Privacy Policy

1. Scope

This policy explains how the personal data of renters using the LeCafé app is processed under Turkish Personal Data Protection Law no. 6698 (KVKK), and also serves as the privacy notice required by that law.

The data controller's registered name and address will be added to this clause once incorporation is complete.

2. Data we process

• Account data: the name and e-mail address from your Google account, and the identifier used to match your account.
• Contact data: your phone number and the moment it was verified.
• Optional declaration: date of birth. It is not verified, is used only for a birthday gift, and you can delete it at any time.
• Rental records: which machine you rented, when, for how long, how the rental ended and what it cost.
• Payment records: top-up amount and time, the last four digits of the card, the name on the card, its expiry date and the payment institution's transaction reference.
• Access and traffic records: sign-in/sign-out events and rental start, end and join events, together with your connection address (IP), device/browser information and app version.
• Agreement acceptance records: the version and integrity digest of the text you accepted, the moment and language of acceptance, your connection address, device information and app version.
• Technical records: app and connection events, error reports, and log bundles sent for fault diagnosis.

3. Data we do not process

• Card numbers and CVV never reach LeCafé at any stage. Card data is held by the payment institution (iyzico).
• National identity numbers are not requested from renters and are not stored.
• Video and audio during a rental do not pass through LeCafé servers and are not recorded. No screenshots are taken.
• What you type and which applications you open on the machine you rent are not monitored or stored.

4. Purposes and legal grounds

• Formation and performance of the contract: opening your account, starting rentals, billing and collection (KVKK art. 5/2-c).
• Legal obligation: retention of financial and commercial records, and keeping the traffic/access records required by law (KVKK art. 5/2-ç).
• Legitimate interest: preventing abuse, fraud and misuse of the service, fault diagnosis and service-quality monitoring (KVKK art. 5/2-f).
• Establishment and protection of rights: using rental, payment, access and agreement acceptance records as evidence in a dispute (KVKK art. 5/2-e).

5. Transfers

• Payment institution (iyzico): to carry out balance top-ups. Your e-mail address, username, phone number if verified and IP address, together with the top-up amount.
• SMS provider: to deliver the phone verification code.
• Google: solely to verify sign-in. This involves a transfer abroad and happens when you choose that sign-in method.
• The Provider of the machine you rent: which machine was rented, on what date and for how long, is visible for revenue accounting. Your name, e-mail and phone number are not shared with the Provider.
• Competent public authorities: where required by law.

The app's servers and database are hosted in Türkiye.

6. Retention periods

• Account data: while your account is open. Deleted or anonymised when the account is closed.
• Rental and payment records: retained for 10 years under financial legislation. These records are kept even if the machine is removed from the fleet.
• Access and traffic records: retained for the period required by law and deleted when it expires.
• Agreement acceptance records: retained for the duration of the contractual relationship and the related limitation periods — this record is the proof of which text you accepted.
• Fault logs: retained for 30 days.
• Verification codes: valid for a few minutes only and invalidated once used.
• Session tokens: invalidated when they expire or when you sign out.

7. Security

Session tokens are stored only in hashed form, phone and card details are masked in the interface, the database is not exposed to the internet and all communication is encrypted.

The connection established between your device and the machine during a rental is end-to-end encrypted and open only for the duration of the rental.

A LeCafé administrator running technical commands on the machine to resolve a fault is bound to a recorded reason and a limited time. The command and its output are kept in the audit record, and the Provider sees this access in its own panel.

8. Your rights

Under KVKK art. 11 you have the right to learn whether your personal data is processed, to request information, to request rectification, erasure or destruction, to request restriction of processing, and to claim compensation for loss.

You can raise requests through the support screen in the app. They are answered within the period prescribed by law.

Where you request erasure, records that the law requires us to keep (financial records, traffic records) and records needed to establish a right are retained for their retention periods.

9. Local storage

The desktop app does not use cookies. Only data such as the token that keeps your session open, your language preference and the most recent copy of the legal texts (so they can be shown offline) is stored on your device. This is cleared when you sign out.

10. Changes

This policy may be updated. The current text is always available on this screen in the app. Updates that change its meaning require your acceptance again.