Privacy Policy

Service provider

This text explains what data the WAY-LOO application and the way-loo.com website process. The disclosure required by Turkish data protection law (KVKK) is a separate text and should be read together with this policy.

1. Driver side: no account

The driver side works without an account. No name, phone number or e-mail is requested.

1.1. Location

Location permission is requested only while the app is in use. Background location is never requested. During navigation, location is used by a foreground service so that guidance continues with the screen off; this is visible in the notification area.

Location data is:

• sent to the map provider to calculate routes;
• sent to our own server to find nearby and on-route listings;
• not stored against a driver on the server — it is used for the request and discarded.

1.2. Weigh-station reports

When you report a weigh station, the location, the heading if available and an optional note are sent. The report is anonymous: a daily rotating device hash that cannot be resolved to an identity is stored, solely to stop one device reporting the same point repeatedly.

1.3. Stored on the device

Your language, vehicle type, the language catalogue, the downloaded weigh-station package and the last cargo list are stored on the device. They are not sent back to the server.

1.4. Voice assistant

You use the voice assistant only when you open it from the menu. The app does not listen continuously.

• Microphone. Microphone permission is requested when you open the assistant. The microphone is on only for that question and only while listening.
• Speech to text. Your phone's speech recognition service turns your speech into text: Google on Android, Apple on iOS. This service is subject to the phone maker's terms. The audio recording does not reach us.
• What is sent. Only the text of your question, your chosen language and a short summary prepared by your phone are sent to our server: the name, category and distance of the listings on your route; the distance to the next weigh station, road events and vehicles waiting for help; the remaining trip. Your location, route, phone number or device identifier are not part of this summary.
• Who produces the answer. The answer is produced by artificial intelligence. Our server forwards the question and the summary to the AI service provider Anthropic PBC (USA) to produce the answer. The answer is built only from this summary and is read aloud.
• Retention. The question and the answer are not stored on our server and are not written to logs. The only thing we store is the total number of uses and the cost, which cannot be linked to a person. To enforce the daily question limit, a device hash that cannot be resolved to an identity and changes every day is kept for 26 hours.
• Retention by the provider. Under its own policy, Anthropic deletes the question and the answer within 30 days at the latest. Content flagged for suspected misuse may be kept longer (up to 2 years).
• Model training. Questions and answers are not used to train AI models, neither by us nor by Anthropic.

1.5. Road event reports and help calls

When you report a road event, its type, location and, if available, your heading are stored. To stop one device from reporting the same event again and again, a device hash that cannot be resolved to an identity and changes every day is kept. For a help call, the type of need, location, heading and, if you wish, a nickname chosen from a fixed list are stored; a hash of a random key is kept so that only you can close the call. From those who answer, only the fixed answer and, if any, their nickname are stored. These records contain no name, phone number or IP address. Road events are deleted 30 days after they expire, help calls 7 days after they expire.

1.6. Notifications

To send update notifications, your phone's notification token, platform, language and app version are stored. The notification is passed through Expo (650 Industries, Inc., USA) to Google's (Android) or Apple's (iOS) notification service. If you do not allow notifications or turn them off, none are sent. The record of a device not seen for one year is deleted.

1.7. Ratings

When you rate a business, the number of stars and the tags you choose from a fixed list are stored. To stop one device from rating the same business again within a short time, a device hash specific to that business, which cannot be resolved to an identity, is kept. Ratings contain no name, phone number or location.

1.8. Error reports and counters

When the app hits an error, version information and the error text are sent to our server; they contain no personal data and are deleted after 90 days. To calculate navigation costs, the daily number of trips per device is kept with a device hash that cannot be resolved to an identity and is deleted after 400 days. Listing counters (views, calls, directions) are kept per listing only, without being linked to a person.

1.9. Hosting

Our servers and database are in the Hetzner Online GmbH data centre in Germany (Nuremberg). Encrypted backups are kept in the same environment for 7 days. Listing and business photos are stored privately in Cloudflare's object storage service and are shown only through time-limited links.

Hetzner's data centres and hosting services are certified to ISO/IEC 27001:2022 for information security management (SOCOTEC Certification, valid until 26.09.2028).

In its published data processing terms, Hetzner commits to providing the service only in countries of the European Union or the European Economic Area, to making any transfer to a third country subject to the customer's prior consent, and to having its technical and organisational measures reviewed at least once a year by an independent and qualified party.

2. Business and cargo side: there is an account

2.1. Data collected

• Phone number (verified over WhatsApp).
• For businesses: trade name, tax number, address, category, location, photograph.
• For cargo listings: display name; optionally company name, tax number, city.
• Listing texts and their translations.
• Credit ledger entries.
• Verification code requests: phone number, a hash of the code and the IP address of the request; deleted after 30 days.
• Session records: the IP address the session was opened from and the device name.
• Photos: all metadata, including location, is removed from uploaded photos.
• Store purchases: the receipt is sent to Google Play for verification, or Apple's signature is verified on our server; the receipt itself is not stored, only its hash and the order number.
• Consent records: which contract version you accepted, when, and with which IP address and client.

2.2. Showing the phone number

A cargo poster's number is shown to drivers while the listing is live. This is taken as explicit consent. When the listing is removed or expires, the number is not shown.

3. Cookies

The app uses no cookies. The website uses only the technical cookie needed for it to work; there are no advertising or tracking cookies. Details are in the cookie policy.

4. Third parties

Map tiles and road data come from OpenStreetMap contributors; administrative boundaries come from Natural Earth.

5. Retention

• Consent records and credit entries: for the statutory retention period.
• Listings: until removed or expired; archived afterwards.
• Audit log: for the configured period, then deleted.
• On account deletion: personal data is anonymised; records that must be retained are kept in de-identified form.
• Verification code requests: 30 days. Closed sessions: 90 days.
• Road events: 30 days after they expire. Help calls: 7 days after they expire.
• Notification device records: after one year without being seen. Error reports: 90 days. Navigation and listing counters: 400 days.
• IP address in complaint records: deleted after one year.

6. Your rights

To exercise your rights under article 11 of the KVKK, write to the address on the contact page. You can also delete your account from within the app.

7. Security

Session tokens are held in encrypted storage on the device. All communication with the server uses HTTPS.

8. Changes

When this policy changes, a new version number is published; earlier versions remain accessible.

The Turkish text prevails. This version was produced from the Turkish original; in case of any discrepancy, the Turkish text governs.