Otomedik
Post Free
Legal

Privacy Policy

How Otomedik collects, uses, stores, and protects personal data. This policy describes the same real practices as the KVKK Information Notice; if they ever conflict, the categories and purposes in the KVKK notice prevail.

Version 1.0 · Effective date will be set at production launch.

Sections that contain legal interpretation must be reviewed by a Turkish lawyer before production. Marked headings fall in that scope.

1. Who we areLawyer review

Otomedik is an online vehicle marketplace serving Türkiye: for-sale and rental listings, dealer and rental-company profiles, a repair-service directory, messaging, and rental booking requests.

The operating legal entity is not yet set in production configuration:

  • Legal name: Şahıs Şirketi
  • Address: Denizli / Pamukkale
  • Tax ID: 12345678901
  • Privacy contact: [email protected]

Official identity must be completed before launch. English is a courtesy translation; Turkish prevails.

2. Information we collect

The full category list is in the KVKK Information Notice, section 2. In short:

  • Account: name or company name, email (Firebase), password (Firebase only), account type
  • Profile: phone, optional location and social links; on business accounts, address, map pin, WhatsApp, staff, tax ID (kept private)
  • Listings, messages, rental booking requests, reviews
  • Uploaded images
  • Firebase Analytics if you consent in the browser
  • Registration acceptance records (document type, version, time; IP/user-agent where justified)

We do not collect payment cards, marketing email lists, a licence-plate field, or tax-certificate PDFs. The contact form currently does not save to a server.

3. How we collect it

Directly from you (registration, profile, listing, message, booking, review); email and display name from Google if you sign in with Google; Google Places when you pick an address; from administrators (verified badge, account actions); Analytics if you consent.

Cookies: Otomedik does not set its own tracking cookies. Sessions use Bearer tokens. The browser may store otomedik_launch_popup_seen and an analytics preference in localStorage. Firebase / Google may set their own cookies.

4. How we use it

Accounts and marketplace features, publishing listings, messaging, coordinating rental booking requests, the public business directory, limited security, admin operations, legal duties, and consent-based analytics. Purposes match the KVKK Information Notice. We do not send marketing messages.

5. How we protect it

Authentication is via Firebase; API requests use Bearer tokens. Passwords are not stored in the Otomedik database. Tax identifiers are stripped from public APIs.

Images (listings, logos, avatars, etc.) in Firebase Storage are world-readable — that is intentional. If tax certificates are added later they must use a private path; no such upload exists today.

We cannot guarantee absolute security.

6. How long we keep informationLawyer review

Exact periods are not yet set. Draft: account data while the account exists; after a deletion request or admin deletion, the Firebase user and MongoDB profile can be removed. Listings may be set to “removed”. A lawyer/accountant must confirm periods before launch. Details: KVKK Information Notice section 7.

7. Cookies and similar technologiesLawyer review

  • Strictly necessary: We do not use a session cookie; identity uses Firebase and Bearer tokens.
  • Local storage: Launch announcement and analytics preference.
  • Firebase Analytics: Not required for the service. It is not started unless you accept via the banner. If you reject, the analytics SDK is not initialized.
  • Google / Firebase: Sign-in and Storage may use their own cookies or storage.

Whether this cookie/analytics approach is sufficient under KVKK and electronic-communications rules requires lawyer review. This is not an IAB consent-management platform.

8. Third-party services and transfersLawyer review

Google (Firebase Auth, Storage, Analytics, Maps/Places), MongoDB, API hosting (Railway referenced in code), and OpenAI for admin blog drafts. Details and cross-border warning: KVKK Information Notice section 6.

9. Sharing

Public: listing content; seller/business name, phone, business WhatsApp, staff (as entered by the business), location, reviews, images.

Private: email, password, tax ID/office, messages, bookings, Firebase user ID.

We do not sell data. We may disclose it if legally required or as part of admin security actions.

10. Account deletion

There is no self-service delete button. Email [email protected]. An administrator can delete the Firebase account and MongoDB profile. Messaging may show a deleted counterpart as a deleted account. Backups or legally required copies may remain for a period a lawyer must define.

11. Your rightsLawyer review

Rights under KVKK are listed in the KVKK Information Notice section 8. Apply at [email protected].

12. Security

We use HTTPS, Firebase authentication, authorized API routes, and stripping tax fields from public responses. Stored listing/profile images are reachable via public URLs. Security reports may be sent to [email protected].

13. Changes to this policy

Version 1.0. The effective date will be set at launch. Material changes increment the version. New accounts store the current version; existing users are not forced through a re-consent flow.

14. Contact

Privacy and KVKK: [email protected]

A general contact page also exists; founder details there are not a substitute for the official controller identity.