Privacy
These source documents are working drafts. Missing fields and product scope require legal review before publication.
GONNA Istanbul — Privacy Notice (EU/EEA, UK and international users)
DRAFT — legal review required. Prepared for users in the EU/EEA and UK (GDPR / UK GDPR, Art. 13) and as the English privacy notice for all international users. The Turkish KVKK notice (
01-kvkk-aydinlatma-metni.md) applies in parallel. Fill in⟨…⟩and align providers/retention with the final setup.
Last updated: ⟨date⟩ · Version 0.1
Who we are
⟨GliaCorp legal name⟩, ⟨address⟩, Türkiye ("GliaCorp", "we"). Contact: ⟨[email protected]⟩. EU representative (Art. 27 GDPR): ⟨name, address⟩. UK representative: ⟨name, address⟩.
The short version
- No account needed. We don't know your name.
- Plans are built from what you tell us and stored on your phone.
- Ads and offers are chosen only from the plan you're looking at right now. We don't track your history, don't use your advertising ID, and don't follow you across other apps or sites.
- Location is used only when you allow it, and background location only while trip guidance is on.
- Analytics run only if you opt in.
What we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Anonymous device ID, app version, OS, language, time zone | Run the service, keep your plans, security | Contract (6(1)(b)); legitimate interests (6(1)(f)) for security |
| Trip preferences (dates, pace, interests, budget, walking tolerance, taxi preference, accessibility) | Build and re-plan your itinerary | Contract (6(1)(b)) |
| Planner chat messages | Turn your request into plan parameters | Contract (6(1)(b)) |
| Precise location (foreground) | "Start here", nearby places, step-by-step guidance | Contract (6(1)(b)) + your device permission |
| Background location (guidance only) | Turn/stop alerts with the screen off | Consent (6(1)(a)) |
| Current plan contents (places, area, day, interest tags) | Choose relevant offers and ads for that plan | Legitimate interests (6(1)(f)) — funding a free service without tracking. You can object any time: Settings → Privacy → Plan-based offers |
| Aggregate ad/offer impressions and clicks | Reporting to partners | Legitimate interests (6(1)(f)) |
| Partner click with anonymous reference (SubID) | Match commissions | Legitimate interests (6(1)(f)) |
| Usage events, crash logs | Improve the app | Consent (6(1)(a)) |
| Email (newsletter) | Trip ideas and offers | Consent (6(1)(a)) |
| Server logs incl. IP address | Security, abuse prevention, legal obligations | Legitimate interests (6(1)(f)); legal obligation (6(1)(c)) |
We do not process payment data (bookings happen on partner sites) or special categories of data. Please don't type health, religion or similar information into the planner.
Who receives data
Hosting (⟨provider, country⟩); AI provider (⟨Anthropic PBC, USA⟩ — planner messages and preferences, no device ID); map tiles (⟨provider⟩ — IP address, map area); analytics/crash reporting (⟨provider⟩, only with consent); offer/ad delivery (⟨our own offer server; non-personalised ad network fill⟩ — context keywords, device type, IP; no advertising ID); affiliate partners and networks (⟨…⟩ — anonymous SubID only; anything you enter when booking is governed by the partner's own privacy notice); authorities where legally required.
International transfers
Some providers are outside the EEA/UK. We rely on adequacy decisions where available (e.g. EU–US Data Privacy Framework for certified US providers) or the European Commission's Standard Contractual Clauses (and the UK Addendum). Ask us for a copy of the safeguards.
Retention
On-device data: until you delete it or uninstall. Server plan requests and chat messages: ⟨30 days⟩. Server logs: ⟨…⟩. Analytics: ⟨14 months⟩. Shared plan links: ⟨12 months⟩ after last access. Consent records: as long as needed to prove consent.
Your rights
Access, rectification, erasure, restriction, portability, objection (including to plan-based offers), withdrawal of consent at any time (without affecting prior processing), and complaint to your supervisory authority. Because we don't have accounts, include the device ID shown in Settings → Privacy → My device ID in your request to ⟨[email protected]⟩.
Automated decisions
Your itinerary is generated automatically, but it has no legal or similarly significant effect on you; you can edit or ignore it at any time.
Children
GONNA is not directed to children under ⟨16⟩.
Changes
We'll notify you in the app about material changes and ask again where consent is required.