Privacy Policy

This policy explains what Merhaba Istanbul collects, why, and what you can do about it. It covers the mobile app and the website at www.merhabaist.com.

For anything in this policy, contact [email protected].

1. The short version

We collect your email so you can have an account, and we store the places you save and the plans you create so they are there when you sign in again. We use your location only while you navigate, and we do not keep it. There is no analytics, advertising, or tracking in this app, and no cookies. You can delete your account from inside the app, and it happens immediately.

2. What we collect

Account. Your email address. If you sign in with Apple or Google, whatever name and profile picture they pass to us. If you use Apple's private relay, we only see the relay address.

What you create. Saved places, plans and itineraries, and your messages with the AI chat assistant. Stored against your account so they follow you across sessions and devices.

Optional submissions. If you send us a cat picture, we receive the photo, your first name, your email, your story, and your Instagram handle if you give one. If you suggest a place, we receive the place details, your name, your email, and your phone number if you give one. Both forms are voluntary. Place suggestions are never published. Cat pictures are published on our website and social media only if you tick the box giving permission when you send one, and we credit your Instagram handle if you provided it. If you change your mind, email us and we will take it down.

Photos. Only the single picture you choose to send. Photos are re-compressed on your device before upload, and we do not use location information from photos.

Location. When you press Navigate, the app uses your location to calculate the route. Only at that moment, only while the app is open, never in the background. We do not store it.

Purchases. Handled entirely by the App Store and Google Play. We are told whether a purchase succeeded so we can unlock what you bought. We never see your card details.

Technical. Your IP address is recorded when you sign in, as a security measure. When the app starts it checks for updates, which sends your app version and platform.

On your device. Your language, saved places, and sign-in session are stored locally on your phone and removed when you uninstall.

3. What we do not collect

There is no analytics, no crash reporting, no advertising, and no tracking software in this app. We cannot see which screens you open, how long you stay, or which features you use. We do not build advertising profiles, we do not track you across other apps, and we never sell or rent your data.

The app uses no cookies. The website uses no cookies and runs no analytics.

4. How we use it

To run your account, store and sync your places and plans, generate itineraries and answer questions through the AI chat assistant, calculate routes, confirm your purchase, reply when you contact us, keep the service secure, and meet legal obligations.

Nothing else. If that changes, we will tell you first.

5. Legal basis

If you are in the EEA or the UK:

• Contract covers everything needed to run the service: your account, places, plans, chat history, and purchase.
• Consent covers location and the optional submission forms. Withdraw it by denying the permission in your device settings, or by not using the form.
• Legitimate interests covers security and abuse prevention, which is why sign-in IPs are recorded.

6. AI features

The app uses an AI chat assistant to generate itineraries and answer questions, and an AI service to write short tips about the journey between stops.

We send the assistant your trip details, your stops, and your recent messages in that conversation. We do not send your email, your name, or your account ID. Our AI provider does not use this to train its models and holds it briefly for security monitoring before deleting it.

Your chat history stays in your account until you delete your account.

AI can be wrong. Opening hours, prices, and travel times change. Check anything that matters before relying on it.

7. Who we share with

Only companies that help us run the service, only what they need, and never for their own purposes:

• Hosting and database provider (your account, places, plans, chat)
• AI providers (trip details and chat messages)
• Google Maps (your location and destination, to return a route)
• Apple and Google (sign-in, and all purchases)
• Email provider (sign-in codes, and delivering your submissions to us)
• Rate-limiting service (your account ID and a message counter, held for up to an hour)
• App update service
• Our website and social media accounts, but only for cat pictures you have given permission to publish

We may also disclose data where the law requires it, or to protect the safety and rights of our users.

We do not sell your data and we do not share it for advertising.

8. Where it is stored

Your account data, photo storage, and rate-limiting data are held in Frankfurt, Germany.

Our AI provider processes data in the United States. Sign-in, app update, and map services may also process data outside the EEA and the UK.

9. How long we keep it

Your account and everything in it stays until you delete your account. Deletion is immediate.

Deleting a plan is not the same as erasing it. When you delete a plan in the app, it stops appearing for you but stays on our servers. It is erased when you delete your account, or sooner if you ask us.

Sign-in security records are held briefly by our authentication provider, then removed.

Messages you send to the AI assistant are held by our AI provider for a short period for security monitoring, then deleted. They are not used to train their models.

Submissions work differently. If you delete your account, we remove your name, email, phone number, and Instagram handle from any submission you sent, but we keep the photo or place suggestion itself with no link to you.

Submissions also arrive in our support inbox by email, and deleting your account does not reach that inbox. If you want a submission and its email removed completely, email us and we will delete both.

10. Your rights

Wherever you live, you can ask what we hold about you and get a copy, correct anything wrong, delete your account from Profile inside the app, ask us to delete a submission, or withdraw location permission in your device settings.

In the EEA and UK you can also restrict how we use your data, object to processing based on legitimate interests, and request your data in a portable format.

Email [email protected]. We reply within 30 days. We may ask you to confirm your identity so nobody else can make a request about you.

If you are in the EEA or UK and unhappy with how we handled something, you can complain to your national data protection authority.

11. Security

Connections between the app and our servers are encrypted, access to stored data is restricted, and sign-in uses a one-time code rather than a password.

No service is perfectly secure. If a breach affects your data, we will tell you and the relevant authorities as the law requires.

12. Age

You must be at least 16 to use Merhaba Istanbul. We do not knowingly collect data from anyone younger. If you believe a child has given us their information, email us and we will delete it.

13. Links elsewhere

The app opens Google Maps for navigation and your email app for support, and may link to other sites. Once you leave Merhaba Istanbul, this policy no longer applies.

14. Changes

We update this page when our practices change. The date at the top shows the current version. If a change materially affects how we handle your data, we will tell you in the app or by email before it takes effect, and ask your consent where the law requires it.

15. Contact

Email: [email protected]
Web: www.merhabaist.com

Merhaba Istanbul is operated from Kuwait.