1. Data controller
As G360.ai, we act as the data controller under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and take the security of your personal data seriously. This notice explains what data we process, for what purposes, and how.
2. Personal data we collect
Through our website and communication channels, we may collect your name, phone number, email address, business information, and any other contact details you share with us.
3. Purposes of processing
The data we collect is processed to prepare quotes, deliver our virtual tour service, maintain customer communication, fulfill legal obligations, and improve service quality.
4. Data transfers
Your personal data is not shared with third parties except where legally required. It may be shared to a limited extent with our business partners where necessary to deliver our service (e.g. hosting and infrastructure providers).
5. Retention period
Your personal data is retained for as long as required by the purpose of processing, subject to the statute-of-limitations periods set out in applicable law.
6. Your rights under KVKK
Under Article 11 of KVKK, you have the right to learn whether your personal data is processed, request information about it, learn the purpose of processing and whether it is used accordingly, know the third parties to whom it is transferred domestically or abroad, request correction if processed incompletely or incorrectly, request its deletion or destruction, and request that these actions be notified to the third parties it was transferred to.
7. Contact
To exercise your rights or for any questions, you can reach us at bilgi@g360.ai.
8. Cookie Notice
We use cookies, similar storage technologies and pixels ("cookies") to improve your experience and measure our services. Their use complies with applicable legislation, primarily Turkish Personal Data Protection Law No. 6698. Our site uses both first-party cookies (placed by us) and third-party cookies (placed by providers such as Google).
Strictly necessary cookies
Required for the site to function correctly; these cannot be disabled. They cover remembering your theme and language preference, keeping your session active when you sign in to the admin panel, and security checks. For these we rely on the legal grounds in Article 5 of KVKK: processing being directly related to the conclusion or performance of a contract, and processing being necessary for our legitimate interests provided your fundamental rights are not harmed.
Analytics cookies
Used to measure which pages are viewed, how long a visit lasts and how our services are used. Measurement relies on a temporary code that expires when your browser tab closes, and your IP address is not stored. A persistent visitor code is stored only if you give explicit consent, so that returning visits can be recognized. For the persistent code we rely on your explicit consent under Article 5 of KVKK; if you do not consent, no persistent record is created.
Advertising and measurement cookies (third party)
Placed by Google Analytics and Google Ads, these cookies are used to measure advertising performance and to show relevant promotion to visitors of our site. Google Consent Mode is applied: unless you consent, these cookies are not written and no advertising identifier is created. For these we rely on your explicit consent under Article 5 of KVKK.
| Cookie / technology | Provider | Purpose | Duration |
|---|
| g360_olay_oturum | G360 | Temporary session code for visit measurement | Until the tab is closed |
| g360_riza | G360 | Remembering your cookie preference | Until deleted |
| g360_ziyaretci | G360 | Measuring returning visits (with consent only) | Until deleted |
| _ga, _ga_* | Google Analytics | Visit statistics | 2 years |
| _gcl_* | Google Ads | Advertising conversion measurement | 90 days |
| Google Maps | Google | Maps and business search | Session |
How can you control cookies?
You can change your preferences at any time via the "Settings" option in the cookie bar on our site. You can also delete or block cookies from your browser settings: Chrome, Firefox, Safari. To opt out of Google Analytics entirely you can use the Google Analytics opt-out add-on. For your rights under KVKK, see section 6 above.
9. Mobile app (G360 Sanal Tur)
This section applies to the G360 Sanal Tur Android app published on Google Play (package name: ai.g360.app). The other sections of this policy also apply to the app. In case of conflict, this section prevails for the app.
9.1 Data controller
Data controller: Burak Kaan Kök. E-mail: bilgi@g360.ai. Phone: +90 545 620 78 30.
9.2 Optional account (Sign in with Google)
You can use the app without an account. The account is used only to sync your favorites and recently viewed lists and to give G360 staff access to the staff section. If you wish, you can sign in with Google from the Profile tab. When you sign in, we receive your name, e-mail address, the link to your profile photo and your Google account ID from Google. We never receive your Google password. After you sign in, your favorites and recently viewed tours are saved to your account, so you can see the same lists on your other devices. For security, the time, IP address and method of each sign-in are recorded. The app shows no ads and does not use the advertising ID.
G360 staff can open the staff section of the app with the same Google sign-in. This section shows a staff member only the contact details of the business customers they are authorized to see, taken from the G360 customer management system. This information is not stored on the device.
You can delete your account at any time: in the app with Profile > "Delete my account", or on the g360.ai/hesap-sil page. Deletion immediately and permanently removes your name, e-mail address, profile photo link, your favorites and recently viewed lists on our server, your favorite deletion records and your sign-in records. The lists on your device stay; you can delete them by uninstalling the app.
9.3 App permissions
The app only uses the internet and network state permissions. It does not request location, camera, microphone, contacts, photo or file access. Technical permissions added by the libraries it uses (keeping the device awake, starting at boot, foreground service) are not used by the app to collect data.
9.4 Information stored on your device
The following information is stored on your device. If you are not signed in, it is not sent to us or to anyone else. If you are signed in, your favorites and recently viewed tours are synced with your account (9.2):
- The list of tours you add to favorites,
- The list of up to 20 tours you viewed last (cleared with Profile > "Clear recently viewed"),
- The cache of the tour list and cover images.
Searches in the app run on the device. Search terms are not sent to us and are not stored. You can delete this information by uninstalling the app or with "Clear storage" in Android settings.
9.5 Downloading the tour list
The app downloads the tour list and cover images from g360.ai. These requests do not contain personal data. Your device's IP address is technically processed by our infrastructure provider Cloudflare so that the response can reach you. If a wrong password is entered for a password-protected tour, a non-reversible hash of your IP address is kept for up to 10 minutes to limit attempts.
9.6 Measurement in the tour player
Tours open inside the app in the g360.ai tour player. To understand how tours are viewed, the player sends us the following information:
- Opening the tour, the sections viewed, moves between points (scenes) in the tour, zooming, leaving the tour and viewing time,
- The element tapped or clicked on the player page and its position, page scrolling,
- Samples of the on-screen position of touch or pointer movement (one every 1.5 seconds, at most 40 samples),
- If text is copied on the player page, the first 60 characters of the copied text,
- Taps on a phone or WhatsApp link and the text of that link (up to 60 characters). This link belongs to the business that owns the tour; your own number is not collected,
- Where the tour was opened from: landing page, referring address, source and campaign tag (for tours opened from the app the source is recorded as "direct"),
- Device type (mobile/desktop), screen width and device language,
- Approximate country and city derived from the IP address.
This information is recorded together with a temporary session code created randomly each time a tour is opened. The code is not linked to an account, your name or a device ID. Your IP address itself is not written to the measurement records. Google Analytics, Google Ads and Microsoft Clarity do not run inside the app.
- Purpose: to understand which parts of tours draw interest, to improve the service and the app, to find errors, and to give tour-owner businesses aggregate (non-personal) viewing statistics.
- Legal basis: KVKK Art. 5/2-f (legitimate interest of the data controller, provided it does not harm your fundamental rights and freedoms).
- Collection method: electronically, by automated means.
9.6a App error reports and usage events
If the app crashes or an error occurs, the app sends us an error report. The report contains the error type, the error message, where in the code the error occurred (stack trace), the app version, the platform and operating system version, the screen where the error occurred and the time. E-mail addresses, keys and session data, long number sequences (e.g. phone numbers) and the query parts of links are removed before the report is stored. The same error on the same day is kept as one record; only its repeat count increases.
The app also sends us the following usage events: opening a tour, starting to explore, adding or removing a favourite, and signing in with Google. Each event is sent with the tour code (if any), the app version, the app language, the time and a random, temporary session code that is created anew each time the app is opened. No installation ID, advertising ID or location is sent.
Error reports and usage events are not linked to your account, your name or a device ID. Your IP address is not written to these records. To prevent abuse, requests from the app are counted per IP address or per account within a 60-second window; this counter is not kept as a record. Purpose: finding and fixing errors in the app and improving the app. Legal basis: KVKK Art. 5/2-f (legitimate interest of the data controller, provided it does not harm your fundamental rights and freedoms). Collection method: electronically, by automated means.
9.7 Map (Google Maps)
The map tab uses the "Google Maps SDK for Android" service of Google LLC. To show the map and improve its own services, Google may collect data such as IP address, device and request information, crash logs, map usage information and an SDK identifier. This data is subject to Google's own privacy policy: policies.google.com/privacy. The app does not request location permission. Your location is not shown on the map and is not sent to us.
9.8 Tours opened with Street View
Some tours are Google Street View imagery and open as a Google Maps embed. While you view these tours, Google may use cookies and collect data under its own policy.
9.9 Links that leave the app
- "Directions" opens in the Google Maps app or in the browser.
- "Share" opens the Android share menu. We do not know whom you send the link to.
- Website and policy links in the app open in the browser. There, the cookie section of this policy (section 8) applies.
9.10 Transfer of data
Measurement data is not sold and is not shared with anyone for advertising. The data is stored on the servers of Cloudflare, Inc., our hosting and infrastructure provider. These servers may be located abroad. The transfer is made in line with the conditions of KVKK Art. 9. Map and Street View data is collected directly by Google LLC (9.7, 9.8). Account data is not sold either, is not shared for advertising and is stored on the same Cloudflare servers. Sign in with Google is provided by Google LLC.
9.11 Retention period
Measurement records are kept for as long as the purpose of processing requires (section 5). Information on your device (9.4) stays on your device until you delete it. Account data is kept until you delete your account. Sign-in records and the deletion records of favorites you removed are deleted automatically after 180 days.
App error reports are deleted automatically after 90 days, and app usage events after 395 days (about 13 months).
9.12 Children
The app is not directed at children under 18. We do not knowingly collect personal data from children.
9.13 Your rights
Your rights under KVKK Art. 11 are listed in section 6. You can send your requests to bilgi@g360.ai. We reply within 30 days at the latest. Measurement records are kept without an account and with a random session code, so we cannot match a record to a person. If you include the date, time and tour name in your request, we will try to find the related records. You can delete your account data yourself at once in the ways described in section 9.2.
9.14 Changes
We update this section as the app changes. Last updated: 10.10.2026.
