KVKK Privacy Notice

1. Identity of the Data Controller

Under KVKK, the following legal/natural person is responsible as the Data Controller for the processing of your personal data:

• Trade name / Name: Bunayorumum
• Website: bunayorumum.net
• Email (Contact and KVKK applications): iletisim@bunayorumum.net
• Address for service: Shared on request via contact

Company details (full trade name, MERSİS number, registered electronic mail (KEP) address, tax office) will be added in this section once the legal entity has been established. Throughout this process, the email address above remains the valid communication channel for KVKK rights applications.

2. Categories of Personal Data Processed

Bunayorumum processes the following categories of personal data within the framework of the definitions in KVKK Article 3:

2.1. Identity Data

• First name, last name (optional, entered by the user during registration if they wish)
• Username / alias (if any)

2.2. Contact Data

• Email address (mandatory, verified)

2.3. Customer Transaction Data

• Membership date, last login date, plan-change history
• Plan type (Free, 30-Day Package, Premium, Dealer & Professionals)
• Analysis credit (quota) usage records
• Saved listings, garage records, your shortlists
• Premium expert review requests and your feedback

2.4. Analysis Transaction Data

• The listing URLs analyzed and the analysis reports produced (including content)
• Your comments, questions and story posts
• Notification preferences

2.5. Financial Data

• Transaction amount, plan/package name, date, order/transaction reference, invoice number
• Wallet balance and wallet transaction history (top-up, spending, gift-card use); referral/invite credit records
• Card details (card number, CVV, etc.) are not processed. At present, payments are accepted only by bank transfer (Havale/EFT) and in-site wallet balance; payment by credit/debit card is not yet active. When card payment is enabled in the future, card data will be collected on the infrastructure of a PCI-DSS compliant third-party payment service provider and will not be stored on our servers.

2.6. Technical Data

• IP address, browser type (user-agent), operating system
• Device fingerprint (limited use for fraud prevention only)
• Cookie and session identifiers (for details, see the Cookie Policy)

2.7. Authentication Data

• Password hash (stored with bcrypt/argon2; the plain-text password is never kept)
• Access/refresh tokens (access_token, refresh_token)
• Two-factor authentication tokens (if enabled)

2.8. Behavioral and Profiling Data (subject to Explicit Consent)

• Usage behavior events (UserBehaviorEvent: analysis, viewing, search)
• Personalization profile (UserPersonalizationProfile: preferred make, price range)

This category is processed only if consent is given under the Explicit Consent Statement.

2.9. Communications Marketing Data (subject to Explicit Consent)

• Marketing email subscription status, open/click metrics (Resend infrastructure)
• Web push notification subscription (browser push token)

This category also requires explicit consent.

3. Third-Party Listing Owner Data

Bunayorumum does not store the personal data of the listing owner (the seller) in its database.In the data pulled from listing platforms such as Sahibinden.com, arabam.com and similar, via a single car or motorcycle listing URL chosen by the user, only technical information about the vehicle itself is processed:

• Make, model, year, mileage, engine, transmission, fuel, color, body/segment type
• Listing title and description (shortened and technically cleaned for analysis purposes)
• The vehicle's photo links. In standard analysis the photo files are not downloaded, only the link reference is processed. When the vision feature is enabled, a limited number of the listing's photos (up to 8) are passed through AI visual analysis to assess paint/damage/inspection marks; this processing is carried out on Anthropic (USA) infrastructure and raw photos are not stored permanently (see Sections 7 and 8).
• Location (at city / district level; not a person-specific address)
• Price, seller type (individual / dealer); the seller's identity is not stored

This approach is directly compliant with the principles of data minimization and purpose limitation in KVKK Article 4. The listing description is shortened and technically cleaned for analysis; the seller's personal data such as name, surname, phone and email is not recorded in our database and is not shown in the AI report output.

If, as a listing owner, you believe your data should not be processed, contact iletisim@bunayorumum.net; we will review within 24 hours and, if necessary, stop the analysis display of the relevant listing.

4. Processing Purposes and Legal Bases

The table below shows for which purpose and on which legal basis each category of data is processed:

5. Method of Collection

Your personal data is collected electronically, by automated or partly automated methods:

• Registration and login forms on the website
• Account operations (profile update, plan change)
• Analysis request form (listing URL entry)
• Havale/EFT and wallet payment flows
• Cookies and similar technologies (localStorage, sessionStorage)
• Contact by email and support request forms

In addition, for price comparison (the market index), public technical information such as price / year / mileage of listings comparable to the analyzed vehicle is compiled from arabam.com and (when enabled) sahibinden.com search results in an anonymized and aggregate form. In this comparable-listings compilation, the identity, link or seller information of an individual listing is not stored; only the price distribution (median, lower/upper quartile) and the sample count are calculated.

6. Transfer of Data (KVKK Article 8 — Domestic)

Within the framework of KVKK Article 8, your data may be transferred on a limited basis to the following categories of recipient:

Your data is not sold to third-party companies for advertising or marketing purposes.

7. Cross-Border (Overseas) Transfer (KVKK Article 9 — 2024 Reform)

Within the framework of KVKK Article 9, as re-regulated by Law No. 7499 (2024), certain transfers that are essential for operating the service are made overseas. The legal basis for the transfer is the Standard Contractual Clauses (SCC) published by the Board and a notification to the Authority within 5 business days of the date of signature:

Which data goes to which provider? In standard analyses, listing data (the URL and a content summary) is sent by default to Google Gemini. When a Premium user selects "Deep Analysis", or as a fallback during peak load, the same data is sent to Anthropic Claude. When the vision feature is enabled, listing photos are processed only on Anthropic infrastructure (no photo is sent to Google). Email, error monitoring and analytics transfers are limited to the relevant providers.

8. Automated Systems and Artificial Intelligence

Within the scope of the service, Bunayorumum analyzes listing data and produces reports using artificial intelligence (Claude/Anthropic and Gemini/Google). Under KVKK Article 11/g, as a data subject you have the right to object to a result arising against you through analysis by automated systems.

• AI analysis outputs are supportive of the user's own decision and do not produce an adverse legal result (for example, credit refusal, setting an insurance premium).
• AI reports are shown only to the requesting user; they are not automatically shared with third parties.
• When a showcase image is produced on the report page, the vehicle's license plate in the image is automatically detected and masked as a requirement of personal data protection; if the plate cannot be safely masked, the image is not shown at all. The raw image is not stored permanently; the masked image is produced at the time of the request.
• If you object to the accuracy of the AI output, you can request a manual review or deletion of the report.
• Your data is not used in AI training (Section 7).

9. Retention Periods

The destruction cycle is applied at least once every 6 months (Regulation on the Deletion, Destruction or Anonymization of Personal Data, art. 11).

10. Your Rights as a Data Subject (KVKK Article 11)

As a data subject you have the following rights:

1. To learn whether your personal data is processed
2. If it has been processed, to request information about this
3. To learn the purpose of the processing and whether the data is used in line with that purpose
4. To know the third parties to whom the data has been transferred, domestically or overseas
5. To request correction if it has been processed incompletely or inaccurately
6. To request its deletion or destruction within the framework of KVKK Article 7
7. To request that correction or deletion operations be notified to the third parties to whom the data was transferred
8. To object to a result arising against you through analysis solely by automated systems
9. To claim compensation for damage arising from unlawful processing

To exercise the rights above, you can visit our Data Subject Rights Application page or send an email directly.

11. Application and Contact

Under KVKK Article 13, to exercise your rights you may submit your request:

• Email: iletisim@bunayorumum.net (from your registered email address)
• In-site application form: Data Subject Rights Application
• Post: Shared when you request it via contact

Your application is concluded within 30 days at the latest, free of charge as a rule (Article 13). If you are not satisfied with the response, or you do not receive a response within 30 days, you may file a complaint with the KVKK Authority.

Information expected in an application:

• First name, last name, Turkish ID (T.C. kimlik) number
• Address for service
• The nature of the personal data subject to the request
• The request and its basis

12. Updates to This Notice

This Privacy Notice may be updated depending on changes in the scope of the service or in legislation. For significant changes that may be against the consumer's interests, notice is given by email at least 15 days in advance; for your right to object, see Terms of Use Article 13.

For your questions: iletisim@bunayorumum.net · Related pages: Explicit Consent Statement · Cookie Policy · Terms of Use