Privacy & personal data

1. Who is responsible

MUBER TRAVEL TURİZM TİCARET LİMİTED ŞİRKETİ operates Muber Travel and is the data controller for these activities. Registered address: Merkez Mahallesi, Ali Galipbey Caddesi, Ekşioğlu İşhanı No: 16, İç Kapı No: 29, Gaziosmanpaşa / İstanbul, Türkiye. Contact: info@mubertravel.com.

2. Information we receive

Account information includes your email address, verification status and, where requested by the registration form, your name, telephone number and a protected password hash. Email verification is required before an account is activated. We do not store your account password as readable text.

Journey requests include your name, email, phone, pickup and destination addresses, travel date and time, passenger and luggage counts, selected vehicle and extras, and any flight number or journey note you provide. We also process the booking reference and subsequent correspondence. Please do not enter passport numbers, payment card details or medical records in free-text notes.

Technical information includes connection and request information needed to deliver the site, maintain sessions and limit misuse, including IP-derived security identifiers. Information is collected electronically through the site and through the email or messaging channels you choose to contact us.

3. Purposes and legal grounds

We use account and journey details to respond to your request, verify your email, manage your account and arrange the service you request. The relevant basis under Turkish Law No. 6698 is necessity for establishing or performing a contract (Article 5(2)(c)).

We use relevant transaction records to meet applicable legal obligations (Article 5(2)(ç)) and to establish, exercise or protect legal rights (Article 5(2)(e)). Security and abuse-prevention processing relies on our legitimate interests, provided your fundamental rights are not harmed (Article 5(2)(f)). Reading this notice or creating an account is not consent to advertising.

4. Service providers and disclosure

Authorised Muber personnel and the transport providers assigned to your journey receive the details necessary to arrange and deliver it. Our website uses Sites hosting on Cloudflare infrastructure and Resend for transactional emails. These providers process the technical, account or message data needed for their services. Information may also be disclosed to competent authorities where legally required.

Address search sends the address text you enter to Google Maps services. When a route preview is available, the selected origin and destination are sent to Google to calculate and display the route. Journey times are estimates. Google operates these services under its own privacy terms, available at https://policies.google.com/privacy.

The Google interface loads only when you choose Google sign-in. When that service is available, we validate the identity response from Google and use your name and verified email to start our account verification flow. We do not request access to Gmail messages, contacts or Google Drive, and we never receive your Google password. Google may process browser and account information when its sign-in interface loads.

Some technology providers operate outside Türkiye, so their services can involve processing abroad. You can request information about the recipients and the applicable international-transfer arrangements using the contact details above. This notice is not a request for blanket consent to overseas transfers.

5. Cookies, storage and retention

Only if you enable optional analytics, we count page views and visits in aggregate, by page, traffic-source category, country and device category. We do not store names, email addresses, IP addresses or visitor identifiers in these statistics. Session storage keeps only the last page and visit time in your tab to approximate visits with a 30-minute inactivity threshold; closing the tab clears it.

A necessary session cookie keeps you signed in for up to 30 days; signing out invalidates that session. Email codes expire after 10 minutes. If Google sign-in is available, a short-lived security cookie protects that flow. Your language and currency preferences are stored in your browser until you change or clear them. You can remove these items through browser settings, although removing session cookies signs you out.

Account information is retained to provide your account. You can request account closure and deletion by email. Journey and correspondence records are retained for the service, applicable legal obligations and the establishment or defence of claims; records whose processing grounds have ended are subject to deletion or anonymisation. Code expiry does not itself mean every associated record has immediately been erased.

6. Your rights and requests

Under Article 11 of Law No. 6698, you may ask whether your data is processed, obtain information about that processing and its purpose, learn about domestic or overseas recipients, request correction, request deletion or destruction when the legal conditions apply, and request that relevant corrections or deletions be notified to recipients. You may object to an adverse result based solely on automated analysis and seek compensation for damage caused by unlawful processing.

Send requests to info@mubertravel.com, preferably from the email associated with your account, or submit a written request to our registered address. Explain the request and include enough information to identify the account or journey. We may need proportionate identity verification. Requests under Turkish data protection law are answered within the applicable statutory period, generally no later than 30 days. Rights and complaint routes under other applicable data protection laws remain available.

7. Separate choices and communications

Necessary service messages, verification codes and booking correspondence are not marketing subscriptions. Accepting a transfer agreement does not give advertising consent. Optional visit measurement is off until separately permitted and can be withdrawn using Cookie preferences.

We use data supplied by a booking holder about another passenger only for the necessary service and related lawful purposes. The booking holder should share this notice with that passenger; enquiries can also be made directly to us.

8. Special-category data and data minimisation

Passenger counts and seat needs can be provided without medical documents. Do not submit health records, passport copies or card details in free-text notes. If a service requires special-category data, the specific lawful basis and secure collection process must be assessed separately; this notice is not general permission to process it.

Information may be shared with assigned drivers, transport providers, authorised staff, accounting/legal advisers and competent authorities only as necessary for the relevant purpose and legal basis. Flight-check services, when enabled, use flight number and date to check the journey.

9. Retention and overseas processing

Retention depends on the category and purpose: membership, booking performance, accounting obligations, complaints, security and potential claims are assessed separately. Expiring a login code or cookie does not automatically erase every associated server record. You may request information about the retention applicable to your record.

Hosting, transactional email, maps, optional Google sign-in and any enabled flight service may involve providers or infrastructure outside Türkiye. The overseas-transfer framework under Article 9 of Law No. 6698 must be assessed separately for the actual recipient and flow. Cookie or contract acceptance is not a substitute for that framework and this notice does not claim that a particular standard contract has been signed.

10. Optional AI support

When you send a message to the Muber AI assistant, your message and recent messages from the same chat are sent to OpenAI to generate a response. The assistant also receives the public vehicle/extras catalogue and transfer rules, but does not receive account records or other customers’ reservations. Opening the window alone does not send your message to OpenAI.

When you request a journey price, the route is sent to Google Maps services to verify locations and driving distance. The resulting quote is calculated by Muber’s pricing system. Journey details and the calculated vehicle prices are also supplied to OpenAI to explain and compare your options. Quote records are stored temporarily on our server and are valid for 30 minutes; this is separate from chat storage. Selecting a vehicle opens the reservation form, where you review details and explicitly submit your request.

Only authorised operators can share photos from the vehicle gallery or upload photos. Uploaded images are resized and re-encoded, EXIF metadata is removed, and images are accessible only to authorised staff and the browser associated with that conversation. They expire with the conversation and are removed during scheduled cleanup; images are not submitted to the AI model. Any photo caption remains part of the chat text. Chat messages are stored in our protected conversation database for up to 30 days so authorised staff can assist and take over the conversation. When you open the chat, an approximate connection country provided by Cloudflare is stored for authorised staff to assist you, even before your first message. We do not store a raw IP address for this feature or disclose the country to the AI or in notification text. VPNs can affect accuracy. An essential secure cookie associates this browser with its conversation. Starting a new chat disconnects the previous conversation; it does not delete stored records or provider logs. We send store=false to the Responses API, but this is not a guarantee of zero retention: OpenAI may retain abuse-monitoring data for up to 30 days or longer where required under its published data controls. Provider processing can involve infrastructure outside Türkiye.

Do not share passwords, verification codes, payment card details or unnecessary sensitive information. An assistant message does not cancel or confirm a reservation, guarantee staff availability, take payment or grant a refund. You can request a representative in the chat; availability is not guaranteed. WhatsApp and booking@mubertravel.com remain available for operational requests. Following WhatsApp opens that provider’s service; your chat transcript is not automatically sent there.

11. Optional Google measurement

With your separate analytics permission, Google Analytics 4 receives page and reservation-request events and processes browser/device and technical connection information. Unlike our aggregate first-party counters, Google may use browser identifiers. Query parameters, fragments, passenger contact fields, flight codes, precise journey addresses, booking references and chat content are not sent as event parameters. Automated form measurement and Google signals are disabled.

Google Ads conversion measurement is enabled only after Ads identifiers are configured and you separately permit advertising measurement. Personalised advertising and enhanced conversions are disabled. Cash requests are measured as leads, not collected revenue. You can withdraw either choice through Cookie preferences without affecting booking. The cookie policy explains browser records and lifetimes.

Google LLC is an additional recipient for these optional services, which may involve processing outside Türkiye. Separate consent for optional measurement does not replace the applicable international-transfer framework described above. Previously sent data is not erased solely by withdrawing a browser preference; you can address rights requests to the controller.