KVKK Information Notice

This information notice is provided by Moneo YAZILIM A.Ş. ("the Company," "we") as data controller under Article 10 of Türkiye's Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It explains how we process your personal data in connection with the hiddeneye.ai website, the venue partner program, public venue pages and scan reports, and the Hidden Eye app's feature that detects scans made at partner venues. The Turkish version of this notice is the authoritative text; this English version is a translation.

Data processed in the other features of the Hidden Eye mobile app is described in detail in our Privacy Policy. This notice supplements the Privacy Policy.

1. Data controller

The data controller is Moneo YAZILIM A.Ş., Nidakule Göztepe, Merdivenköy Mh. Bora Sk. No:1-3/22, Kadıköy, İstanbul, Türkiye. You can reach us by phone at +90 850 885 0 911 and by email at [email protected].

2. Personal data we process

Which data we process depends on the channel through which you deal with us.

a) The contact form on our website

• Identity and contact: your email address and, if you give it, your name.
• Request details: the topic you choose, your message and any other information you include in it.
• Transaction security: a one-way hash of your IP address (the IP address itself is not stored), the time of sending, and the result of the browser check that Cloudflare Turnstile runs to tell automated submissions apart.

Reports made through the "Report a problem" link on venue pages and emails you send us directly are also covered here. For cookies and visitor statistics on our website, see our Privacy Policy.

b) Venue partner applications and the partner relationship

This section covers applicants, venue representatives, employees who use the venue panel, and individual hosts.

• Application details: the venue's name, type, city, number of rooms, website or listing link, and the applicant's email address and phone number.
• Ownership verification: an email address at the business's domain, Google Business Profile details, records of the verification call; for Airbnb hosts, the listing link and a screenshot of the host profile.
• Venue registration: the venue's address and the location marked on the map, the venue's Wi-Fi network names and access point identifiers (BSSIDs), the public IP address our server sees during venue-mode scans, and the app identifiers of devices linked to the venue-mode account. For individual hosts who let out a single flat, this information may be personal data.
• Panel users: the name and email address of people who use the venue panel, and records of their actions in the panel.
• Billing and payment details (for venues that choose cash payouts): tax ID number (VKN) or Turkish national ID number (TCKN), IBAN, trade name or full name, address, tax office and invoice details; for individuals without a tax registration, expense voucher (gider pusulası) and withholding tax records.
• Correspondence: emails and other correspondence with us as part of the partner relationship.

c) Public venue pages and scan reports

• Photos taken in venue mode: taken when no guests are in the room. Before publication, EXIF data (including location) is removed and faces, documents and screens are blurred automatically.
• Scan details: the venue, the room, the date and time of the scan, the checks made, coverage and results.
• The person who scanned: the report shows only their role or initials. Which panel user made the scan is kept in our records and is not published.

Reports do not contain Bluetooth MAC addresses, Wi-Fi network names, IP addresses, full device lists or any data about guests. Guest scans are shown on the page only as a total.

d) The Hidden Eye app

Data processed in the app (anonymous installation ID, subscription information, usage and device information, images you send to AI features, crash reports and advertising measurement) is described in our Privacy Policy.

e) Detecting scans at partner venues

When you start a room scan in the app, the app sends our server the following, to tell whether the scan is being made at a partner venue:

• a one-way hash of the identifier (BSSID) of the Wi-Fi access point you are connected to;
• only if you have allowed it on your device, your precise location (coordinates);
• the IP address the request comes from (it reaches the server with every internet request).

This information is used only to determine whether the scan matches a registered partner venue and is not stored. Location permission is requested only while the app is in use; location is not used in the background. Not granting it does not block your scan or any feature of the app.

If there is a match, the only thing stored is a record that your app profile ID (an anonymous ID held by our subscription provider, Adapty) scanned at a given venue at a given time. This record is used to show you the venue's discounted price, to build the venue's guest scan count and, if you buy Pro within 72 hours, to calculate the share owed to the venue. The venue does not see who you are; the venue panel shows only totals and amounts.

3. Purposes of processing

• To reply to your contact requests and reports, and to look into problems reported to us.
• To assess partner applications, verify venue ownership and prevent fraudulent applications.
• To enter into and perform the partner agreement; to provide the venue panel and manage venue registrations and venue-mode devices.
• To publish venue pages, badges and scan reports, and to produce PDF copies and translations of reports.
• To detect scans made at partner venues, build guest scan counts, offer venue guests a discounted price, calculate venue shares and reflect refunds.
• To pay shares, handle invoices and expense vouchers, and meet tax and accounting obligations.
• To prevent fake scans, location spoofing and misuse, and to keep information secure.
• To establish, exercise and protect our rights in legal disputes, and to respond to requests from competent authorities.

4. Legal bases

We process your personal data on the following legal bases listed in Article 5(2) of the KVKK:

• Formation or performance of a contract (Art. 5(2)(c)): assessing partner applications, performing the partner agreement, managing panel users, publishing reports, offering venue guests a discounted price, and calculating and paying shares.
• Express provision by law and compliance with a legal obligation (Art. 5(2)(a) and (ç)): obligations under Tax Procedure Law No. 213, Income Tax Law No. 193 and Turkish Commercial Code No. 6102, such as invoices, expense vouchers, withholding tax and keeping books and records, and requests from competent authorities.
• Establishing, exercising or protecting a right (Art. 5(2)(e)): keeping the records needed for disputes, objections and refunds.
• Legitimate interest (Art. 5(2)(f)): replying to contact requests, verifying ownership and preventing fraud, detecting scans at partner venues, showing the scanner's role or initials in reports, and information security. In this processing we take care not to harm your fundamental rights and freedoms and use only the data that is needed; for example, we do not store the location and network information used for detection.

We do not rely on your explicit consent for any of the processing described in this notice. Precise location is used only if you allow it on your device's permission screen, and you can withdraw that permission at any time in your device settings. If we later want to carry out processing for which the law requires explicit consent or approval, such as sending commercial electronic messages for marketing, we will ask for it separately and it will be optional. Not giving it does not affect any service, and you can withdraw it at any time.

5. Recipients of personal data

We do not sell your personal data. We transfer data only as far as needed for the purposes above, in line with Articles 8 and 9 of the KVKK, to the following recipients:

• DigitalOcean: the servers that run the website, the venue panel and databases.
• Cloudflare: caching and content delivery, file storage (R2), checking for automated submissions on the contact form with Cloudflare Turnstile, and rendering report PDFs.
• Resend: delivering contact form messages to us and sending you notification emails.
• Adapty: verifying subscriptions and purchase events, and showing venue guests the discounted price.
• OpenAI: analysing images in the app's AI features.
• Sentry: recording errors and crashes.
• Google (Google Analytics): website visitor statistics.
• Banks: making cash payouts.
• Our accountants and legal advisers: handling accounting, tax and legal matters.
• Competent public authorities and courts: only where required by law and to the extent requested.

Public venue pages and reports are, by their nature, visible to anyone with internet access and can be downloaded as PDFs.

6. Transfers abroad

Some of the service providers above process data outside Türkiye, mainly in the United States and European Union countries. Since 1 June 2024, explicit consent is no longer a general basis for transfers abroad. We make these transfers under Article 9 of the KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, using the standard contracts published by the Board, and we notify the Personal Data Protection Authority of the standard contracts within five business days of signing them. In exceptional, occasional cases where a standard contract cannot be used, we rely only on the cases listed in Article 9(6).

7. How we collect personal data

We collect your personal data by partly or fully automated means: through the contact and partner application forms on our website, the venue panel, the Hidden Eye app (including venue mode) and email, and also during verification phone calls and from documents you send us. The IP address used in scan detection is received automatically with the request the app makes to our server.

8. How long we keep personal data

• Contact form messages: 12 months, then deleted automatically. Emails you send us directly: until your request is resolved.
• Partner application details: while the application is being assessed. If the application is rejected or not completed, 1 year from the last action on it.
• Screenshots and similar documents obtained for ownership verification: no more than 1 year after verification is concluded.
• Partner agreement, invoice, expense voucher and payment records: for the periods required by law, in particular Article 82 of Turkish Commercial Code No. 6102 and Article 253 of Tax Procedure Law No. 213; as a rule, 10 years from the year following the year in which the agreement ends.
• Panel user details: while the partnership continues or the user's access remains active; after that, only as part of the agreement records, for the period above.
• Venue pages and reports: remain published while the venue is a partner. A report the venue withdraws is deleted; the page shows only the number of withdrawn reports. When the partnership ends, the venue page, badge and reports are taken down.
• Scan detection: location coordinates, BSSID hashes and IP addresses are never stored. The record that "this profile scanned at this venue at this time" is kept until the 72-hour purchase window and the refund period have passed; it is then separated from the profile ID and only the venue's daily total scan count remains.
• App data: the periods stated in our Privacy Policy.

When a retention period ends, the data is deleted, destroyed or anonymised in line with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data. If there is a dispute or an official request, the relevant data may be kept until it is resolved.

9. Your rights under Article 11 of the KVKK

By applying to us, you have the right to:

• learn whether your personal data is processed,
• request information about it if it has been processed,
• learn the purpose of processing and whether the data is used in line with that purpose,
• know the third parties in Türkiye or abroad to whom the data is transferred,
• ask for the data to be corrected if it is incomplete or inaccurate,
• ask for the data to be deleted or destroyed under the conditions in Article 7 of the KVKK,
• ask for third parties to whom the data was transferred to be notified of any correction, deletion or destruction,
• object to a result against you arising from the analysis of your data exclusively by automated systems,
• claim compensation if you suffer damage because your personal data was processed unlawfully.

10. How to apply

To exercise your rights, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your application:

• as a petition with your wet signature, by hand or by post, to our address above,
• using your registered electronic mail (KEP) address, secure electronic signature or mobile signature,
• to [email protected] from an email address you have previously given us and that is registered in our systems.

Your application must include your name and surname, your signature for written applications, your Turkish national ID number if you are a Turkish citizen or, if you are not, your nationality and passport or ID number, your address for notifications, your email address if any, your phone number and the subject of your request. Because the app does not use accounts, we may ask for additional information, such as the date of a scan, so we can find your data.

We will conclude your application free of charge as soon as possible according to its nature, and within 30 days at the latest. If the request involves an additional cost, the fee set in the tariff in the Communiqué may be charged.

11. Right to complain to the Board

If your application is rejected, you find our reply insufficient, or we do not reply in time, you may complain to the Personal Data Protection Board under Article 14 of the KVKK within 30 days of learning of our reply and in any event within 60 days of the date of your application.

12. Changes

We may update this information notice when our processing activities or the law change. The current version is always published on this page. We will also tell venue partners about significant changes by email or in the venue panel. For other rules that apply to venue partners, see the Venue Partner Terms; for the app's terms of use, see the Terms of Service.

13. Contact

For questions and applications about this notice: