1. Data controller
As G360.ai, we act as the data controller under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and take the security of your personal data seriously. This notice explains what data we process, for what purposes, and how.
2. Personal data we collect
Through our website and communication channels, we may collect your name, phone number, email address, business information, and any other contact details you share with us.
3. Purposes of processing
The data we collect is processed to prepare quotes, deliver our virtual tour service, maintain customer communication, fulfill legal obligations, and improve service quality.
4. Data transfers
Your personal data is not shared with third parties except where legally required. It may be shared to a limited extent with our business partners where necessary to deliver our service (e.g. hosting and infrastructure providers).
5. Retention period
Your personal data is retained for as long as required by the purpose of processing, subject to the statute-of-limitations periods set out in applicable law.
6. Your rights under KVKK
Under Article 11 of KVKK, you have the right to learn whether your personal data is processed, request information about it, learn the purpose of processing and whether it is used accordingly, know the third parties to whom it is transferred domestically or abroad, request correction if processed incompletely or incorrectly, request its deletion or destruction, and request that these actions be notified to the third parties it was transferred to.
7. Contact
To exercise your rights or for any questions, you can reach us at bilgi@g360.ai.
8. Cookie Notice
We use cookies, similar storage technologies and pixels ("cookies") to improve your experience and measure our services. Their use complies with applicable legislation, primarily Turkish Personal Data Protection Law No. 6698. Our site uses both first-party cookies (placed by us) and third-party cookies (placed by providers such as Google).
Strictly necessary cookies
Required for the site to function correctly; these cannot be disabled. They cover remembering your theme and language preference, keeping your session active when you sign in to the admin panel, and security checks. For these we rely on the legal grounds in Article 5 of KVKK: processing being directly related to the conclusion or performance of a contract, and processing being necessary for our legitimate interests provided your fundamental rights are not harmed.
Analytics cookies
Used to measure which pages are viewed, how long a visit lasts and how our services are used. Measurement relies on a temporary code that expires when your browser tab closes, and your IP address is not stored. A persistent visitor code is stored in your browser so that returning visits can be recognized.
Advertising and measurement cookies (third party)
Placed by Google Analytics and Google Ads, these cookies are used to measure advertising performance and to show relevant promotion to visitors of our site. These cookies load when you open the site. By using the site you accept their use. You can delete or block cookies in your browser settings.
| Cookie / technology | Provider | Purpose | Duration |
|---|
| g360_olay_oturum | G360 | Temporary session code for visit measurement | Until the tab is closed |
| g360_riza | G360 | Remembering your cookie preference | Until deleted |
| g360_ziyaretci | G360 | Measuring returning visits (with consent only) | Until deleted |
| _ga, _ga_* | Google Analytics | Visit statistics | 2 years |
| _gcl_* | Google Ads | Advertising conversion measurement | 90 days |
| Google Maps | Google | Maps and business search | Session |
How can you control cookies?
You can change your preferences at any time via the "Settings" option in the cookie bar on our site. You can also delete or block cookies from your browser settings: Chrome, Firefox, Safari. To opt out of Google Analytics entirely you can use the Google Analytics opt-out add-on. For your rights under KVKK, see section 6 above.
9. Mobile app (G360 Sanal Tur)
This section applies to the G360 Sanal Tur (G360 Virtual Tours) app: the Android version on Google Play and the iOS version on the App Store (package name and bundle ID for both: ai.g360.app). Where the two versions differ, this section says so; otherwise they work the same way. The other sections of this policy also apply to the app. In case of conflict, this section prevails for the app.
9.1 Data controller
Data controller: Burak Kaan Kök. E-mail: bilgi@g360.ai. Phone: +90 540 5000 360.
9.2 Optional account
You can use the app without an account. The account is used only to sync your favorites and recently viewed lists and to give G360 staff access to the staff section. If you wish, you can create an account with your e-mail address and a password from the Profile tab. For the account, we receive your e-mail address and your password. A name is not required; when the account is created, the part of your e-mail address before the @ sign is saved as your name. After you sign in, your favorites and recently viewed tours are saved to your account, so you can see the same lists on your other devices. For security, the time, IP address and method of account creation and of each sign-in are recorded. The app shows no ads and does not use the advertising ID.
Your password is stored only as a one-way, salted hash (PBKDF2); the password itself is not stored. Because the email address is not verified, an account created with email does not open the staff section. Failed sign-in attempts are counted for at most 15 minutes, using a keyed hash of the email, to prevent abuse.
In the Android app, you can also sign in with Google from the Profile tab if you wish; the iOS app has no Google sign-in. With this sign-in, we receive your name, e-mail address, the link to your profile photo and your Google account ID from Google. We never receive your Google password. If the e-mail address is registered as G360 staff, the staff section opens in the Android app. This section shows a staff member only the contact details of the business customers they are authorized to see, taken from the G360 customer management system. This information is not stored on the device.
You can delete your account at any time: in the app with Profile > "Delete my account", or on the g360.ai/delete-account page. Deletion immediately and permanently removes your name, e-mail address, password hash and profile photo link (if any), your favorites, recently viewed and saved-for-later lists on our server, your favorite deletion records and your sign-in records. The lists on your device stay; you can delete them by uninstalling the app.
9.3 App permissions
The Android app only uses the internet and network state permissions. It does not request location, camera, microphone, contacts, photo or file access. Technical permissions added by the libraries it uses (keeping the device awake, starting at boot, foreground service) are not used by the app to collect data. The iOS app does not request location, camera, microphone, contacts, photos, Face ID or app tracking (App Tracking Transparency) permission.
9.4 Information stored on your device
The following information is stored on your device. If you are not signed in, this information is not sent to us or to anyone else. The tour player's measurement data (9.6) and the app's error reports and usage events (9.6a; e.g. opening a tour, adding a favorite) are sent without being linked to your account. Error reports that could not be sent yet (up to 20) wait on the device until they are sent. If you are signed in, your favorites and recently viewed tours are synced with your account (9.2):
- The list of tours you add to favorites,
- The list of up to 20 tours you viewed last (cleared with Profile > "Clear recently viewed"),
- The cache of the tour list and cover images.
Searches in the app run on the device. Search terms are not sent to us and are not stored. You can delete this information by uninstalling the app or, on Android, with "Clear storage" in the settings. On iOS, your sign-in session is kept in the Apple keychain and is deleted when you sign out in Profile. If you delete the app, the session may remain in the keychain; it is deleted without being read the first time the app is opened after reinstalling.
9.5 Downloading the tour list
The app downloads the tour list and cover images from g360.ai. These requests do not contain personal data. Your device's IP address is technically processed by our infrastructure provider Cloudflare so that the response can reach you. If a wrong password is entered for a password-protected tour, a non-reversible hash of your IP address is kept for up to 10 minutes to limit attempts.
9.6 Measurement in the tour player
Tours open inside the app in the g360.ai tour player. To understand how tours are viewed, the player sends us the following information:
- Opening the tour, the sections viewed, moves between points (scenes) in the tour, zooming, leaving the tour and viewing time,
- The element tapped or clicked on the player page and its position, page scrolling,
- Samples of the on-screen position of touch or pointer movement (one every 1.5 seconds, at most 40 samples),
- If text is copied on the player page, the first 60 characters of the copied text,
- Taps on a phone or WhatsApp link and the text of that link (up to 60 characters). This link belongs to the business that owns the tour; your own number is not collected,
- Where the tour was opened from: landing page, referring address, source and campaign tag (for tours opened from the app the source is recorded as "direct"),
- Device type (mobile/desktop), screen width and device language,
- Approximate country and city derived from the IP address.
This information is recorded together with a temporary session code created randomly each time a tour is opened. The code is not linked to an account, your name or a device ID. Your IP address itself is not written to the measurement records. Google Analytics, Google Ads and Microsoft Clarity do not run inside the app.
- Purpose: to understand which parts of tours draw interest, to improve the service and the app, to find errors, and to give tour-owner businesses aggregate (non-personal) viewing statistics.
- Legal basis: KVKK Art. 5/2-f (legitimate interest of the data controller, provided it does not harm your fundamental rights and freedoms).
- Collection method: electronically, by automated means.
9.6a App error reports and usage events
If the app crashes or an error occurs, the app sends us an error report. The report contains the error type, the error message, where in the code the error occurred (stack trace), the app version, the platform and operating system version, the screen where the error occurred and the time. E-mail addresses, keys and session data, long number sequences (e.g. phone numbers) and the query parts of links are removed before the report is stored. The same error on the same day is kept as one record; only its repeat count increases.
The app also sends us the following usage events: opening a tour, starting to explore, adding or removing a favourite, and signing in (with Google or email). Each event is sent with the tour code (if any), the app version, the app language, the time and a random, temporary session code that is created anew each time the app is opened. No installation ID, advertising ID or location is sent.
Error reports and usage events are not linked to your account, your name or a device ID. Your IP address is not written to these records. To prevent abuse, requests from the app are counted per IP address or per account within a 60-second window; this counter is not kept as a record. Purpose: finding and fixing errors in the app and improving the app. Legal basis: KVKK Art. 5/2-f (legitimate interest of the data controller, provided it does not harm your fundamental rights and freedoms). Collection method: electronically, by automated means.
9.7 Map (Google Maps / Apple Maps)
In the Android app, the map tab uses the "Google Maps SDK for Android" service of Google LLC. To show the map and improve its own services, Google may collect data such as IP address, device and request information, crash logs, map usage information and an SDK identifier. This data is subject to Google's own privacy policy: policies.google.com/privacy. In the iOS app, the map tab uses Apple Maps (MapKit) of Apple Inc.; the Google Maps SDK is not part of the iOS app. Map requests are subject to Apple's own privacy policy: apple.com/legal/privacy. The app does not request location permission. Your location is not shown on the map and is not sent to us.
9.8 Tours opened with Street View
Some tours are Google Street View imagery and open as a Google Maps embed. While you view these tours, Google may use cookies and collect data under its own policy.
9.9 Links that leave the app
- "Send feedback" opens your e-mail app. The app version and version code, the operating system and its version (Android or iOS), the phone's make and model and the app language are added to the e-mail. You can see and delete them before sending. The e-mail comes to bilgi@g360.ai; we use your e-mail address and what you write to reply to you and to fix the app.
- "Directions" opens in the Google Maps app or in the browser.
- "Share" opens the share menu on Android and the share sheet on iOS. We do not know whom you send the link to.
- Website and policy links in the app open in the browser. There, the cookie section of this policy (section 8) applies.
9.10 Transfer of data
Measurement data is not sold and is not shared with anyone for advertising. The data is stored on the servers of Cloudflare, Inc., our hosting and infrastructure provider. These servers may be located abroad. The transfer is made in line with the conditions of KVKK Art. 9. Street View data and, in the Android app, map data are collected directly by Google LLC; in the iOS app, map requests are processed directly by Apple Inc. (9.7, 9.8). Account data is not sold either, is not shared for advertising and is stored on the same Cloudflare servers. Sign in with Google (Android app only) is provided by Google LLC.
9.11 Retention period
Tour player measurement records (9.6) are kept for as long as the purpose of processing requires (section 5). Information on your device (9.4) stays on your device until you delete it. Account data is kept until you delete your account. Sign-in records and the deletion records of favorites you removed are deleted automatically after 180 days.
App error reports are deleted automatically after 90 days, and app usage events after 395 days (about 13 months).
9.12 Children
The app is not directed at children under 18. We do not knowingly collect personal data from children.
9.13 Your rights
Your rights under KVKK Art. 11 are listed in section 6. You can send your requests to bilgi@g360.ai. We reply within 30 days at the latest. Measurement records are kept without an account and with a random session code, so we cannot match a record to a person. If you include the date, time and tour name in your request, we will try to find the related records. You can delete your account data yourself at once in the ways described in section 9.2.
9.14 Changes
We update this section as the app changes. Last updated: 23.10.2026.
