, route summary (no location) |
| Hosting service (Hetzner Online GmbH) | Abroad (Germany) | Server and database hosting | All data processed in the service |
| Object storage (Cloudflare, Inc.) | Abroad (USA) | Photo storage | Listing and business photos |
| Notification service (Expo, 650 Industries, Inc.) | Abroad (USA) | Delivering notifications | Notification token, notification text |
| Google / Apple | Abroad (USA) | Delivering notifications to the phone; purchase verification | Notification token and text; purchase receipt |
| Translation provider (Mazdek GmbH) | Abroad (Switzerland) | Kurdish and Persian translation | Listing text |
Transfers abroad are made under the conditions in article 9 of the KVKK.
Hetzner's data centres and hosting services are certified to ISO/IEC 27001:2022 for information security management (SOCOTEC Certification, valid until 26.09.2028).
In its published data processing terms, Hetzner commits to providing the service only in countries of the European Union or the European Economic Area, to making any transfer to a third country subject to the customer's prior consent, and to having its technical and organisational measures reviewed at least once a year by an independent and qualified party.
6. Collection method
Data is collected electronically and by automated means through the application and the website.
7. Your rights
Under article 11 of the KVKK you may: learn whether your data is processed; request information about it; learn the purpose of processing and whether it is used accordingly; know the third parties to whom it is transferred in Türkiye or abroad; request correction if incomplete or inaccurate; request erasure or destruction; request that such actions be notified to third parties; object to a result produced solely by automated analysis; and claim compensation for damage.
Send requests to the address on the contact page.
8. Retention and destruction
Data is kept for as long as the purpose requires and for statutory retention periods, then deleted, destroyed or anonymised. On an account deletion request, personal data is anonymised.
Voice assistant questions and answers are not stored on our server; only the total number of uses and the cost, which cannot be linked to a person, are kept. Under its own policy, the AI service provider Anthropic deletes the question and the answer within 30 days at the latest; content flagged for suspected misuse may be kept for up to 2 years. Questions and answers are not used to train AI models.
Specific periods: verification code requests 30 days; closed sessions 90 days; road events 30 days and help calls 7 days after they expire; notification device records after one year without being seen; error reports 90 days; navigation and listing counters 400 days; audit log 3 years; IP address in complaint records one year. Encrypted backups in the hosting environment are kept for 7 days.
The Turkish text prevails. This version was produced from the Turkish original; in case of any discrepancy, the Turkish text governs.