What we hold, and what we do not

01Who is responsible

Rivayet is operated by Solustiq Yazılım ve Yapay Zeka Teknolojileri Anonim Şirketi, registered in Edirne, Türkiye, tax number 7730942638. Under the Turkish Personal Data Protection Law No. 6698 (KVKK) we are the data controller (veri sorumlusu); under the EU General Data Protection Regulation (GDPR) we are the controller for the processing described here.

Day-to-day requests are handled by our operations desk, reachable at operation@traveldistro.com.

02What this policy covers

This policy covers the rivayet.co website you are reading, the Rivayet audio guide application at rivayet.app and in the app stores, and the correspondence that follows when you write to us.

It does not cover the hotel, host or travel agency that issued your code. They are separate controllers for their own booking records, and their own privacy notices apply to those.

03What we process

We have kept this deliberately short. In full, it is:

• Your access code, the language you chose and a device label, sent to our servers when you open the app so that we can validate the code and count how many devices have used it.
• Which guides were opened and when, so that we can support you and tell the partner who issued the code how their guests used it.
• Anything you type into the agency application form on this website — agency name, country, website, contact name, role, email, phone and the rest of that form — which is sent to our operations desk by email and not stored in a separate database.
• Ordinary server logs kept by our hosting provider: IP address, browser user agent, requested page and timestamp, retained for security and troubleshooting.

04Location stays on your device

When you ask the app to find the stop nearest to you, it reads your position through your device's location service and compares it with the coordinates of the stops, on the device. Your coordinates are never transmitted to us and we never store them. Nothing you do in the app builds a location history.

The permission is only requested when you use that feature, and refusing it costs you nothing but the shortcut — every stop can still be started by hand from the list.

05Why we are allowed to

Under GDPR Article 6 and KVKK Article 5, each of the above rests on one of these grounds:

• Performance of a contract: validating your code and delivering the guides you were given access to.
• Legitimate interests: keeping the service secure, preventing abuse of codes, and reporting aggregate usage to the partner who issued your code.
• Legal obligation: retaining what Turkish tax and commercial law requires us to retain.
• Consent: your device's location permission, which you grant and can withdraw in your device settings at any time.

06What we use it for

Only these, and nothing else:

• Opening the guides your code covers and keeping them working on your device.
• Answering you when you write to support.
• Telling the partner who issued your code how many of their guests listened, and to which guides.
• Keeping the service secure and diagnosing faults.

07Who else sees it

We do not sell personal data, we do not share it for advertising, and there are no advertising or analytics trackers in the app or on this website — no Google Analytics, no Meta pixel, no crash-reporting SDK.

The only parties involved are the ones that make the service run:

• Vercel Inc., which hosts this website and the application and therefore processes ordinary server logs.
• Resend (Plus Five Five, Inc.), which delivers the email generated by the agency application form.
• TravelDistro, which runs the audio guide API that validates codes and serves the guide content.
• OpenStreetMap Foundation, whose tile servers draw the map. When the map is displayed, your IP address and the area you are viewing reach those servers — the same as visiting any website that shows a map.
• The hotel, host or agency that issued your code, which receives usage figures for the codes it issued.
• Courts and public authorities, where Turkish law requires disclosure.

08Where the data goes

Our processors operate servers inside and outside Türkiye and the European Economic Area, including in the European Union and the United States. Where personal data leaves Türkiye or the EEA, the transfer is covered by the receiving party's standard contractual clauses and equivalent safeguards, in line with KVKK Article 9 and GDPR Chapter V.

09How long we keep it

We keep as little as we can for as short as we can:

• Code, device and listening records: for the life of the code plus twelve months, so that we can settle questions with the partner who issued it.
• Agency applications: two years from the date you applied, or until you ask us to delete them.
• Support correspondence: two years from the last message in the thread.
• Server logs: up to thirty days, then discarded.
• Records that Turkish tax and commercial law requires us to keep: for the statutory period, which is generally ten years.

10Your rights

Under KVKK Article 11 and GDPR Articles 15 to 22 you may ask us to do the following, and we answer within thirty days:

• Tell you whether we process data about you, and give you a copy of it.
• Correct anything inaccurate or incomplete.
• Delete it, where we are not required to keep it.
• Restrict or object to processing based on our legitimate interests.
• Receive what you gave us in a portable, machine-readable form.
• Withdraw a consent you gave — the location permission — without affecting what was lawful before.
• Complain to a supervisory authority: the Turkish Personal Data Protection Authority (KVKK Kurumu) or, in the EEA, your national data protection authority.

11How it is kept

Traffic to this website and the application runs over TLS. Access to the systems holding code and listening records is restricted to the operations staff who need it, and our processors are bound by written data processing terms.

No system is perfect. If a breach occurs that is likely to put you at risk, we notify the Turkish authority and, where the GDPR applies, the relevant supervisory authority and the people affected, within the periods the law sets.

12Children

Rivayet is made for travellers of any age to listen to, but it is not directed at children and we do not knowingly collect data from anyone under 13 through an account or a form — there is no account to create, and the application form is for businesses. If you believe a child's personal data has reached us, write to us and we will delete it.

13Changes to this policy

When this policy changes we update the date at the top of the page and publish the new text here. Where a change materially affects how your data is handled, we say so on this page rather than leaving you to spot the difference.

14Asking us something

Write to operation@traveldistro.com with enough detail to find you — the code you used, or the email address on your booking. You do not need a particular form of words; a plain request is enough, and we will tell you if we need anything more to identify you.