Privacy Policy

This Privacy Policy explains how FireTrack ("Yangın Takip") collects, uses and protects personal data in connection with the fire safety service management platform provided at yangintakip.com (the "Service"). For the detailed disclosure required under the Turkish Personal Data Protection Law (KVKK), see the KVKK Disclosure.

Data controller

1. Data We Collect

• Account data: name, e-mail address, phone, company/tenant details, role and permission data, password (stored only as an irreversible hash).
• Business records: customer (organization), site, location, equipment (asset), maintenance, survey, quote and stock records entered by the service companies using the platform.
• Technical data: IP address, browser and device information, sign-in and activity logs.
• Cookies: only cookies and browser storage strictly necessary for sign-in, security and preferences; no analytics or advertising cookies — see the Cookie Policy.

Permissions the mobile app asks for

The app asks for a permission only when you first use the feature that needs it. None of them is mandatory; if you decline, only that feature stops working. You can withdraw any permission at any time in your phone's settings.

• Camera (QR scanning): asked when you first open the "Scan" screen. Used to read the QR label on equipment; the image is not stored. If you decline, you can find the equipment by typing the code.
• Camera (taking photos): asked when you tap "take photo" during an inspection or drill. The photo is attached only to that record. If you decline, you can pick a photo from your gallery or continue without one.
• Photos (gallery): asked when you tap "choose from gallery". Only the photos you pick are accessed. If you decline, you can use the camera or continue without a photo.
• Location: after you sign in, a screen first explains what it is used for, then the permission is requested. While the app is open, your location is shared with your company's managers (roughly every 30 seconds or 30 metres, or once a minute when you are not moving) and attached to inspection and visit records. A "Sharing location" indicator is shown in the app while this is happening. No location is collected while the app is closed or in the background. If you decline, you can keep using the app; your location is not shared and records are submitted without a location.
• Microphone: asked when you tap record in the voice assistant and used only to record voice notes. Before the first recording the app also explains where the data goes and asks for your consent (see "Voice assistant" below). If you decline, only voice notes stop working.
• Notifications: a card first explains what they are used for; the permission is requested when you tap "Continue". Used to deliver alerts such as upcoming maintenance or assigned work to your phone. If you decline, you still see alerts inside the app and the web panel.

When you save a PDF to your phone you choose the folder yourself; no separate storage permission is requested.

Mobile app (Yangın Takip)

This section describes the data collected by the Yangın Takip mobile app distributed through Google Play and the App Store. The app is published by DEVİCEYE YAZILIM MEDİKAL TEKNOLOJİLER ANONİM ŞİRKETİ ("Deviceye"), which is the data controller named above.

• Name and e-mail address: processed to create your account and sign you in.
• Precise location: collected only while the app is open. Field staff location (latitude, longitude, accuracy, heading and speed) is shared so that the company's managers can see the team in the field, and is attached to inspection submissions. No background location is collected.
• Photos: photos you take or select as inspection evidence are processed and attached to the relevant record.
• Voice assistant: a voice note you record is uploaded to our servers and transcribed on Yangın Takip servers. The transcribed text is sent to the AI service provider Anthropic (Claude, United States) to extract suggested actions; the audio recording itself is not sent to Anthropic. Suggestions are submitted for approval by an authorized person before being recorded. The app asks for your consent before the first recording; if you do not consent, no voice note is recorded.
• Usage measurement: counters of which screens are opened and which actions are used are processed, linked to your account, to improve the product. No advertising or third-party analytics tools are used.
• Push notification token: processed to deliver notifications to your device; deleted when you sign out.
• Device information: installation ID (a random app-specific identifier), device model, operating system and app version; processed so that administrators can see the mobile device and version list.
• Crash logs: error message, stack trace and app version; processed for troubleshooting and contain no personal data.

The app does not collect an advertising ID and contains no advertising SDKs. Personal data is not sold and is not shared with third parties other than hosting and infrastructure processors and the voice assistant provider described above. Providers abroad are listed in the KVKK Disclosure. All communication between the app and our servers is encrypted with HTTPS.

To request deletion of your account and data, see Account and data deletion.

2. How We Use Data

• Providing the Service, managing your account and authentication
• Sending maintenance reminders, reports and notification e-mails
• Security, debugging and abuse prevention
• Complying with legal obligations

We do not sell or rent your data to third parties for advertising.

3. Where Data Is Stored

Service data is stored in PostgreSQL databases hosted on servers (VPS) located in Turkey. Transactional e-mails are also sent through our domestic (Turkey) shared hosting provider; only the information required to deliver the e-mail (recipient address, name, message content) is processed for this purpose. See the KVKK Disclosure for the full processor table.

4. Data Security

• All traffic is encrypted with TLS (HTTPS).
• Passwords are stored using irreversible hashing algorithms.
• In our multi-tenant architecture each tenant's data is isolated per tenant; API requests are filtered by tenant authorization.
• Access is restricted through role-based authorization.
• Regular backups are performed.
• How we notify the Board and affected people in a data breach is described in the KVKK Disclosure.

5. Data Sharing

Personal data is shared only with service providers strictly necessary to operate the Service (hosting, e-mail delivery, push notifications, AI service for the voice assistant), with competent public authorities where legally required, and in other cases with your explicit consent.

6. Retention

Account and business records are retained for the duration of the contractual relationship and for the periods required by applicable law. Upon account closure, your data is deleted or anonymized within a reasonable period, subject to statutory retention obligations.

7. Your Rights

For your rights under Article 11 of the KVKK and how to exercise them, see the KVKK Disclosure. For questions, contact info@yangintakip.com.

8. Changes

We may update this policy from time to time. Material changes will be published on this page; the "Last updated" date above shows the current version.