Privacy Policy

Who we are

Filopy is a software service that provides a reservation website, an admin panel and a mobile app to businesses renting out vehicles and heavy equipment. For any question about this policy, contact us at hello@filopy.com.

Data we process

We group the data into three categories:

• Website visitors: the name, email and message you submit through the contact form, plus aggregate page-view statistics.
• Platform users (our customers’ staff): name, email address, role, an irreversible hash of your password, and session records.
• Rental data (end-customer details): the name, phone, email, requested dates, delivery address and notes of the person making a reservation request.

Data processed on behalf of our customers

For rental data the controller is the rental company using the platform; Filopy acts solely as a processor, handling that data on their instructions in order to provide the service. Requests to delete or correct such data should be directed to the rental company you booked with.

Each customer’s installation runs on its own database; data from different companies is never mixed.

The mobile app

The Filopy mobile app is for rental company staff only, and accesses:

• Camera: used exclusively to scan the pairing QR code shown in the panel. No image is captured, stored or transmitted.
• Push identifier: a device identifier issued by Expo is stored so we can deliver notifications. It is removed when you sign out of a workspace.
• Session data: the session key created at pairing is kept in the device’s secure keychain (Keychain / Keystore).
• The app does not access location, contacts, the photo library or the microphone.

Why we process it

• To provide the service: running reservation, fleet, document and messaging workflows.
• To inform: delivering new request, message and quote alerts by email and mobile notification.
• For security: preventing unauthorised access and validating sessions and device pairings.
• To communicate: responding to your enquiries and providing support.

Legal basis

We process data to enter into and perform our contract, to meet legal obligations, and under our legitimate interest in providing the service securely (Turkish KVKK art. 5; GDPR art. 6). For entirely optional fields such as the contact form, our basis is your consent.

Sharing and service providers

We do not sell your data. To deliver the service we rely on a limited set of providers:

• Server and database hosting (the infrastructure the application runs on).
• An SMTP provider for sending email.
• Expo’s notification infrastructure and the corresponding platform services (Apple APNs, Google FCM) for mobile notifications.
• Brandfine analytics for visit statistics on this website.
• Telegram, where a customer chooses to enable operational alerts through it.

Retention

We retain data for as long as the service is provided and for any period required by applicable law. Pairing codes expire within two minutes and are consumed on first use. Push identifiers reported as invalid are deleted automatically.

Security

• All traffic is encrypted with HTTPS.
• Passwords are stored only as irreversible hashes.
• Only the SHA-256 hash of a pairing code is stored; the code itself exists solely inside the QR image.
• Uploaded documents are kept in non-public storage and served only through time-limited signed links.

Your rights

Under KVKK art. 11 and the GDPR you have the right to access your data, request its correction or deletion, object to its processing, and request portability. Send any request to hello@filopy.com.

Cookies

This website uses no tracking cookies beyond session handling and basic visit statistics. The admin panel uses one strictly necessary session cookie to keep you signed in.

Changes

When we update this policy we change the date on this page. We notify our customers separately about material changes.