Privacy Policy

Data Controller

The data controller responsible for your personal data is Oney Finansal Danışmanlık Turizm ve Dış Ticaret A.Ş., a joint-stock company incorporated in Istanbul, Turkey (the "Company," "we," "us"). Registered address: Istanbul, Turkey — exact street address available on request to privacy@eluma.me.

For all privacy-related enquiries, data subject requests, and complaints, contact us at privacy@eluma.me. We aim to respond within five business days and are legally required to act within 30 days for GDPR requests.

What We Collect

Account data. When you create an ELUMA account we collect your email address, phone number (if you sign in via SMS), and name. This data is stored in our authentication provider (Firebase, operated by Google Ireland Limited) and our application database (MongoDB Atlas, operated by MongoDB, Inc.).

Camera images — transient processing only. When you point the ELUMA Lens at a landmark, the image is transmitted over an encrypted connection to our recognition service, processed, and a recognition result is returned to your device. The image bytes themselves are not retained on our servers beyond the lifecycle of that request. We do cache a SHA-256 hash of the image to serve repeated recognition requests for the same landmark without reprocessing; this hash cannot be reversed to reconstruct your image. No image is associated with your user account unless you explicitly save a discovery.

GPS coordinates — optional. If you grant location permission, we collect approximate coordinates at the moment of a recognition request to improve result accuracy. Location data is not logged persistently in association with your account.

Recognition history. When you save a discovery, we store the landmark identifier, recognition timestamp, and any user-added notes in association with your account. You may delete individual discoveries or your entire history at any time from the app.

Ticket booking data. Ticket sales on ELUMA are operated by Misyura Travel under TURSAB License No. 17192. When you book a ticket through our app, the booking is processed by Misyura Travel and Headout (our ticketing infrastructure partner). We receive a booking confirmation ID and associated event metadata in order to display your booking in the app. Your payment card data is processed exclusively by the payment processor and is never transmitted to or stored by us.

Automatically collected data. When you use the marketing website (eluma.me), our web server logs request metadata including your IP address, browser type, referral URL, and page visited. These logs are retained for 14 days for security and operational purposes.

How We Use Your Data

We use personal data to: (a) authenticate you and maintain your account; (b) process recognition requests and return results to your device; (c) display and manage your booking history; (d) send transactional notifications (booking confirmations, service updates) — never unsolicited marketing without your explicit consent; (e) prevent fraud, abuse, and security incidents; (f) comply with legal obligations including TURSAB record-keeping requirements; and (g) respond to your support requests.

We do not sell your personal data. We do not use your data for automated decision-making that produces legal or similarly significant effects without human oversight.

Service Providers and Third Parties

ELUMA partners with industry-standard cloud, AI, ticketing, and payment infrastructure providers under data processing agreements that require them to protect your data to at least the standard described in this policy. A current list of sub-processors is available on request to privacy@eluma.me.

Ticket sales are operated by Misyura Travel (TURSAB License No. 17192). By purchasing tickets through ELUMA you also become subject to Misyura Travel's own terms and privacy practices for the booking transaction.

Data Retention

Image hash cache: maximum 24 hours, then automatically purged.

User account data (email, name, phone, recognition history): retained for the lifetime of your account and deleted within 30 days of a valid erasure request.

Booking records: retained for a minimum of 3 years in accordance with TURSAB package travel record-keeping obligations, after which they are securely deleted.

Server access logs: 14 days.

International Data Transfers

We are incorporated in Turkey. Some of our service providers are based outside Turkey and the European Economic Area (EEA). Where personal data is transferred to countries not recognised as providing an adequate level of data protection, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, and on the safeguards provided by our sub-processors' certifications, to ensure your data remains protected.

Children

ELUMA is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you are between 13 and 16 and resident in the European Economic Area, we require verifiable parental or guardian consent before processing your personal data. If you believe we have inadvertently collected data from a child, please contact privacy@eluma.me and we will delete it promptly.

Your Rights

Depending on your country of residence, you may have the following rights over your personal data:

Access. Request a copy of the personal data we hold about you.

Rectification. Ask us to correct inaccurate or incomplete data.

Erasure ("right to be forgotten"). Ask us to delete your personal data. Certain data may be retained to comply with legal obligations (e.g. booking records under TURSAB rules).

Restriction of processing. Ask us to pause processing of your data while a dispute is resolved.

Data portability. Receive your personal data in a structured, machine-readable format.

Objection. Object to processing based on our legitimate interests.

Withdrawal of consent. Where processing is based on your consent, withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us at privacy@eluma.me. We will respond within 30 days. For GDPR complaints, you may also lodge a complaint with your national data protection authority. For Turkish residents, complaints may be filed with the Kişisel Verileri Koruma Kurumu (KVKK) at kvkk.gov.tr. For US residents, you may contact your state Attorney General.

California residents (CCPA). You have the right to know what personal information we collect and how it is used, to request deletion, to opt out of the sale of personal information (we do not sell personal information), and to non-discrimination for exercising your rights. Submit requests to privacy@eluma.me.

Apple App Store — Privacy Nutrition Label

In compliance with Apple App Store privacy disclosure requirements: ELUMA collects account identifiers (email, phone) linked to your identity for app functionality; usage data (recognition requests, history) linked to your identity; and crash diagnostics (if enabled by your device settings) not linked to your identity. Camera images are processed transiently and are not collected in the sense of being retained.

Security

We apply industry-standard security measures including TLS encryption for data in transit, at-rest encryption for stored personal data, access controls limited to personnel with a legitimate need, and regular security reviews. No system is impenetrable; if you discover a security vulnerability please report it responsibly to privacy@eluma.me.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this page and, where required by law, notify you via the app or by email. Continued use of ELUMA after the effective date of the updated policy constitutes acceptance of the changes.