Privacy Policy

Garajiz (“we”, “us”, “the app”) processes the personal data described below in accordance with the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, where it applies, the EU General Data Protection Regulation (“GDPR”).

• Data controller: [TO BE FILLED: legal entity name]
• Address: [TO BE FILLED: registered address], Türkiye
• MERSIS no.: [TO BE FILLED] · VERBIS no.: [TO BE FILLED]
• Privacy contact: kvkk@garajiz.com
• EU representative: [TO BE FILLED: EU representative under Art. 27 GDPR, if appointed]

• Account information: your name and email address when you sign in with Google or Apple; your email address when you register with email. If you use Apple's “Hide My Email”, we only receive Apple's private relay address. We receive no data from Apple other than name and email.
• Business information: the business name, city and business phone you enter when creating a service/garage account.
• Payments and subscriptions: in-app subscriptions (App Store) are processed by Apple; we never see your card details and only store the subscription status and transaction ID. Subscriptions purchased on the web are processed by Dodo Payments as Merchant of Record.
• Vehicle information: plate, make/model, inspection and insurance dates and similar information you add.
• Driving licence (optional): if you use licence reminders, the licence classes and expiry date you enter.
• Appointment information: the garage, service, date and notes you choose.
• Contact: the phone number you provide (optional).
• Location: only if you allow it, your device location is used to show the nearest auto services. Your location is not stored on our servers; it is processed only to list nearby services at that moment. You can revoke the permission in your device settings at any time.
• Live support chat: the messages you write to our support assistant (Emocan) and, if a team member takes over, the conversation with our team.
• Technical: a session cookie and basic server logs.
• App diagnostics: when the iOS app hits an error or crashes, the error log, app version, device model, OS version and performance metrics such as screen load times — used only to find and fix bugs.
• App usage data: which screens are opened and which features are used in the iOS app (e.g. creating a work order, sending a quote). This is linked to your internal user ID, but your name, email, phone and plate are not sent. No screen recording; not used for advertising or tracking and not combined with other companies' data.

When you sign in with Google, or when a business connects its calendar in settings, and only if you grant permission, we request Google Calendar (calendar.events) access. We use this access only for the following:

Vehicle owners (customer portal):

• to create a reminder event in your own Google Calendar for a service appointment you book;
• to delete that event when you cancel the appointment;
• to create/update yearly reminder events for the inspection and insurance dates you enter.

Businesses (service panel, if a Google Calendar connection is set up):

• to write the business's appointments as events to the primary calendar of the connected Google account, update the event when the time changes and delete it when the appointment is cancelled. The event contains the plate, service, vehicle owner's name and phone, location and assigned technician (free-text appointment notes are not written). This data is transferred to the Google account connected by the business (Google LLC, servers outside Türkiye) because the business set up the connection and to perform the appointment service;
• when an appointment event created by Garajiz is moved in the calendar, to update the appointment time in Garajiz accordingly (deleting the event from the calendar does not cancel the appointment; the panel only shows a warning);
• to read only the start and end times of other events in the calendar so those slots are treated as busy for online booking. The title, description, location and attendees of those events are not stored or displayed.

We do not read, copy or analyse your calendar events for any other purpose. We do not use this access for advertising and never sell or transfer it to third parties. A business can disconnect the calendar at any time in Garajiz under Settings → Google Calendar; disconnecting stops new writes and watching, but appointment events already created remain in Google (the business can delete them in Google Calendar). You can also revoke this access at any time on your Google account's Permissions page.

When you create a business/garage account, and only if you grant permission, we request Google Drive (drive.file) access. We use it only to:

• create a single folder for your business in your own Google Drive (“Garajiz — {your business name}”);
• upload the vehicle and work-order photos you add to that folder and store their links so the app can display them.

Because of the drive.file scope, we can access only files created through this app. We cannot read, see or change any other existing files or folders in your Drive.

Customer portal — registration document OCR: if you choose to scan your vehicle registration, and only with your permission, a temporary Google Doc is created in your Drive with the drive.file scope, the vehicle details (plate, make/model) are read and the file is deleted as soon as processing is complete. No other file in your Drive is accessed.

• Encryption in transit: all data transfers are encrypted with TLS 1.2+; the connection between your browser and our servers always uses HTTPS.
• Encryption at rest: data is stored on Supabase infrastructure in the EU (Frankfurt) region on AES-256 encrypted disks. Your Google authorisation tokens (refresh tokens) are additionally encrypted at application level with AES-256-GCM; the key is kept separately from the database.
• Access control: your data is accessible only through your authenticated session. Server-side role-based access control is enforced; each user can access only their own records. Administrator access requires separate credentials and is recorded in an audit log.
• Data minimisation: we collect only what the service needs. Google API scopes follow the principle of least privilege (calendar.events and drive.file — no full account access).
• Retention: account and vehicle data are kept while your account is active. When you delete your account, your personal data is permanently deleted within 30 days. When the sole owner of a business deletes their account, the business is closed immediately (its storefront goes offline and all staff lose access) and all of the business's records are permanently deleted within 30 days. Server logs are kept for up to 90 days. Live support conversations are deleted automatically 365 days after the last message.
• Breach notification: if we detect a security breach affecting your personal data, we notify the competent authorities within 72 hours as required by KVKK Art. 12 and applicable law, and inform affected users without delay by email or in-app notice.

We do not sell your personal data. Data is shared only with the infrastructure providers we use to deliver the service (e.g. Google Cloud for hosting, Supabase for the database, Google Analytics for web analytics, Apple and Dodo Payments for payments) and with the garage you book an appointment with (vehicle and contact details, so it can manage the appointment).

Other processors we use to operate the service:

• Resend — sending verification codes, notifications and quote emails (email address and email content).
• Sentry — error, crash and performance tracking on the website and iOS app (error log, device/browser type, app and OS version; passwords and payment details are not sent). Processed in the EU (Germany).
• PostHog — product usage analytics in the iOS app (screens opened, features used, internal user ID; no name, email, phone or plate; no screen recording). Processed in the EU (Germany).
• Microsoft Clarity — with your cookie consent only, website usage analytics including session interaction recordings and heatmaps.
• Cloudflare — domain, security and content delivery (IP address and request data).
• Upstash — rate limiting to prevent abuse (temporary user/IP keys, short-lived).
• Telegram — when a live support conversation is handed over to our team, the conversation (your messages and any name/email you provided) is relayed to our team's private Telegram group so a team member can reply.
• Apple Push Notification service and browser push services — delivering notifications to your device when you turn them on (device push token and notification text).

When you use AI features (fault diagnosis, vehicle value estimate, maintenance estimate, community answer suggestions; work-order suggestions for businesses), only the vehicle details needed for that feature (make, model, year, mileage, colour, fault code) and the symptom, complaint, diagnosis or question text you write are shared with our AI provider Anthropic PBC (USA). Your name, email, phone, plate and VIN are not sent. The app explains this sharing and asks for your consent the first time you use these features; if you do not consent, the AI features will not work and nothing else is affected. Anthropic processes this data only to generate a response and does not use it to train its models.

Because the providers listed above operate servers outside Türkiye, your personal data is transferred abroad through them. The database, hosting, error tracking and usage analytics run mainly in the EU (Germany); AI features are processed in the USA; Telegram, Google, Apple, Cloudflare, Resend and Upstash may process data in other countries. Transferred data is processed only for the purposes described in this policy.

Transfer mechanism under KVKK Art. 9 (as amended by Law No. 7499) and, for EU users, GDPR Chapter V: [TO BE CONFIRMED BY COUNSEL: standard contractual clauses / notification to the KVKK Authority / other safeguard, per provider]. You can request information about the safeguards by writing to kvkk@garajiz.com.

Under KVKK Art. 11, you have the right to:

• learn whether your personal data is processed;
• request information about the processing;
• learn the purpose of processing and whether data is used in line with that purpose;
• know the third parties in Türkiye or abroad to whom your data is transferred;
• request correction of incomplete or inaccurate data;
• request deletion or destruction of your data under KVKK Art. 7;
• request that corrections and deletions be notified to third parties to whom the data was transferred;
• object to a result against you arising exclusively from automated analysis;
• claim compensation for damage caused by unlawful processing.

If you are in the EU/EEA, under the GDPR you also have the right to data portability, to restrict processing, to object to processing based on legitimate interest, to withdraw consent at any time (without affecting processing before withdrawal) and to lodge a complaint with your local supervisory authority.

To exercise your rights, write to kvkk@garajiz.com from the email address registered to your account, or follow the step-by-step guide at garajiz.com/en/delete-data. We respond within 30 days. If you are not satisfied with our answer, you may apply to the Turkish Personal Data Protection Authority (KVKK Kurumu) within the periods set by law.

You can also delete your account in the app at any time: vehicle owners via Profile → Delete Account, business users via Settings → Delete Account. If you signed in with Apple, deleting the account also revokes your Sign in with Apple connection with Apple.

We use a necessary, httpOnly session cookie to keep you signed in. On our website (garajiz.com) we also use Google Analytics 4 (GA4) and Microsoft Clarity to understand how the site is used — for example which pages are visited; Clarity can also record session interactions (clicks, scrolls) and create heatmaps. IP addresses are anonymised. These tools are activated only if you accept analytics cookies in the cookie banner, and then place analytics cookies (e.g. _ga) in your browser.

We do not use advertising or marketing tracking cookies.

You can disable this analytics by rejecting analytics cookies or with a browser add-on (e.g. Google Analytics Opt-out). For how Google processes data, see the Google Privacy Policy.

Garajiz is not directed at children. You must be at least 16 years old (or the minimum age required in your country) to create an account.

We may update this policy from time to time. The current version is always published on this page.