Privacy and Data Protection Notice

Data controller: Ali Efe Okudan, Yenişehir, Lens Yaşam Merkezi, Block C, Floor 1, Unit 332, Pendik / Istanbul, Türkiye. Requests: destek@favdriver.co. This notice covers Fav Driver's vehicle-focused social media app and website. It provides information; it is not contract acceptance, a device permission or explicit consent.

1. What data do we process, and why?

Registration/login details, name, email, account identifier and chosen profile information are processed to administer membership and authentication under contract formation/performance, Article 5(2)(c) of Turkish Law No. 6698 (KVKK). Optional phone, biography, profile photo, vehicle/plate details and galleries support your selected profile and social functions. Adding a contact to the app directory does not automatically upload your entire device address book.

Connections, blocks, invitations, community membership/permissions, posts, captions, comments, boards and room messages are processed under Article 5(2)(c) to deliver your chosen social interaction and enforce visibility rules. Sharing with selected people does not make content public to everyone; making data public is not permission for unrestricted use.

Messages, photos, voice messages, call/delivery status, recipient details and notification tokens are used under Article 5(2)(c) to provide communication and delivery. Supported direct and journey chat content is end-to-end encrypted. Communication metadata, profiles and all social posts are not covered by that encryption. We do not promise end-to-end encryption for community boards, room text or comments. The app does not record voice call audio; voice messages you create are separate content. We cannot exercise absolute control over recordings made on a recipient's device.

Precise/approximate location, movement/status, route stops, time, distance and recorded journeys are processed as necessary under Article 5(2)(c) to deliver the location, route story, map or recording feature you choose. If an activity requires explicit consent, that must be obtained separately; device permission is not explicit consent. Live sharing and recording can continue in the background when the relevant feature and necessary device permissions are enabled.

Vehicle expense settings, captured journey parameters and record cards are processed under Article 5(2)(c) for the relevant function. Saved vehicle parameters are stored on the server; parameters included in a journey record may be shared with it. Temporary edits on the personal expense total and journey cost screens do not themselves create a new server record/message. The Cost Calculator Rules explain this further.

Subscription product/period, transaction and entitlement information, trial/campaign days, boosts and qualifying events are processed for software membership performance under Article 5(2)(c); required financial records rely on legal obligations under Article 5(2)(ç). Fav Driver does not collect full payment card details.

IP, session, device/app version, access and error records support security and abuse prevention under legitimate interests, Article 5(2)(f), provided your rights are not harmed. Limited product-use events and account/app installation identifiers are considered under that basis to measure and improve the service; message text, routes and photos are not sent as analytics event parameters. App analytics are separate from website cookies.

Reports, selected reported content, appeals and dispute records rely on establishing, exercising or protecting rights under Article 5(2)(e); binding authority requests and mandatory records rely on express legal provisions/legal obligations under Article 5(2)(a)/(ç). You can withdraw any separately given explicit consent without retrospectively invalidating prior lawful processing.

2. Who can see content and location?

Vehicle galleries and comments are shown to accounts with access to the relevant profile/vehicle; social functionality does not automatically make them public web posts. Community descriptions, member areas, boards and rooms have their own visibility rules. Connections, active vehicle selection, membership, blocks and deletion can affect future access.

Live location and availability are shared according to your chosen status and the feature's directory/community/chat audience; there is no universal rule that only the other participant in an active journey can see location. Route story stops, recorded routes and live location differ. Check the audience information on the screen. Stopping live sharing does not delete an earlier location message, route story or recording.

An authorised recipient can save, screenshot or forward delivered content and must respect data protection and privacy law. Reporting content may send your selected limited evidence in unencrypted form to authorised moderation staff for review.

3. Photos and facial comparison

Remote selfie/facial comparison is retired in this version; new biometric identity verification is not offered. Uploading a profile/vehicle/post photo does not officially verify identity, a driving licence or liveness. Image formatting or on-device face-presence checks do not mean server-based biometric identity matching occurs.

Accounts processed by earlier versions using Firebase and AWS Rekognition may have historical photo/result records. You can request information or deletion where legal conditions are met. Before any new biometric activity is enabled, its scope, recipients, retention, Article 6 processing condition and any separate explicit consent must be explained. This notice does not provide advance consent.

4. Providers and international transfers

Technical services include Supabase (accounts, databases, file storage), Google/Firebase (sign-in, real-time communication, notifications, server functions, limited app analytics and web hosting), Cloudflare (media distribution and communication relay infrastructure used), RevenueCat (subscription verification) and Apple (sign-in, App Store, maps and notifications). AWS Rekognition provided earlier facial comparison. Data may reach the relevant provider and its service subprocessors only for the necessary function.

Chosen recipients and authorised members receive your relevant shared data. Support/moderation personnel, advisers bound by confidentiality and legally authorised authorities access only data necessary for their duties. Domestic transfers follow KVKK Article 8 and the relevant processing grounds.

These providers' foreign infrastructure or support can involve international transfers. Such transfers require an adequacy decision, appropriate safeguards or a qualifying exception under KVKK Article 9; ordinary cloud use does not become lawful merely through acceptance of general terms or an occasional-transfer exception. At preparation of this notice, completed KVKK transfer safeguards for the operator have not been verified; we do not claim a signed standard contract is in place. You may ask support about the applicable mechanism, recipients and regions. This notice does not authorise transfers.

5. Collection and retention

Data comes from your and your contacts' inputs, permitted device functions, app/site access, identity/subscription providers and support requests, through automated, partly automated or filing-system-based methods. Manage privacy choices through device and app settings.

• Account, profile, vehicle, connection and social content records remain while the corresponding account/content function continues; deletion or relationship closure follows each record type's rules. Removing a directory connection does not automatically delete independent direct chat history.
• Expired route stories become hidden from other members but may remain in the owner's archive until deleted. Expiry and physical deletion are different operations.
• Direct chats and media are retained for history access. Delete for me does not delete a recipient's copy. Supported delete-for-everyone actions affect in-app access but cannot recall externally saved copies. Legacy journey chats have a 15-minute access window after completion followed by cleanup; this is not a deadline for all newer direct chats.
• Recorded journeys, sent route/location cards and voice messages do not automatically disappear when live sharing or a call ends. Their own history/deletion rules apply. Freezing a community does not permanently erase its records.
• The ordinary cleanup threshold is 180 days for content-report evidence and currently 365 days for separate access/traffic records. These are not retention periods for all personal data. Applicable mandatory preservation or a specific dispute may require retaining only necessary records separately with restricted access.
• Document acknowledgement/acceptance versions and times, transaction/entitlement and mandatory financial records are retained as necessary for performance, proving acceptance and applicable statutory retention/limitation periods. Data whose processing basis ends is deleted, destroyed or anonymised.

Receiving a deletion request, ending visibility and physically clearing server/backups may occur at different times. This notice does not promise instantaneous erasure or an unverified fixed backup deadline across distributed files and backups. Ask about retained records, reasons and deletion status. Account deletion does not remove the need to cancel an App Store subscription separately.

6. Website and cookies

This version's information, legal and invitation pages do not add advertising/analytics cookies or marketing pixels. Hosting infrastructure may process IP, request time, browser and security/access logs to serve and protect the site. Invitation URLs can include an invitation code for opening it in the app; do not post them publicly.

External services such as app downloads, maps or the store also apply their own privacy/cookie rules. If non-essential website trackers are added later, applicable information and permissions must be provided first; visiting today is not advance consent.

7. Rights and requests

Under KVKK Article 11, you can learn whether data is processed and obtain details, purposes and whether use matches those purposes, and domestic/international recipients. You can request correction, deletion/destruction under Article 7 and notification to relevant recipients. You may object to an adverse result based exclusively on automated analysis and seek compensation for unlawful processing.

Contact destek@favdriver.co with enough information to verify you securely, your request and a reply address. Use your registered email or another legally valid method; proportionate additional verification may be requested. Do not send passwords or unnecessary identity documents. Duly submitted requests are resolved as soon as possible and within at most 30 days, free of charge except additional costs permitted by law.

For refusal, insufficient response or no timely response, you may complain to the Turkish Personal Data Protection Board within 30 days of learning the response and in any event within 60 days of your request. Prior application to the controller and other statutory conditions apply. Court remedies remain available. Report an under-18 account or unlawful sharing of a child's data through the same channel.