Privacy Policy and KVKK Privacy Notice

This is the English translation of the Turkish text. If the two differ, the Turkish text prevails.

Usage statistics and ad measurement · Website and contact form · Türkçe metin

1. Data Controller

Webasist Teknoloji Limited Şirketi (Davutpaşa V.D. 8001187915), Maltepe Mah. Yılanlı Ayazma Sk. No:13 D:109 Zeytinburnu / İstanbul · E-mail: info@webasist.com

2. Personal Data We Process

Category	Data	Source
Identity	Name	You
Contact	Phone number, e-mail	You / Google / Apple
Location	Current location, location history (up to 30 days), speed, altitude	Device GPS
Device	Model, operating system, app version, battery level, notification token	Device
Usage	Family circle memberships, safe zones, alerts, messages	You
Security	IP address, session tokens, sign-in records	Server
Usage statistics (optional)	Screen names and feature use (counts and fixed types only), app instance ID, device model, operating system and app version, language, approximate region derived from the IP address	Device, only with your consent (Google Firebase Analytics); never for child accounts
Ad measurement (optional)	Account creation, finishing the introduction, creating or joining a family circle and subscription start events; Firebase's automatic app-open and session events (without an analytics ID); Android advertising ID; approximate region derived from the IP address	Device, only with your consent (Google Analytics; Meta on Android only); never for child accounts
Ads (free plan)	Advertising ID, IP address (Google derives only an approximate region from it), device information	Device (Google AdMob, non-personalised ads; never for child accounts)

3. Purposes and Legal Bases

• Sharing family members' locations, safe-zone and emergency (SOS) alerts: explicit consent (KVKK art. 5/1).
• A child's location data: explicit consent of the legal representative (parent). The sharing status is always visible on the child's device.
• Usage statistics and ad measurement: explicit consent (KVKK art. 5/1). They are two separate choices, both off by default, and saying no does not limit any feature of the app. The explicit consent you give on the sign-in screen covers only location sharing and the family safety features; it does not cover these two, which are asked separately. No data is processed for these purposes for child accounts (section 8).
• Account creation and authentication: performance of the contract (KVKK art. 5/2-c).
• Service security and abuse prevention: legitimate interest (KVKK art. 5/2-f).
• Compliance with legal obligations (KVKK art. 5/2-ç).

4. Recipients and Transfers

• Firebase Cloud Messaging (Google): only the notification token and notification content.
• SMS verification: your phone number, to send the verification code. Depending on the setting in our admin panel, the code is sent through Firebase Authentication (Google) or through the selected SMS provider; if one cannot deliver it, the other may be used. The SMS providers are İleti Merkezi, Netgsm or Verimor, based in Türkiye and authorised by the BTK (the Turkish telecommunications authority), and Twilio (USA) only if it is configured.
• Google Maps Platform: coordinates, to display the map.
• Apple / Google: only the identity token, for social sign-in.
• Google Play / App Store: subscription verification; payment details stay with the stores, and our server stores only the subscription status.
• Google AdMob: only on the free plan, only on adult (parent or member) accounts, non-personalised ads. For child accounts the ads SDK is not started and no ads are shown; no ads on Premium. Details: section 9.
• Google Firebase Analytics / Google Analytics: only if you allow "Usage statistics" or "Ad measurement"; app usage events and the app instance ID. Never for child accounts. Details: section 9.
• Meta (Facebook) app events: only in the Android app and only if you allow "Ad measurement"; app open, account creation and subscription start events. Never for child accounts. Details: section 9.
• Hosting: location data (current location and location history) is stored in a data centre in the European Union (Germany).

When a verification code is sent through a domestic SMS provider (İleti Merkezi, Netgsm or Verimor), no transfer abroad takes place for this purpose. When it is sent through Firebase Authentication (Google) or Twilio (USA), the phone number is processed on servers abroad; for notifications, the notification token and notification content are also processed on Google servers abroad. For Google services this transfer abroad relies on appropriate safeguards under KVKK art. 9 (standard contract notified to the Board); if Twilio is used, that transfer is likewise made in line with KVKK art. 9. Usage statistics and ad measurement data that you allow are also processed on Google and Meta servers abroad; these transfers are also made in line with KVKK art. 9. Your personal data is never sold. The only advertising-related data flows are those described in section 9 (non-personalised ads on the free plan, and ad measurement only with your consent); your GPS location, location history, messages and family information (family members, names, places) are never part of them. Google and Meta may derive only an approximate country/city-level region from your IP address.

5. Retention

• Location history: shown for 2 days on the free plan, kept on the server for at most 30 days, then deleted automatically.
• Alert and message history: 30 days.
• Account data: until the account is deleted. When you ask for deletion, all data on our servers is permanently deleted.
• Backups: 14 days.
• Usage statistics (Google Analytics): event-level and user-level data is kept for at most 14 months, then deleted automatically by Google. Aggregated reports that cannot be linked to anyone (e.g. daily user counts) may be kept longer.
• Meta app events: according to Meta's own retention rules (Meta Privacy Policy).
• Your consent choices: on your device, until you change them, sign out, delete your account or uninstall the app. When you sign out, your choices are deleted, the analytics ID on the device is reset and the choice is asked again at the next sign-in on this device.

6. Your Rights (KVKK art. 11)

You have the right to access, correct and delete your data, to object to processing and to withdraw your consent. You can delete all your data in the app with Settings → Delete account, or write to info@webasist.com. Requests are answered within 30 days at the latest. Details: Account and data deletion.

You can withdraw "Usage statistics" and "Ad measurement" at any time in the app under Settings → Safety & privacy; from that moment on, no new data is collected for these purposes. Signing out also ends both permissions.

7. Transparency Commitment

Location Assist cannot be used for covert tracking. Every device that shares its location shows a persistent notification, and the app shows a "Location sharing is on" status. The person sharing can always turn sharing off.

8. Children's Privacy

A child account is created only with the parent's approval. No ads are shown on a child account; the ads SDK is not started and no ad requests are made. Usage statistics and ad measurement are never turned on for a child account: the consent card and these settings are not shown, no data is sent to Google Analytics or Meta, and the advertising ID is not used for these purposes. If an adult account was signed in on the same device before, its choices are deleted when it signs out; a child account never inherits them.

9. Usage Statistics, Ad Measurement and Ads

After you sign in (adult accounts only; child accounts are not asked), we ask for your choice on two separate things: Usage statistics and Ad measurement. Both are optional and off by default. "Accept all" allows both, "No, thanks" leaves both off, and "Manage preferences" lets you choose each one separately; saying no does not limit any feature. Unless you allow them, no data is sent to Google Analytics or Meta for these purposes. You can change your choice at any time under Settings → Safety & privacy.

Usage statistics (Google Firebase Analytics)

Purpose: to see, as counts, which screens and features are used, to find steps where people run into problems, and to improve the app. If you allow it, we send:

• Screen names (e.g. "map", "timeline") and the fact that a feature was used: sign-in and sign-up method (phone, Google, Apple), finishing the introduction, creating a family circle or joining with an invitation, sharing an invitation (only the type of sharing channel), adding a place, starting safe arrival, the type of check-in, SOS (normal or silent), sending a chat message (without its content), opening the timeline, opening the Premium screen, starting a subscription (monthly or yearly), tapping a notification (the notification type).
• Account properties: your role (parent or member), your plan (free, Premium) and the app language. If you withdraw this permission, these properties are removed from the device and are not added to later events.
• Measured automatically by Firebase: first open, session start and length, app updates, subscription purchases made in the store (product, amount, currency).
• Technical information: the app instance ID (a random ID specific to the app installation), device model, operating system and app version, language, and an approximate country/city-level region derived from your IP address. Your GPS location is not used. On iOS the identifier for vendor (IDFV) is not collected.

Ad measurement (Google and Meta)

Purpose: to measure how many people our ads on Google and Meta bring to the app, and how many of them create an account or subscribe. If you allow it:

• Google: these events may be used in Google Ads as ad results: account creation (with the method), finishing the introduction, creating a family circle, joining a family with an invitation and subscription start (plan type). These events carry only the event name; who is in your family, how many people it has, names or places are never sent. With this permission, Firebase's automatically measured app-open, session, app-update and store purchase events are sent too; if only this permission is given, without an analytics ID (app instance ID). On Android, the advertising ID may be used for this measurement.
• Meta (Facebook), in the Android app only: app open (once per launch), an install notice (once per installation), account creation (with the method) and subscription start (plan type; amount and currency where available) events may be sent to Meta, together with technical information added by the Meta SDK (device model, operating system and app version, language, IP address, Meta's anonymous app-specific ID, the advertising ID). Meta may match these events to your Facebook/Instagram account using information such as the advertising ID, and may use them under the Meta Business Tools Terms and its own privacy policy for ad measurement and to deliver and improve its ads; this may also affect the ads you see on Meta's platforms. We do not build custom audiences or run retargeting on Meta from app events. The iOS app contains no Meta SDK.
• We never show you personalised ads in our app, and "ad personalisation" is always reported to Google as not granted. How Meta may use this data is described above.
• On iOS we do not ask for Apple's App Tracking Transparency permission, so the iOS advertising identifier (IDFA) is never collected.
• Google and Meta may derive only an approximate country/city-level region from your IP address; your GPS location is not sent to these tools.
• For child accounts these options are not shown and are never turned on.

Never sent

Your phone number, name, e-mail address, location and location history (coordinates, addresses, place names), chat messages and status notes, invitation codes, family circle and user IDs, and any free text you type are never sent to these tools. We do not set a user ID that identifies you in the analytics tools, so these records are not linked to your name or account. For the same reason, deleting your account does not delete them separately; they are deleted at the end of the retention period in section 5. When you sign out or delete your account, the analytics ID on the device is reset and your consent choices are deleted.

Ads (Google AdMob)

On the free plan there is one ad space on accounts that are not child accounts (parents or members). Ads are non-personalised; there are no ads on Premium or on child accounts. The ads SDK is started not when the app opens but when the ad space can first be shown; it is never started before sign-in or for child accounts. Even for non-personalised ads, Google may use the advertising ID, the IP address (from which it derives only an approximate region) and device information to limit how often an ad is shown, to prevent fraud and to produce aggregated reports. This is independent of the "Ad measurement" permission.

10. Website and Contact Form

This section covers the locationassist.webasist.com website and its contact and "Notify me at launch" form. The data controller is the one named in section 1.

Data processed through the form

• Your name and e-mail address; optionally your phone number and message; for business enquiries, the company name and team size.
• The topic of the form (family use, business, press, other), the language of the page you sent it from, when you sent it, when you confirmed that you have read this notice, and your optional e-mail consent.
• A one-way hash of your IP address, made on our server with a secret key. The IP address itself is not stored, and no browser or device data (User-Agent) and no location is collected.

Purposes and legal bases

• Answering your request and contacting you about it: directly related to entering into a contract (KVKK art. 5/2-c) and legitimate interest (KVKK art. 5/2-f).
• E-mailing you when the app launches and about important updates: only with the explicit consent you give with the separate box on the form (KVKK art. 5/1; Law No. 6563 on the Regulation of Electronic Commerce). Saying no does not stop you from sending the form. You can withdraw it at any time by replying to one of these e-mails or by writing to info@webasist.com.
• Preventing spam and abuse (the IP hash and a limit on how often the form can be sent): legitimate interest (KVKK art. 5/2-f).

Where it is stored, transfers and retention

Form records are stored on our servers in the European Union (Germany); this transfer abroad is made in line with KVKK art. 9. Form data is never sent to measurement or advertising tools, never sold and never shared with others.

A form record is kept for at most 24 months after the last action on it (sending, our reply, a status change, withdrawing the e-mail consent) and is then deleted automatically. Once you withdraw your e-mail consent we stop sending you these e-mails. If you want your record deleted sooner, just write to info@webasist.com (KVKK art. 7 and 11).

Website measurement and cookies

The website loads no measurement tool and sets no measurement cookie unless you agree. If you choose Accept in the cookie banner, the following tools are loaded to measure whether our site and ads work:

• Google Analytics 4: events such as page views, form submissions (only the topic of the form) and store badge clicks. Cookies: _ga, _ga_*. Google signals and ad personalisation are off.
• Google Ads conversion measurement: whether a form submission came from one of our ads. Cookies: _gcl_au and similar _gcl cookies.
• Meta Pixel: page views, form submissions (only the topic of the form) and store badge clicks. Cookies: _fbp, _fbc. Meta may also use this data to show and optimise ads.

These tools process data such as browser and device information, the IP address and cookie IDs on Google and Meta servers abroad, including in the United States; this transfer is also made in line with KVKK art. 9. The name, e-mail address, phone number and message you enter in the form are never sent to them. Your choice is stored only in your own browser. You can withdraw your consent at any time with the Cookie preferences link at the bottom of the page; measurement then stops and these cookies are deleted.