Privacy Policy

Summary

Smartmic Pilot is a business asset and fleet tracking platform. Location data comes from tracking hardware the customer attaches to its own assets — not from your phone. The app never asks for location permission, shows no advertising, contains no analytics or tracking tools, and sells no data.

1. Data controller

Coretech İnovasyon Teknoloji LTD.. For requests and questions: furkan.orta@oemco.com.tr

2. Who uses the app

Accounts are created for corporate customers only; there is no self sign-up inside the app. Your account is created either by your own company administrator or by the platform operator. The app is not intended for individual consumers.

3. Data we process

Account information

Email address, password (stored only in hashed form), role, and the company you belong to.

Asset location data

Coordinates, measurement accuracy, battery status, the address text produced by the hardware provider, and timestamps — all received from the tracking hardware attached to the customer’s asset. This data describes the asset, not you.

Technical records

Which data arrived when, and whether it succeeded. Kept for diagnostics: the question “why was this asset not updated?” can only be answered from these records.

4. What we do not collect from your phone

The app requests no sensitive operating-system permissions. It does not access or collect:

• Your phone’s location (location permission is never requested)
• Camera, microphone, photos
• Contacts, calendar, call or message history
• Health or motion data
• Advertising identifiers; no cross-app tracking takes place

The only thing the app needs is network access. There is no ad network, no analytics, and no crash-reporting tool.

5. Purpose and legal basis

Data is processed solely to deliver the service: authentication, showing assets on the map and in lists, reporting entry into and exit from defined zones, and fault diagnosis. The legal basis is performance of the contract with the customer company and the legitimate interest in operating the platform securely. Data is not used for marketing, not sold, and not shared for advertising.

6. Sharing and service providers

Data is not shared with anyone other than the providers that make the service technically possible. Each sees only what its own function requires:

• Database and authentication: Supabase (servers located in the European Union)
• Web panel hosting: Vercel
• Map imagery: Esri / ArcGIS Online. Because map tiles load directly into your browser or phone, this provider sees your IP address and the map area you are viewing; your asset information is not sent to it.
• Address resolution: OpenStreetMap Nominatim. Only coordinates are sent; who made the query is not.

Data may also be disclosed to competent authorities where legally required.

7. Tenant separation

Each customer company’s data is separated at the database level. A user of one company can never see another company’s assets, locations, or users. When a tracking device is moved from one company to another, the location history from the earlier period is not disclosed to the new company.

8. Retention

• Location history: 24 months, unless a different period is agreed in the contract.
• Technical records: 90 days.
• Account information: for as long as the account is active; deleted when the account is closed.

9. Your rights

Under Turkish data protection law (KVKK, Article 11) and, where applicable, the GDPR, you have the right to learn whether your data is being processed, to request information about it, to have it corrected, erased, or its processing restricted, and to object to processing.

You can send requests to furkan.orta@oemco.com.tr. Since your account was created by your employer, raising the request with your own company administrator first will usually be faster.

10. Security

All connections are encrypted (TLS). Passwords are stored as irreversible hashes and never kept in plain text anywhere. Access is role-based, and authorisation is enforced at the database level rather than in the interface — so however a request is written, a user only ever receives rows belonging to their own company.

11. Children

The app is intended for business use and is not directed at people under 18. We do not knowingly collect children’s data.

12. Changes

If this policy changes, the date above is updated. Customer companies are notified separately of any material change.