Draft, pending legal review. It describes what the system actually does, field by field. It is written to the GDPR standard everywhere, with the additions US state law and KVKK require (ADR 0017). Not yet reviewed by a lawyer; company and registration details are to be completed.
moovoy is the controller of what is described here — veri sorumlusu under KVKK, "business" under the CCPA.
1. What we hold, and why
Everything below is something the system genuinely stores.
| What | Why | How long |
|---|---|---|
| Your name and email address | To open an account, and so an operator knows who to meet | Until you close the account |
| Your password, hashed | To sign you in. We cannot read it | Until you close the account |
| Which terms you accepted, which version, and when | To show what was agreed | 10 years |
| Whether you asked for marketing email, and when | Because we may only send it if you did | Until you close the account |
| Your phone number, passenger name, flight number and notes, given at booking | So the operator can carry you and reach you on the day | With the journey record |
| Your journeys — route, times, operator, price, and how the price was worked out | To perform the contract, and to answer questions about it | 10 years (tax law) |
| Payments, refunds, extras you approved, and when you approved them | Tax law, and to show you consented to each charge | 10 years |
| A reference to a card you asked the payment provider to keep, and its label (e.g. "Visa ending 4242") | So a later payment you approve is one tap. Never the card number | Until you remove it |
| Saved places, travellers and preferences | So you do not type them twice | Until you delete them |
| Your reviews | To inform other customers | Until you delete them; removed reviews are kept on our record |
| Notices we sent you, and whether the email left | To show we told you | 3 years |
| A problem you reported, and what was decided | To resolve it, and to see a pattern | 10 years |
| A note an operator wrote about a journey with you | The operator's own record, visible only inside that operator | As long as the operator's account exists |
If you work for an operator, we also hold your business account, your role and abilities, invitations, and — for the owner — the company's details and the documents it uploaded, with an append-only record of every decision about them.
We do not store card numbers, and never see them. We do not build a profile of you, we do not infer anything about your health, beliefs or politics, and we do not sell or share your personal information for advertising.
2. On what legal basis
- Performing our contract with you — your account, bookings, payments.
- A legal obligation — invoices and journey records.
- Your consent — marketing email and any non-essential cookie. Separate, off by default, withdrawn in one click.
- Our legitimate interest — security, fraud prevention, and the record that shows what we checked about operators. Balanced against your rights and never a catch-all.
3. Who else sees it
Only these, only what they need, each under a contract:
| Who | What they get | Why |
|---|---|---|
| The operator you booked | Your name, phone, route, times, flight and notes | They carry you |
| The payment provider (Stripe; iyzico for operators in Türkiye) | What is needed to hold and take a payment, and your card if you ask it to keep it | Payment |
| Google (Maps Platform) | The address text you type, and the two points of a route | Address suggestions and distance |
| Resend (email) | Your address and the message | To deliver email you are expecting |
| Cloudinary (media) | Photographs operators upload | Hosting pictures |
| Railway, Vercel (hosting) | The database, as infrastructure | To run the site |
| Authorities or a court | What is lawfully required | Because it is required |
The operator becomes a controller of what we pass them, for their own records. Their agreement with us requires their own privacy notice, forbids marketing to you from our data, and forbids selling it.
4. Where it is held
The database and the API are in Europe. Some providers above process data in the United States and elsewhere. Transfers rest on standard contractual clauses or an adequacy decision, and, where KVKK requires, your explicit consent. A lawyer must confirm this paragraph before launch.
5. What you can do
Wherever you live:
- See it — including any note an operator wrote about you. Ask us, and we answer within 30 days.
- Correct it — in your account, or by writing to us.
- Delete it — close your account and the personal parts go. What survives is the journey and payment record the law requires us to keep.
- Take it elsewhere — in a machine-readable file.
- Withdraw consent — one click for marketing; the cookie settings link for cookies.
- Object where we rely on legitimate interest.
- Complain — to us first at hello@moovoy.com, then to the supervisory authority where you live.
Regional additions
- California (CCPA/CPRA) — you have the rights to know, delete, correct, and to opt out of the sale or sharing of personal information. We do not sell or share it, and we do not use sensitive personal information beyond what a booking needs. We will not treat you differently for using these rights. An authorised agent may make a request for you.
- European Union and EEA (GDPR) — the rights above, and a complaint to the data protection authority in your country.
- Türkiye (KVKK Article 11) — the rights above, answered within 30 days, and a complaint to the Kişisel Verileri Koruma Kurumu.
6. Children
moovoy is not for people under 18. A child travelling as a passenger is named by the adult who books; we hold that name and any requirement, such as a child seat, and nothing else.
7. If something goes wrong
If personal data is exposed, we tell the relevant authority within 72 hours of becoming aware, and tell you directly where it is likely to put you at risk.
8. Changes
We tell you before a material change takes effect. The version you were shown is recorded with the date.
9. Reaching us
moovoy · hello@moovoy.com
Company name, address, and registration numbers (including VERBİS for Türkiye) to be completed before launch.