What we do with your data

The personal data we process

• Account details: your email address, an irreversible hash of your password, and, if you gave them, your name, home city, passport nationality and currency preference.
• Session records: a hash of the session token, when it expires, your browser string and IP address. These exist so someone else opening your account can be noticed.
• Usage records: the searches you run (from, to, date), the routes and plans you save, the price alerts you set, and the moments you click through to a partner site.
• Consent records: if you gave or withdrew marketing consent, when you did it, from which IP address and browser. Kept so the consent can be proven.
• Pilot form: if you took part in the Sabancı University pilot, the answers you gave and the language you gave them in. If you did not take part, no such record exists.

Why we process it

• To compute routes for the trip you searched, joining flights, trains, buses and ferries into one result.
• To keep your account working, keep your session secure, and stop abuse and automated request floods.
• To send the emails the service cannot work without, such as email verification and password reset.
• To send the price radar and newsletter if you gave explicit consent. You can leave with one click and the service stays the same.
• In the pilot study, to read your form answer next to your own search log and find where the product got it wrong.

Legal basis

Account and service data is processed to set up and perform the contract (art. 5/2-c). Session security and abuse prevention rest on legitimate interest (art. 5/2-f). Marketing email and taking part in the pilot rest on your explicit consent alone (art. 5/1); you can withdraw it at any time and it does not affect your use of the service.

Who else sees it

We do not sell your personal data and we do not open it to ad networks. Keeping the service running involves: the infrastructure providers that host the site and run the database, the delivery provider that sends the emails, and, when you type something to the assistant, the model provider that processes only that text. When you click through to a partner (Kiwi, Aviasales, FlixBus, Omio and similar), that partner sees the click under its own rules. Some of these providers are outside Turkey, so the data is transferred abroad.

How it is collected

All of it is collected electronically and automatically while you use the site. No paper, no phone calls, no lists bought from a data broker.

How long it is kept

Account and usage data is kept while your account exists. Delete the account and the records attached to it go with it. Session records expire on their own. Pilot answers are kept until the study is finished, or until you ask for them to go, whichever comes first.

One more note about the pilot

Taking part in the Sabancı University pilot is entirely voluntary, there is no prize draw and no gift, and you can stop whenever you want. Your answers are linked to your account because reading an answer next to the real search log behind it is the whole point of the study. Answers are not shared with third parties, anything published is published anonymised and in aggregate, and one email deletes them.