Privacy Policy

iPilot · Effective October 26, 2026

This Privacy Policy explains how ETILER DIJITAL HIZMETLER LIMITED SIRKETI ("we", "us") processes personal data when you use the iPilot mobile application and its website (together, the "Service"). Please read it together with our Terms of Use.

1. Who we are

The data controller for the Service is ETILER DIJITAL HIZMETLER LIMITED SIRKETI, Esentepe Mah. Yüzbaşı Kaya Aldoğan Sk. Pardus Plaza No: 4 İç Kapı No: 3, Şişli, İstanbul, Türkiye. For any question or request about your personal data, write to [email protected].

2. The data we process

Data you give us

• Support messages: your email address and whatever you include when you contact us.
• Content you submit to AI features: the messages, prompts, images or files you send to the app's AI features, and the responses generated for you (see AI features).
• Feedback and reviews you choose to give inside the app.

Data collected automatically

• Device and app information: device model, operating system and version, language, time zone, app version, and approximate location derived from your IP address (country and region; we do not collect precise location).
• Identifiers: an identifier the app creates for your installation, an anonymous account identifier used to keep your data and purchases together, Firebase installation identifiers, and push notification tokens if you allow notifications. On Android, the advertising ID; on iOS, the IDFA only if you allow tracking through Apple's App Tracking Transparency prompt.
• Usage data: the screens you view, features you use, buttons you tap, session length, and technical events such as crashes and errors.
• Purchase data: which subscription or product you bought, the price and currency, the store transaction identifiers, renewal and cancellation status. Payment card details are handled by Apple or Google; we never receive them.
• Attribution data: which advertising campaign, ad or link led to your installation or purchase, including click identifiers from ad platforms.
• Website data: on our website and landing pages, cookies and similar technologies, your IP address, browser user agent, the page you came from, and advertising click identifiers in the link you followed (for example gclid).

We do not intentionally collect special categories of personal data (such as health, religion or biometric data). Please don't share such information in support messages or with AI features.

3. Why we process it, and on what legal basis

4. AI features

Some features of the Service are powered by artificial intelligence models provided by third parties. When you use them:

• The content you submit (text, images, files) and the context needed to answer it are sent to our AI model providers — currently Google (Gemini), OpenAI and Anthropic — which process it to generate a response and return it to us. They act as our service providers and, under their terms for business customers, do not use this content to train their models.
• We store your conversations so you can see your history and so we can operate, troubleshoot and improve the feature. You can ask us to delete them at any time (see Your rights).
• AI responses are generated automatically and can be inaccurate, incomplete or inappropriate. Don't rely on them for medical, legal, financial or other professional advice, and don't submit personal data about other people or sensitive information.
• We do not use your AI content to make decisions that produce legal or similarly significant effects for you.

5. Advertising and measurement

Campaign measurement. When you install the app or make a purchase after seeing one of our ads, we tell the advertising platform about that event (for example "install", "start trial" or "purchase", with the value) together with the identifiers needed to match it to the ad — such as a click identifier, your IP address and user agent, or the advertising identifier you allowed. This lets us know which ads work and lets the platforms optimise our campaigns. The platforms we use are Google Ads and Apple Search Ads.

Your choices. On iOS, the app asks before tracking you across other companies' apps and websites, and you can change this any time in Settings → Privacy & Security → Tracking. On Android, you can delete or reset your advertising ID in Settings → Privacy → Ads. On the website, you can refuse non-essential cookies.

6. Service providers

We share personal data only with providers that process it on our behalf and under our instructions, with app stores for purchases, and with authorities where the law requires it. Our providers are:

We may also disclose personal data to a buyer or successor if our business or the app is sold or merged, to professional advisers under confidentiality duties, and where necessary to establish, exercise or defend legal claims. We do not sell personal data for money. Sharing identifiers with advertising platforms for measurement may count as "sharing" or "targeted advertising" under some US state laws — see section 14.

7. Subscriptions and payments

Purchases are made through the Apple App Store or Google Play and are subject to their terms. They process your payment details; we receive confirmation of the purchase, the product, the price and transaction identifiers through RevenueCat, which we use to give you access, handle renewals and restores, and keep accounting records.

8. International transfers

We are based in Türkiye, and our providers process data in the United States, the European Union and other countries. Where personal data is transferred out of the EEA, the UK, Switzerland or Türkiye to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, for transfers from Türkiye, the standard contracts and other mechanisms provided under Law No. 6698. You can ask us for more information about these safeguards.

9. How long we keep data

• Usage and analytics data: up to 26 months.
• Purchase records: as long as tax and accounting laws require (generally 10 years in Türkiye).
• AI conversations: until you delete them or ask us to, or 24 months after your last use of the app.
• Support messages: up to 3 years after the matter is closed.
• Advertising and website identifiers: up to 13 months.

When the period ends, we delete or anonymise the data, unless we must keep it longer by law or to defend a legal claim.

10. Security

We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit, access controls limited to staff and providers who need it, and logging of access to production systems. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.

11. Your rights

Depending on where you live, you may have the right to: know whether we process your data and get a copy of it; correct inaccurate data; have it deleted; restrict or object to processing, including for direct marketing; receive it in a portable format; withdraw consent at any time (without affecting earlier processing); and not be subject to decisions based solely on automated processing that significantly affect you.

To exercise them, write to [email protected]. Because you don't have an account, we may ask for your in-app identifier or purchase details to find your data and confirm the request is yours. We answer within one month (30 days in Türkiye), and free of charge unless a request is clearly unfounded or excessive. Deleting the app does not delete data we already hold; to delete it, contact us.

12. EEA, UK and Switzerland

If you are in the European Economic Area, the United Kingdom or Switzerland, the GDPR (and the UK GDPR or Swiss law) gives you the rights in section 11, and we process your data on the legal bases in section 3. Where we rely on legitimate interests, you may object, and we will stop unless we have compelling grounds. You also have the right to lodge a complaint with the data protection authority where you live or work.

13. Türkiye

If you are in Türkiye, we process your personal data as data controller under the Personal Data Protection Law No. 6698 ("KVKK"), for the purposes and on the legal grounds in section 3 (Articles 5 and 6 of the KVKK), and transfer it abroad as described in section 8 (Article 9). Under Article 11 you may ask us whether your data is processed, request information about it, learn the purpose of processing and whether it is used accordingly, know the third parties it is transferred to in Türkiye or abroad, request its correction or deletion and the notification of these to recipients, object to a result against you arising solely from automated analysis, and claim compensation for damage caused by unlawful processing. Send requests in writing to Esentepe Mah. Yüzbaşı Kaya Aldoğan Sk. Pardus Plaza No: 4 İç Kapı No: 3, Şişli, İstanbul, or to [email protected]. If we reject your request or don't answer in time, you may complain to the Personal Data Protection Board.

14. California and other US states

If you live in California or another US state with a consumer privacy law, you have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of the "sale" or "sharing" of personal information and of targeted advertising; and not to be discriminated against for using these rights. In the last 12 months we collected the categories described in section 2: identifiers, commercial information (purchases), internet or other electronic network activity (usage data), and approximate geolocation, and content you submitted to AI features. We collect them for the purposes in section 3, disclose them to the service providers in section 6, and keep them for the periods in section 9. We do not sell personal information for money; providing identifiers to advertising platforms for measurement may be a "sale", "sharing" or "targeted advertising" under these laws, and you can opt out by turning off tracking on your device (section 5) or by writing to us. We do not use sensitive personal information. You or an authorised agent can make a request at [email protected]; we verify it as described in section 11.

15. Children

The Service is not directed to children under 13 (or under 16 in the EEA, or the age of digital consent where you live), and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

16. Changes to this policy

We may update this policy as the Service or the law changes. The effective date at the top shows when it last changed; if a change is significant, we will tell you in the app before it takes effect. Continuing to use the Service after that means the updated policy applies.

17. Contact

ETILER DIJITAL HIZMETLER LIMITED SIRKETI
Esentepe Mah. Yüzbaşı Kaya Aldoğan Sk. Pardus Plaza No: 4 İç Kapı No: 3, Şişli, İstanbul
[email protected]