Home
Questo testo legale fa fede in turco e in inglese. Si applica la versione inglese riportata di seguito.

Privacy Policy

Version 2026-10-20 · Effective date: 20 October 2026

1. Controller

The controller of the personal data processed in the Klaimira app and on klaimira.com is Zihni Tunçsiper (“we”). For any privacy question or request: destek@klaimira.com

This notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and Article 13 of the EU General Data Protection Regulation (GDPR).

2. In short

  • An account is required: you sign in with Apple or Google. Your records and evidence are kept in your account, so they are not lost when you change phones. Exception: once you save or share the paid claim file of a trip, that trip’s data is deleted from the server and stays only on your phone (section 4).
  • Your data is not sold, not used for advertising and not used to track you across other apps or websites.
  • Usage statistics are optional and pseudonymous, not anonymous: they are stored with a random identifier linked to your account.
  • AI is used only with your explicit permission, in three actions you start yourself, with the least text needed; you can withdraw permission at any time (section 6).
  • You can export your data at any time and delete your account from within the app.

3. What we process

  • Account and sign-in: the account identifier and email address Apple or Google gives us (Apple’s relay address if you chose to hide your email), and the date your account was created. Your Apple or Google password never reaches us. Session keys are stored on the server only as hashes.
  • Profile (optional): the name, postal address, IBAN and email address that go into your claim letters.
  • Family passengers (Pro, optional): the names of passengers you add to your account and, optionally, their email address, postal address, IBAN and booking reference (PNR).
  • Flight details: flight number, date, airports, times, airline; passenger name and booking reference if read from a boarding pass; ticket price if you enter it.
  • Disruption and evidence: disruption type and event times; photos and documents you take or choose (departure board, receipt, airline notice, baggage report, bag tag and similar); notes you write and airline statements you record; amounts and times read from receipts; call duration and cost; rerouting offers; claims, letters, the text of rejection letters and AI responses.
  • Location (if you allow it): the location your phone reports when evidence is saved (latitude, longitude, accuracy) becomes part of that evidence’s seal and is stored with it. To detect your arrival at the airport, location is used only on your phone and is not sent to the server for that purpose. No location is collected in the background. Refusing permission never blocks a record.
  • Seal and attestation: the SHA-256 digests of each piece of evidence, the time it was recorded, a random per-installation device identifier and the server’s signed timestamp (attestation).
  • Notifications (if you allow them): your push address (APNs or FCM token), platform and app language.
  • Live tracking (only while the feature is switched on and you put a flight under tracking): that flight’s number, date, departure airport and scheduled times are kept on the server as a tracking record. While the feature is off, no tracking record is created.
  • Purchases: product, transaction ID, subscription expiry and status (renewal, refund, expiry) and a random purchase identifier linked to your account. Your payment card details stay with the App Store or Google Play and never reach us.
  • Usage statistics (only with your explicit consent): events from a fixed list (e.g. “app opened”, “flight added”, “file generated”) and short, non-personal properties (platform, product, result). Your name, email, flight numbers and evidence content are not sent.
  • Error reports: if the app fails, the error code, a short message stripped of personal data (email addresses and long digit strings are masked), app version and platform. Error reports are sent without session data and are not linked to your account.
  • Connection data: for every request to the server, your IP address and the request time are processed for security and abuse prevention (rate limits) and kept in the server’s access logs for a limited time.

We recommend that you do not write special categories of data, such as health information, in your notes; the app does not need them.

4. Where data is kept

  • On your phone: every record is first written to the app’s folder on your phone; recording works without an internet connection. Session keys are kept in the phone’s secure storage (Keychain / Keystore).
  • On our server: your records (flights, disruptions, evidence details, statements, claims, rejection analyses, profile, family passengers, consent records) are synced with your account. Evidence files (photos and documents) and the server attestation are uploaded for one trip on the free plan and for all trips with Pro (within a per-account storage quota); files that are not uploaded stay only on your phone. Claim files (PDF) are generated and kept only on your phone.
  • Your data stays only with you: when the full file of a claim has been paid for (Klaimira Single File or Pro) and you save or share the paid claim file (PDF), all of that trip’s data is deleted from the server: the trip, flights, disruptions, evidence details and evidence files, statements, claims and rejection analyses; if there are any, the flights’ live tracking records are deleted too and tracking stops. Only your purchase record, the server attestations of your evidence (seal digest and signed timestamp; your claim file can still be verified with them), the records’ identifiers, the trip they belong to and the time of deletion (to pass this on to your other phones) and a digest of the fields that cannot be changed (SHA-256; to check that a record sent back has not been altered) remain on the server. Deleted data remains in the server’s daily backups for at most 7 more days. The app tells you “this trip’s data is now only with you”. From then on the only copy of this trip is on your phone: if you lose your phone, uninstall the app or sign out, it cannot be recovered. To keep it, create a ZIP file with Settings → Privacy → “Export my data” and store it somewhere safe. If you ask for an AI rejection analysis or letter narrative for this trip, all of the trip’s records (including the location in the evidence seals; not the evidence files) are sent back to the server temporarily and deleted again when the action is finished (section 6).
  • The server is in a Contabo GmbH data centre in Germany. Data is transferred only over HTTPS. The server copy is not end-to-end encrypted.

5. Purposes and legal bases

  • Providing the service (account, sync and backup, evidence seal and attestation, rights assessment, letter and claim file, deadline reminders, notifications and, while the feature is switched on, live flight tracking) and verifying purchases: performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).
  • Security, abuse prevention and fixing errors (connection data, rate limits, error reports): legitimate interests (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
  • Usage statistics: consent (KVKK Art. 5(1); GDPR Art. 6(1)(a)). You can withdraw it at any time in Settings → Privacy; withdrawal does not affect the lawfulness of earlier processing.
  • AI actions (section 6): consent (KVKK Art. 5(1); GDPR Art. 6(1)(a)). Permission is asked the first time you want to use AI; you can withdraw it at any time in Settings → Privacy. Withdrawal does not affect the lawfulness of earlier processing.
  • Location, camera and notifications are used only with the permission you grant in your phone’s permission dialog.
  • Where the law requires it (e.g. a request from a competent authority), only the data needed, to the extent needed (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)).

6. AI (Anthropic)

The first time you want to use AI, the app shows what will be sent, to whom and what will not be sent, and asks for your explicit permission. If you do not give it, no AI request is made (our server also refuses requests without recorded permission) and you can do the same things yourself without AI. Your permission is recorded in your consent records with its version and date. You can withdraw it at any time in Settings → Privacy; if you do, you will be asked again the next time.

AI is used only in the three actions below and only when you start them. The request goes through our server to Anthropic; only the following is sent to Anthropic:

  • Statement classification: the text of the airline statement you recorded and its source (staff, board, app notification and similar). No flight, name or identifier is sent.
  • Rejection letter analysis: the text of the rejection letter (pasted or read on your phone); the claim’s regime, the rights engine’s result, amount and appeal chain; the evidence list (evidence ID, type, local time and the structured details you chose on the task cards, excluding free-text notes) and the text of the airline statements you recorded.
  • Letter narrative: the text in which you describe what happened, the claim language and the disruption type.

Never sent: photos and receipt images, location, the details stored in your profile and account (your name, email, postal address, IBAN, booking reference), account and device identifiers. In text you paste or write, the names saved in your account (yours, your family passengers’ and those on your boarding passes), email addresses, IBANs and booking references are replaced on our server with [NAME], [EMAIL], [IBAN] and [PNR] marks before sending. Other personal data in the text (for example your address or a name spelled differently) is sent as part of that text; you can remove it before sending.

AI does not decide entitlements, amounts, articles or authorities; these come only from the app’s rights engine. Request and response texts are not written to our server logs (only duration, usage and result code). Responses are stored in your account with your claim; for a trip whose data stays only on your phone (section 4), the records sent back for the action and the response are deleted from the server again when the action is finished. Under its commercial terms Anthropic does not use this content to train its models; it may keep it for a limited period set out in its terms for abuse monitoring.

7. Service providers (processors) and transfers

To provide the service, the following providers process data on our behalf and only for that purpose:

  • Contabo GmbH (Germany): server hosting; all account data on the server.
  • Anthropic PBC (USA): AI actions; only the texts listed in section 6.
  • AeroDataBox (via api.market): flight verification and (while the feature is switched on) live tracking; only flight number and date. No personal data is sent.
  • Apple: Sign in with Apple, App Store purchase verification and iPhone notifications (APNs).
  • Google: Sign in with Google, Google Play purchase verification and Android notifications (Firebase Cloud Messaging; the Firebase project is used only for sign-in and notifications).

While live tracking is switched on, the texts of tracking notifications (e.g. flight number and delay) are delivered to your phone through Apple’s or Google’s notification service.

On Android, boarding pass barcodes and receipts are read with Google’s on-device ML Kit libraries and the Google Play services code scanner: the image and the text read never leave your phone. These libraries may, however, send usage diagnostics to Google: device information (manufacturer, model, operating system version), the app’s package name and version, a per-installation identifier, performance metrics and error codes. Google uses them under its own terms to operate and improve these libraries. On iPhone, this reading is done with Apple’s on-device tools.

Some of these providers may process data outside Türkiye and the European Economic Area, including in the USA. These transfers rely on the safeguards provided for in the providers’ data processing terms.

We do not share, sell or rent your data for marketing. Where the law requires it (e.g. a court order), only the data needed may be disclosed to the competent authorities.

8. How long we keep data

  • Account data (records, evidence files, attestations, profile, family passengers, consent records, purchase records): for as long as your account exists, except for trips whose data stays only on your phone (section 4). When you delete your account, it is deleted immediately and permanently from the server database and file storage.
  • When you delete a record in the app (trip, flight, family passenger), its content is erased immediately from your phone and from the server database; only the record’s identifier and deletion time remain, so that it also disappears from your other devices.
  • Usage statistics are deleted after 180 days, error reports after 30 days (as they are not linked to your account, when that period ends rather than when you delete your account), unused push addresses after 270 days and finished flight tracking after 30 days.
  • Backups: to protect against data loss, the server takes a daily backup of its database on the same server and keeps each backup for 7 days; older backups are deleted automatically. Deleted data (including account deletion, records deleted one by one and trips whose data stays only on your phone) leaves the backups within 7 days at the latest. Backups are used only to restore the service after a failure. No backups are kept outside the server.
  • Data on your phone: stays on your phone until you sign out, delete your account or uninstall the app. Signing out and deleting your account remove the records and files on the phone (including the export file).
  • PDFs, letters and export files you share are under your control.

9. Your rights

Under Article 11 KVKK and Articles 15–22 GDPR you have the following rights:

  • Access and copy: Settings → Privacy → “Export my data” gives you your records, evidence files, seals and server attestations in a single ZIP file. Write to us for other server records (purchases, usage statistics).
  • Rectification: you can correct your profile and records in the app. A sealed piece of evidence cannot be changed; a correction is added as a new record linked to the old one.
  • Erasure: Settings → Delete account (details in the “Account and Data Deletion” text).
  • Withdrawing consent: you can turn usage statistics and AI permission off in Settings → Privacy.
  • Objection, restriction of processing and data portability: write to us.
  • Automated decisions: the app’s rights assessment is an information tool; it does not take automated decisions that produce legal effects concerning you.

Send your requests to destek@klaimira.com; we reply within 30 days at the latest. You can lodge a complaint with the Turkish Personal Data Protection Board or, in the European Union, with the data protection authority of the country where you live or work.

10. Family passengers’ data

  • If you add other passengers to your account, you enter their details. You are responsible for their accuracy and for informing those people about this notice. A parent or guardian enters the details of passengers under 18.
  • Passengers can also exercise their rights directly against us by writing to destek@klaimira.com.
  • Deleting a passenger does not delete the claims opened for them: the name in those claims is frozen as it was at the time of deletion and is used in letters and claim files; the passenger’s other details (email, address, IBAN, booking reference) are deleted. Letters you marked as “sent” and claim files (PDF) you already generated stay unchanged, with the details they contain.

11. Children

Klaimira is not directed at children. If you are under the age required to open an Apple or Google account, do not use the app; a parent or guardian uses the account for a child’s trip.

12. Security

Transfers are encrypted with HTTPS, session keys are stored on the server as hashes, the server exposes only the endpoints it needs and every endpoint is rate limited. Evidence is sealed with two layers of SHA-256; the server attestation is an Ed25519 signature. No system is completely secure; if a breach occurs we will inform you and the competent authority as required by law.

13. Changes

We may update this notice. When it changes, its version changes and the app asks you to accept the new version before you continue. The consents you have given are listed with their versions and dates in Settings → Privacy.