Privacy Policy
1. Who we are
Velocost is operated by Cenk Alper Tantoğlu (Urastech) (address: Fatih Mahallesi No:74, Muratlı / Tekirdağ, Türkiye), the data controller. Any request, objection or deletion demand can be sent to info@urastech.com.
Velocost is a trip cost planner for car journeys in Türkiye and Europe, plus vehicle and fleet expense tracking. It is not a navigation app and does not track you while you drive.
2. Data we process
The table below is the complete list. We collect nothing outside it.
| Category | Content | Why | Required? |
|---|---|---|---|
| Identity and contact | Full name, email address | Creating your account, signing you in, service notices | Required |
| Account security | Irreversible password hash, session token | Login security | Required |
| Google sign-in | Name, email and user id from your Google account | Password-free sign-in — only if you choose it | Optional |
| Vehicle data | Vehicle name, make/model, fuel type, consumption, battery capacity, odometer | Calculating cost correctly | Required to use the feature |
| Trip data | Origin and destination address, waypoints, chosen route, calculated cost and date | Showing results, history, caching | Required to use the feature |
| Expense records | Fuel/charging purchases (litres or kWh, amount, odometer), maintenance and cost entries | Real consumption and per-vehicle cost analysis | Optional |
| Location | Your device’s current coordinates | Read only when you tap “Use my location”, converted to an address and placed in the origin field | Optional — can be declined |
| Fleet (business) data | Company and department name, members, vehicle–driver assignment, delivery stops and driver arrival timestamps | Fleet management; only for users invited to a company account | Optional |
| Natural-language query | The free text you type into the chat field | Turning your sentence into a route | Optional |
| Technical logs | IP address, browser/device information, error logs, request time | Abuse prevention, rate limiting, diagnostics | Required — generated automatically |
| Subscription | Google Play purchase token, subscription status and expiry date | Unlocking and maintaining Pro access | Only for subscribers |
| Support and feedback | The content of your message and your email address | Answering your request | Optional |
We never collect special-category data (health, biometrics, religion, membership). We do not access your contacts, camera, microphone, SMS, call log or device files.
3. Location data in detail
Location permission is entirely optional. If you decline it the app keeps working in full; you simply type the origin yourself.
- Location is read ONLY at the moment you tap “Use my location”, once per tap.
- The app never collects location in the background. Nothing is read while the app is closed or backgrounded.
- The coordinate is converted into an address, written into the origin field and not stored. Your device only keeps your CHOICE (“allowed” / “I will type it”) — never latitude and longitude.
- To convert coordinates into an address we send them to our map provider (HERE or Openrouteservice). Our server keeps only an account-independent address cache.
- You can withdraw the permission at any time from your device settings or your browser’s site settings.
4. Use of artificial intelligence
A query you type in natural language is first parsed by our own rule-based parser on our server; nothing leaves our systems at that stage. Only if the rule-based parse fails is the query text sent to OpenAI’s gpt-4o-mini model.
- Only the sentence you typed is sent. Your name, email, account id and vehicle records are not.
- OpenAI commits not to use data submitted through its API to train models.
- If the same query has been resolved before, it is answered from cache and OpenAI is not called at all.
- The AI only parses “from – to – which vehicle”. The cost calculation itself runs on our server with explainable formulas.
5. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6 / KVKK Art. 5) |
|---|---|
| Creating your account and providing the service | Performance of a contract |
| Cost calculation, history and reporting | Performance of a contract |
| Subscription and credit management | Performance of a contract |
| Abuse prevention, rate limiting, bot protection | Legitimate interest |
| Diagnostics and service quality | Legitimate interest |
| Reading your location | Consent — given on the permission screen, withdrawable |
| Marketing emails and newsletters | Consent — can be switched off in your profile |
| Statutory retention and responding to lawful requests | Legal obligation |
7. Payments
The Pro subscription in the Android app is purchased through Google Play. Google takes the payment; your card number, expiry date and security code never reach us and are never stored in our systems. We keep only Google’s purchase token together with the subscription status and expiry date.
Cancellation, refunds and billing are handled through your Google Play account and are subject to Google Play’s own policies.
8. Retention
- Account and content data: for as long as your account exists. Deleting the account cascades to the linked records.
- Deletion requests: completed within 30 days at the latest; purged from backups within 90 days.
- Technical and error logs: 12 months maximum.
- Invoice and payment records: 10 years, as required by tax law. Accessed only for legal purposes during that period.
- Route and address caches: not linked to your account and carry no identifier.
9. Your rights
Under KVKK Art. 11 and, if you are in the EU, the GDPR, you have the right to:
- Learn whether your personal data is processed and request information about it
- Learn the purpose of processing and whether it is used accordingly
- Know the third parties to whom data is transferred, at home or abroad
- Request correction of incomplete or inaccurate data
- Request erasure or destruction
- Request that correction and erasure be notified to the parties data was transferred to
- Object to an adverse outcome produced solely by automated analysis
- Claim compensation for damage caused by unlawful processing
- Receive your data in a portable format
- Withdraw your consent at any time
Send requests to info@urastech.com; we answer free of charge within 30 days. To delete your account and all data yourself, right now, use the Profile screen in the app — see the “Account and Data Deletion” page.
10. Security
- All traffic is encrypted with TLS; the app only runs over a secure connection.
- Passwords are hashed irreversibly. Plain-text passwords are stored nowhere and are not visible to us.
- Every database table has row-level security enabled: a user can read only their own records.
- API keys and secrets live server-side only and are never sent to the client.
- Rate limiting and bot protection block brute-force attempts.
- In the event of a breach we notify the supervisory authority within 72 hours and affected users as soon as reasonably possible.
11. Children’s privacy
Velocost is not directed at anyone under 18 and contains no child-directed content. We do not knowingly collect data from under-18s; if we learn of such a record we delete it without delay.
12. Changes
When we update this policy the “last updated” date at the top changes. For material changes affecting the categories collected or the parties data is shared with, we notify you in the app and by email before the change takes effect.
13. Contact
For any privacy question: info@urastech.com. You also retain the right to lodge a complaint with the Turkish Personal Data Protection Authority (kvkk.gov.tr) or your local supervisory authority.