Privacy Policy
Al-Sat Marketplace
This Privacy Policy explains what information Al-Sat Marketplace (operated by Erebos Lab) collects, how it is used, who it is shared with, and the choices you have. By using Al-Sat Marketplace you agree to the practices described here.
Data-safety summary
At a glance, here is the data the app collects, whether it is linked to your identity, and whether it is used to track you across other companies’ apps and websites.
| Data category | Linked to you | Used for tracking | Purpose |
|---|---|---|---|
| Contact Info | Yes | No | Create and secure your account, sign you in, arrange delivery/pickup, and enable corporate selling. Email + password only; there is no social sign-in. |
| User Content (Listings) | Yes | No | Publish and operate your listings and seller profile. Photos are uploaded to object storage (Cloudflare R2). VIN and license-plate fields can be hidden from public view. |
| Messages | Yes | No | Provide in-app messaging and negotiation between buyers and sellers. Stored in our database. |
| Location (Listing-level) | Yes | No | Show where an item is located and enable location-based browsing. This is content you enter about a listing — the app does NOT collect your device’s precise location (there is no device-geolocation permission). |
| Purchases & Financial Info | Yes | No | Process payments for promotions, escrow, and subscriptions. Card details are entered on iyzico’s hosted, PCI-compliant page — we never see or store your card number. Some transactions require an identity number, which is sent to iyzico. |
| Identifiers | Yes | No | Authenticate your sessions and operate the service. |
| Usage Data (First-party) | Yes | No | Show sellers listing performance and power “recently viewed.” Stored in our own database; no third-party analytics SDK is used. |
What we collect
Contact Info
- Email address and password (hashed)
- Phone number
- Display name
- Postal addresses with recipient name and phone (your address book)
- Business tax number (corporate sellers only)
Create and secure your account, sign you in, arrange delivery/pickup, and enable corporate selling. Email + password only; there is no social sign-in.
User Content (Listings)
- Listing titles, descriptions, prices, photos, and category attributes
- Store/seller profile (name, logo, banner, bio)
- Reviews, ratings, and listing questions/answers
- Optional vehicle details (VIN, license plate) with hidden-field controls
Publish and operate your listings and seller profile. Photos are uploaded to object storage (Cloudflare R2). VIN and license-plate fields can be hidden from public view.
Messages
- Buyer↔seller conversations and message contents
- Offers made on listings
Provide in-app messaging and negotiation between buyers and sellers. Stored in our database.
Location (Listing-level)
- City and district you assign to a listing
- Optional seller-entered listing coordinates
Show where an item is located and enable location-based browsing. This is content you enter about a listing — the app does NOT collect your device’s precise location (there is no device-geolocation permission).
Purchases & Financial Info
- Orders, escrow/boost transactions, wallet activity, and subscriptions
- Billing contact and, where the processor requires it, a national identity number passed to iyzico
- Payment webhook records
Process payments for promotions, escrow, and subscriptions. Card details are entered on iyzico’s hosted, PCI-compliant page — we never see or store your card number. Some transactions require an identity number, which is sent to iyzico.
Identifiers
- Account user ID (UUID)
- Signed session token (in device secure storage / cookie)
Authenticate your sessions and operate the service.
Usage Data (First-party)
- Listing view history, favorites, and aggregate view/lead counters
Show sellers listing performance and power “recently viewed.” Stored in our own database; no third-party analytics SDK is used.
What we do NOT do
- We never see or store your full card number — card payments are handled on iyzico’s hosted page.
- The app does not collect your device’s precise location; only the location you assign to a listing.
- No third-party analytics, advertising, or tracking SDKs are used.
- We do not sell your personal information.
Third parties who process your data
We share data only with the processors below, each bound to use it only to provide their service to us. Items marked "unverified" are placeholders we must confirm and name before this policy is treated as final.
- Neon (PostgreSQL) — Primary application database for accounts, listings, messages, and orders
- Cloudflare R2 — Object storage for listing photos and media
- iyzico — Hosted 3-D Secure card payment processing (card data handled by iyzico, not by us)
- PayTR (alternate payment provider) unverified — Alternate payment processor — wired but off by default; confirm whether enabled in production before naming.
- e-invoice (e-Fatura/e-Arşiv) integrator unverified — Invoice issuance — optional, off by default; name the provider if enabled.
- hosted search provider (Meilisearch/Typesense) unverified — Listing search — confirm if a hosted search index is used in production.
- email / push notification worker unverified — Delivers email and (modeled) push notifications from an outbox — confirm the delivery provider before publish; device push is not yet wired.
How we use your information
- Operate and personalize the app and its core features.
- Maintain your account, authenticate sessions, and provide support.
- Process payments and manage subscriptions/entitlements.
- Keep the service secure and prevent fraud and abuse.
- Comply with legal obligations and enforce our Terms of Service.
- Improve the product through aggregated, de-identified analytics.
Data retention
We keep personal information only as long as needed to provide the service. Account data is retained while your account is active and for a short recovery window after deletion, then deleted or anonymized. Billing records are retained as required by tax and accounting law. Backups are purged on a rolling basis.
Your rights and choices
Depending on your jurisdiction you may access, correct, export, or delete your personal data, object to or restrict certain processing, and withdraw consent. You can delete your account and its server-side data from within the app, or by emailing us. We respond within 30 days.
Children’s privacy
The app is not directed to children under 13 (under 16 in the EEA/UK) and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.
Security
We use industry-standard safeguards including TLS in transit, encryption at rest for sensitive fields, hashed passwords, least-privilege access, and audit logging. No system is 100% secure; please use a strong, unique password.
Changes to this policy
We may update this policy. Material changes will be reflected by a new "Last updated" date and, where required, announced in the app.
Contact
Privacy questions? Email [email protected].