إشعار الخصوصية

trbnb is run by AI Otel Teknoloji ve Turizm Limited Şirketi, a company registered in İstanbul. Under the Turkish Personal Data Protection Law (KVKK, Law No. 6698) it is the data controller for the personal data described here.

The trbnb website at trbnb.com and the trip assistant on it: what you type or say to plan a trip, the details you give when you book, and what our systems record while you use them.

The hotel that hosts you handles your data under its own responsibility and its own notice. Our booking partner, the supplier through which your booking is made and which takes your payment, says in its documentation that it acts as a data processor: it handles the data only on our documented instructions. This notice says what we pass to each of them, and not what the hotel does with it afterwards.

• What you tell the assistant: where and when you want to go, who is travelling (how many, and children's ages), your budget, and anything else you write about what the trip needs.
• What you give when you book: the lead guest's name, email address and, if you add one, phone number; the other guests' names where the hotel asks for them; and any request you write for the hotel.
• The booking itself: hotel, dates, room and rate, price and currency, the cancellation terms you were shown, booking references, and whether the payment went through. We never receive your card number: you type it into the payment provider's form, not ours.
• If you open a stay link a hotel sent you: the email address it was sent to and the booking it opens.
• If you use the voice features: the text we turn into speech and, if you talk to our voice assistant, your voice and the conversation.
• Technical data: your IP address, used briefly to stop abuse and not stored with your trip; the cookies and browser storage listed on the cookie page; and error logs from our servers.
• If you put a Viator listing on a day, trbnb keeps its title, link, date and Viator's price at that moment with your trip, and the listings you hid, so they are not shown again. Deleting the trip deletes them.
• If you sign in: your email address and language, and what you choose to keep on your account's settings page: your name, a mobile phone number (used only to fill in the booking form for you) and the currency prices are shown in. For each sign-in: when it started and was last used, the browser and system it came from (for example Chrome on Windows, never the full browser string) and a one-way hash of a random key kept in your browser, so trbnb can list your devices and email you when your account is signed in to from a browser it does not recognise.
• If you answer “How did trbnb do?” after a trip: your score from 1 to 5 and any words you add. Only trbnb's two founders read them, and they are never published.
• For each trip you plan: the name you give it, the parts you add to it yourself (a flight, a ride or a tour you booked elsewhere, in your own words, with its day and time) and your conversation with the assistant on the plan. A browser can keep several trips; signing in moves them to your account. Deleting a trip deletes them.

For legal review: The assistant can be told about health, disability, diet or religious practice (“my mother uses a wheelchair”, “halal food”). KVKK art. 6 makes these special categories of data, processable only with explicit consent or under an art. 6(3) condition. Since 28 Sep 2026 trbnb leaves such words out of what it keeps with a trip unless the guest ticks a consent line on the trip; the search uses them either way. The line's wording is a draft, and so are the receipt kept for each tick (the statement shown, the kinds of words it named, when it was given and ended, and why) and its period of 730 days after it ends. Such words are found with a word list, which can miss other ways of saying them. All of this is for the lawyer's read before launch.

For legal review: Draft, 28 Sep 2026: the account's phone and display currency, the browser details and browser key kept with each sign-in, and the new-sign-in email are new with the account's settings page. Their wording, their legal bases (the contract for the account; legitimate interest for the security of signing in) and their periods in the table below are for the lawyer's read before they are final.

For legal review: Draft, 28 Sep 2026: the answers to “How did trbnb do?” (legitimate interest proposed, kept 365 days after the last change), and a trip's name, the parts a guest adds to it and the conversation kept with it, are new. Their wording, legal bases and periods are for the lawyer's read before they are final.

You do not have to tell us about health, disability, diet or religion. If you do, because it matters for where you stay, we use it only to find stays that fit and, if you book, to pass your request to the hotel. We do not use it for marketing or to decide anything else about you.

KVKK art. 5 requires a legal reason for each use. Ours are:

• To understand your trip, show you stays that fit, and make, change or cancel a booking you ask for — because it is necessary to set up and perform a contract with you (art. 5(2)(c)).
• To keep the records commercial and tax law require for every sale — because the law obliges us to (art. 5(2)(ç)).
• To keep the service secure: stopping abuse and fraud, limiting repeated attempts, emailing you when your account is signed in to from a browser we do not recognise, and finding faults — in our legitimate interest, without overriding your rights (art. 5(2)(f)).
• To establish, use or defend a legal claim, for example in a dispute about a booking (art. 5(2)(e)).
• To send you news and offers, or to use analytics or advertising cookies — only if you agree, and you can withdraw at any time. We send no marketing messages today.

• Our accommodation suppliers: your booking details, the guests' names, email addresses and phone numbers, your nationality and any special requests you write, to make the booking with the hotel. Our booking partner takes your payment through its payment provider (Stripe) and is the merchant of record for it. Our booking partner says it stores and processes data mainly in data centres in the United States. It may also process data in the European Union, and the companies it works with (sub-processors) may be in the United States or other countries.
• The hotel: the guests' names, the dates, the room and your requests, so it can host you. Hotels in Türkiye have their own legal duties too, such as reporting their guests to the authorities.
• Google (Gemini): what you write to trbnb (your trip request, text you ask trbnb's AI to read before you plan, your questions in the chat, text you ask it to translate) and hotel reviews, so the assistant can read and answer them. Anthropic (Claude), if used instead, receives the same text. Text you ask it to translate is sent only when you tap the button that sends it to Google. When you ask trbnb's AI to read your text before you plan, its reading is kept in the server's memory for up to 20 minutes, so the same text is not sent twice, and is not written to a database.
• ElevenLabs: text that is read aloud, and your voice if you use the voice assistant.
• Cloudflare: our domain and network traffic pass through it.
• The company that will host our server, not chosen yet; Brevo, a French company and our email provider, which receives the email address and the content of each email trbnb sends, and records when an email is opened and which of its links is followed (it sends every link through its own address first); and, once it is set up, an error-monitoring service (Sentry).
• Public authorities, when the law requires it.

We do not sell your data, and we do not give your contact details to hotels or anyone else for their own marketing.

For legal review: The role of each recipient (controller or processor) is not settled in writing. Our booking partner's data processing agreement is “available on request”; the Google, ElevenLabs, Cloudflare, Anthropic and Brevo terms have not been reviewed against KVKK; hosting and Sentry have no account yet (D049).

Several of the services above are outside Türkiye, most of them in the United States. Since 1 June 2024, KVKK art. 9 allows a regular transfer abroad only to a country the KVKK Board has found adequate, or under an appropriate safeguard — in practice the standard contract published by the Board, signed with the recipient and notified to the Authority within five working days.

We transfer your data abroad only under one of those safeguards or, for an occasional transfer, under one of the exceptions art. 9 allows — for example when it is necessary to perform your booking.

For legal review: No standard contract has been signed with any vendor yet. Until they are signed and notified, production guest data should not go to our booking partner, Google, ElevenLabs, Cloudflare or Anthropic. Since the 2024 amendment, explicit consent is no longer a basis for regular transfers.

Each kind of data has its own period. When it is no longer needed it is deleted or anonymised, by an automatic job where the table says so.

Under KVKK art. 11 you can ask us:

• whether we process your personal data and, if we do, for information about it;
• why we process it, and whether it is used for that purpose;
• who we have passed it to, in Türkiye or abroad;
• to correct it if it is incomplete or wrong, and to delete or destroy it where the conditions of art. 7 are met — and to tell those we passed it to that we did;
• to object to a result against you that comes only from automated analysis;
• for compensation, if you suffer damage because your data was processed unlawfully.

You can also withdraw any consent you gave, at any time, for the future.

Use the request form, or write to us at the details above. We answer within 30 days, free of charge; if the answer involves an extra cost, the fee set by the KVKK Board may be charged. Before we give out or delete anything, we check that the request comes from you.

If we refuse, if you find our answer insufficient, or if we do not answer in time, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of learning our answer, and in any case within 60 days of your request.

• Sign-in sessions, one-time codes and stay links are stored only as cryptographic hashes, so a copy of our database does not open anyone's account.
• Card numbers never reach us: the payment provider's form takes them.
• The messages our systems pass between them carry booking references, not names or addresses.
• Traffic to trbnb is encrypted, and seeing a booking needs the right session or a verified stay link.

For legal review: Encryption at rest, backups and access control on the production server depend on the server, which does not exist yet (D049).

The assistant sorts and filters stays for you automatically and marks where each fact comes from. It takes no decision with legal or similarly significant effect: nothing is booked or paid without your confirmation. If you think an automated result worked against you, you can object (art. 11(1)(g)).

trbnb is for adults planning trips, and bookings must be made by someone aged 18 or over. When a booking includes children we record their ages, and their names only where the hotel requires them.

When this notice changes, the new version and its date are shown at the top. A booking you already made stays under the notice in force when you made it.