KVKK notice
This page sets out the basic facts about the personal data processed within Routavio, and how to make a request.
Data controller
Routavio is not a separate legal entity. The project is run independently by Halil Çınar.
Requests about personal data can be sent to [email protected].
Types of data processed
Data is collected electronically and by automated means while you use the site. Routavio is not aimed at people under 18 and no data is knowingly collected from that age group.
- Account details: email address, an irreversible hash of the password and, if you gave them, your name, home city, passport nationality and currency preference.
- Session records: a hash of the session token, how long the session lasts, browser details and IP address.
- Usage records: the searches you run (from, to, which date), the routes and plans you save, the price alerts you set, and the moments you click through to a third-party provider.
- Consent records: when marketing consent was given or withdrawn, with the IP address and browser details at that moment.
- Pilot form: if you took part in the Sabancı University pilot, the answers you gave and the language you gave them in. Taking part is voluntary, you can stop at any time, and these records are deleted on a single email; if you did not take part, no such record exists.
Purposes of processing
- To compute routes for the trip you searched, joining flight, train, bus and ferry into one result.
- To keep your account open, keep your session secure and prevent abuse.
- To send the emails the service cannot work without, such as email verification and password resets.
- To send the price radar and the newsletter, if explicit consent was given.
- In the pilot study, to read the form answers alongside the matching search log.
The data the account and the service need in order to work is processed as part of the service relationship, while session security and the prevention of abuse are processed under legitimate interest. Marketing email, non-essential cookies and taking part in the pilot study depend on explicit consent alone; consent can be withdrawn at any time and this does not affect your use of the service. Route ranking ranks journeys; there is no personalised pricing and no profiling.
Service providers the data is transferred to
Personal data is not sold and is not opened to ad networks. The service uses the following providers: the infrastructure providers that host the site and run the database, the delivery provider that sends the email, and the model provider that processes the text written to the AI assistant. When you click through to a third-party provider's site (Kiwi, Aviasales, FlixBus, Omio and similar), that provider sees the referral under its own rules. Pilot study answers are not shared with third parties.
Use of service providers abroad
The providers above keep their servers outside Turkey, mostly in the European Union and the United States, so data is transferred abroad. Transfers are made under those providers' standard contractual clauses and data processing agreements, with the safeguards in article 9 of the Law in view. Without an account, search still works in full.
Retention approach
Account and usage data is kept while the account is open; when the account is deleted, the records attached to it are deleted with it. Session records fall away by themselves when they expire. Consent records are kept afterwards as well, so that the giving and the withdrawal of consent can be shown. Pilot answers are kept until the study is finished, or deleted earlier on request.
How to make a request
It is enough to write your name, how you can be reached and what you are asking for; if you prefer the formal route, you can also send it in writing or by registered electronic mail. As far as your identity can be verified, you get a free answer within thirty days at the latest. If you find the answer inadequate, or thirty days pass with no reply, you can complain to the Personal Data Protection Board. Address: [email protected]
Your rights
Article 11 of Law 6698 gives you the following rights:
- To learn whether your personal data is being processed.
- To request information about it if it has been processed.
- To learn the purpose of the processing and whether the data is used in line with that purpose.
- To know the third parties the data is transferred to, in Turkey or abroad.
- To ask for it to be corrected if it has been processed incompletely or wrongly, to ask for it to be deleted where the conditions are met, and to ask that this be notified to the third parties it was transferred to.
- To object to a result reached against you through analysis of the data by automated systems alone.
- To claim compensation if you suffer damage because the data was processed unlawfully.
To use any of these rights, all you have to do is write. As far as your identity can be verified, you get an answer within thirty days at the latest: [email protected]
Last updated: 22 August 2026.