Privacy Policy
Version 1.0.0 · Effective 23 July 2026
This English version is a convenience translation. The Turkish text is legally binding and prevails in case of any difference.
Read the binding Turkish text →AILA
PRIVACY POLICY
ARTICLE 1: Purpose and Scope
This Privacy Policy has been prepared by Humion Teknoloji Anonim Şirketi (the "Company") within the scope of Law No. 6698 on the Protection of Personal Data ("KVKK" or the "Law") and the relevant legislation.
The Company acts as the data controller with respect to personal data and takes all necessary technical and administrative measures to ensure that personal data is processed, stored and protected in compliance with the law.
This Policy sets out the principles regarding personal data processed within the scope of the mobile application, web platform and artificial intelligence-supported services offered by AILA.
ARTICLE 2: Definitions
| Explicit Consent | Consent relating to a specific subject, based on information and given freely. |
|---|---|
| Related User | Persons who process personal data within the data controller's organization or in accordance with the authority and instructions received from the data controller, excluding the person or unit responsible for the technical storage, protection and backup of the data. |
| Personal Data | Any information relating to an identified or identifiable natural person. |
| Special Categories of Personal Data | Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data. |
| Processing of Personal Data | Any operation performed on personal data, whether wholly or partly by automated means or, provided that it is part of any data recording system, by non-automated means, such as obtaining, recording, storing, retaining, altering, rearranging, disclosing, transferring, taking over, making available, classifying or preventing the use of such data. |
| Data Subject | Natural persons whose personal data is processed, such as the Company's shareholders, officials, business partners, suppliers, consultants, employees, job applicants, visitors, customers, potential customers and other related third parties, as well as employees or representatives of public institutions and organizations, banks and independent audit firms. |
| Data Controller | The legal entity that determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system. |
| Data Processor | The natural or legal person who processes personal data on behalf of the data controller based on the authority given by the data controller. |
| Data Recording System | A recording system in which personal data is structured according to specific criteria and processed. |
| Anonymization | Rendering personal data that was previously associated with a person impossible to associate with an identified or identifiable natural person in any way, even by matching it with other personal data or information. |
ARTICLE 3: Acceptance and Application of the Privacy Policy
By using the AILA application and the related platforms, Users are deemed to have declared that they have read, understood and accepted this Privacy Policy.
This Policy applies only to the AILA platform and does not apply to third-party websites to which users are redirected via the platform.
ARTICLE 4: General Principles Regarding the Processing of Personal Data
The Company acts in accordance with the general principles set out in Article 4 of the KVKK when processing personal data. In this context, personal data is processed:
- In compliance with the law and the rules of good faith,
- Accurately and, where necessary, up to date,
- For specified, explicit and legitimate purposes,
- In a manner that is relevant, limited and proportionate to the purposes for which it is processed,
- For the period stipulated in the relevant legislation or required for the purpose for which it is processed.
ARTICLE 5: Categories of Personal Data Processed
Within the scope of the AILA application and platform, the Company may process the following categories of personal data, depending on the processes and in line with the Users' approvals and preferences:
- Identity Information: Name, surname, date of birth, age, etc., and user account information.
- Contact Information: E-mail address, telephone number, residence/contact address.
- Information on Family and Relatives: Identity and contact information of third parties (family members, relatives, friends or persons of whom the User is the guardian/legal custodian) who are included in or invited to the AILA application by the User.
- User-Generated Content and Preferences (Search/Chat History): Commands, texts and queries directed to the artificial intelligence assistant, in-app survey responses and personalization preferences.
- Usage and Transaction Security Data (Log Records): Log records, IP address, device type/information, MAC ID, in-app navigation (clickstream) data and website login/logout details.
- Integration and Reservation History Information: Details (date, time, location, number of persons, etc.) of restaurant, valet, courier, accommodation and ticketing transactions carried out through third-party service providers and operational partners.
- Payment and Financial Transaction Data: Billing and transaction information relating to token purchases and in-app spending.
- Audio Data (With Explicit Consent): Voice recordings shared by the User with explicit consent so that the voice command features and the artificial intelligence assistant experience can be provided in the most efficient way.
- Health and Allergy Information (With Explicit Consent): Special categories of personal data relating to food allergens, dietary restrictions or health conditions that the User voluntarily shares while receiving nutrition, restaurant or lifestyle recommendations from the artificial intelligence assistant.
- Location History Data (With Explicit Consent): Real-time location information obtained from the device so that nearby venues, restaurants, and valet or courier services can be presented to the user accurately.
Special categories of personal data, such as health data and audio data shared by the User during interactions within the application, are processed in accordance with the 'Policy on the Processing of Special Categories of Personal Data' prepared by the Company, by putting in place additional technical measures for data security and solely on the basis of the explicit consent that the Data Subject gives of their own free will.
ARTICLE 6: Purposes and Legal Grounds for Processing Personal Data
Personal data is processed for the following purposes, within the scope of the legal grounds specified in Articles 5 and 6 of the KVKK:
- Providing and carrying out the services offered through the AILA application,
- Operating and developing artificial intelligence systems,
- Processing data in an anonymized or masked manner in order to improve the performance of artificial intelligence models, test them and fix errors,
- Improving the user experience,
- Carrying out reservation and payment processes,
- Managing user requests and support processes,
- Carrying out information security processes,
- Fulfilling legal obligations.
In this context, data processing activities are carried out on the legal grounds of the establishment or performance of a contract, fulfillment of legal obligations, the establishment, exercise or protection of a right, and the Company's legitimate interests.
In cases that require explicit consent, personal data is processed solely on the basis of the data subject's explicit consent.
ARTICLE 7: Methods of Collecting Personal Data
Personal data is collected electronically through the mobile application and web platform, user transactions and electronic forms, cookies and analytics tools.
ARTICLE 8: Transfer of Personal Data
The Company shares personal data with third parties only to the extent necessary and in accordance with Articles 8 and 9 of the KVKK.
In this context, personal data may be shared with:
- Infrastructure and cloud service providers,
- Payment institutions,
- Business partners and service providers,
- Authorized public institutions and organizations.
The Company does not, under any circumstances, sell personal data to third parties for commercial purposes or share it without permission.
Personal data may be shared with servers and service providers located abroad in order to provide the service. Where servers are located abroad, your personal data may be transferred abroad, pursuant to Article 9 of the Law, by concluding the standard contracts announced by the Personal Data Protection Board or by operating other lawful transfer mechanisms.
ARTICLE 9: Storage and Destruction of Personal Data
Personal data is stored for the periods stipulated in the relevant legislation and for as long as the purpose of processing requires. Upon the expiry of these periods, personal data is deleted, destroyed or anonymized in accordance with the Company's Retention and Destruction Policy.
ARTICLE 10: Data Security
The Company takes the necessary technical and administrative measures to ensure the security of personal data and regularly audits its data security processes.
ARTICLE 11: Rights of the Data Subject
Within the scope of Article 11 of the KVKK, data subjects have the right to:
- Learn whether their personal data is being processed,
- Request information regarding the processing if it has been processed,
- Request the correction or deletion of the data,
- Object to the processing,
- Request compensation in case of damage,
- Know the third parties to whom personal data is transferred in Turkey or abroad.
You may submit your rights and applications arising from the Law regarding the personal data processing activities notified to you under this text to the Company's address at Esentepe Mah. Talatpaşa Cad. No: 5 İç Kapı No: 1 Şişli / İstanbul, in person or through a notary public, or to info@myai.la via the e-mail address registered with our Company. Pursuant to the Communiqué on the Procedures and Principles of Application to the Data Controller, applications must include: name, surname and, if the application is in writing, signature; Turkish Republic ID number (for foreign nationals, nationality, passport number or ID number, if any); the residence or workplace address for notification; the e-mail address for notification, if any; telephone number; and the subject of the request. Your application will be reviewed by the Company and you will be responded to within a reasonable time, but in any case within 30 (thirty) days at the latest.
Applications are forwarded to the Company in accordance with the relevant legislation and concluded within the legal time limits.
ARTICLE 12: Policy Changes
The Company reserves the right to amend this Privacy Policy. Updates take effect on the date they are published.