Privacy notice

What we collect, why we are allowed to, and what we never do.

Section 1 covers the Maltayard app and this website. Sections 2 to 7 cover the app. Sections 8 and 9 cover this website: the waiting list, and the form for reporting illegal content.

1. Who we are

Maltayard is run by ITECHIN E-TİCARET LİMİTED ŞİRKETİ, Fenerbahçe Mah. İğrip Sk. No: 13 İç Kapı No: 1, Kadıköy, İstanbul, Türkiye, the controller of your data.

For anything about your data, write to info@maltayard.com.

2. What we collect

Your phone number, to make the account and prove it is yours.

Your locality, to put what is near you first. Never your exact position, and no history of where you have been.

Your listings, chats and offers. These are the service itself.

Reviews, so people can judge who they are dealing with.

Your name. Others see your first name and the first letter of your surname.

A photo and an email address, if you add them. Others never see your email address, only that it is confirmed.

That you sell as a private individual, and when you said so.

A meeting spot you share in a chat is kept with the chat.

Photos lose their location and camera details when you upload them.

Reports and help requests you send us, and the listings, searches and people you save or follow.

A report that someone did not turn up to a meeting, with the chat and the offer it is about.

Your phone’s address for notifications, with its system, app version and language.

3. What we never do

No marketing messages. Notifications are only about your own account, listings, offers, chats, reviews, what you have saved, and the reports and help requests you send us.

We do not sell your data.

We never show a no-show report on a profile.

No tracking, no advertising SDKs, no advertising identifiers.

We do not read or scan chats. If you report a chat, you choose the messages to send us, and a person on our team reads only those. A chat is opened only when the law or an authority requires it.

When you report a chat, we keep a copy of the messages you chose with your report, for as long as the report, a decision based on it, or a challenge of that decision can still be acted on — then we delete it. The person you reported is not told.

Your phone can tell when you are arranging to meet, so it can show a safety reminder. That check happens on your phone and nothing reaches us.

We never ask for an identity document.

We never ask for your contacts or your microphone, and never use your location in the background.

Your phone number is never shown to another person unless you share it in a chat.

4. Why we are allowed to

Everything above is what the service needs to run, so the basis is the contract between you and us, not consent. A chat kept as evidence rests on the law, or on our interest in legal claims.

We do not ask you to tick anything because we do not process anything that would need it.

5. How long we keep it

A listing stays live for 60 days, then it comes down.

When our team takes your listing down, we keep its photos out of public view for six months, and for as long as a request to look again is waiting for our answer. If we got it wrong, the listing comes back with them; if not, we delete them.

An offer expires after 48 hours.

Notifications are deleted after 180 days.

A photo you upload but never use, in a listing or as your profile photo, is deleted after a week.

If someone says you did not turn up, we tell you, and you can say you did meet.

Say it within 7 days and it is not counted unless a person on our team decides otherwise.

We keep a no-show report as we keep every report, also after an account is closed.

Chats are deleted two years after the last message. A chat that is part of a report, a moderation decision, a request from an authority or a dispute is kept until that is closed — six months after our decision, two years after we close an account for good — even if you close your account.

Close your account and, seven days later, we delete what we hold — except your number, kept for a year in a form we cannot read back, and a chat we keep as evidence.

We keep a chat beyond two years only to establish, exercise or defend legal claims, or because the law or an authority requires it. While we keep it, nobody uses it for anything else.

6. Your rights

You can see what we hold, correct it, or have it deleted. Raise a request in Help and a person here answers.

You can also complain to the Information and Data Protection Commissioner in Malta, idpc.org.mt.

7. Advertising

If we ever show an ad it is chosen by what is on the screen, never by who you are, and it is marked Ad.

8. The waiting list

What we keep: your email address; whether you ticked “I have something to sell”; which version of the sign-up text you agreed to, and when. Nothing else: no name, no phone number, no location. The form for reporting illegal content keeps more; see section 9.

Why, and on what basis: to send you one email when the app is in the stores, and to know roughly how many people want to sell. The basis is your consent (GDPR Article 6(1)(a)). You can withdraw it at any time.

How long: until we send that email; then we delete the list. [If the app has not launched by (date), we delete it then.]

Who else handles it: Cloudflare hosts this site, runs the check that you are not a bot (Turnstile) when you sign up, and passes your sign-up on to our server. Fly.io runs that server in Frankfurt (EU). Neon keeps the list in a database in the EU. Twilio SendGrid (Twilio Inc.) sends the two emails of section 9, from [its servers in the United States or in the EU: the founder’s choice]. [The launch email: through Twilio SendGrid as well, or another way? The founder to confirm.] We do not sell your email or use it for advertising.

ITECHIN, the controller, is in Türkiye, outside the EU.

[LAWYER: The controller is in Türkiye. The list is stored by Neon (EU) and passes through Fly.io (Frankfurt, EU) and Cloudflare (global network); all three are US-headquartered. Is making it available to ITECHIN in Türkiye a transfer under GDPR Chapter V, on what basis (no adequacy decision; SCC module 4?), does KVKK apply as well, and how should this paragraph say it? Also: to send the launch email the list is downloaded to a computer whose country is not fixed. Twilio SendGrid (US-headquartered) sends the emails; in its global region the data is in the United States.]

Your rights: you can ask to see, correct or delete your sign-up, and withdraw your consent. If you think we got something wrong, you can complain to the Information and Data Protection Commissioner in Malta (idpc.org.mt).

9. If you report illegal content

Anyone can tell us that something on Maltayard is illegal, through the form for reporting illegal content. This section covers what that form keeps.

What we keep: the link or reference you give, what is illegal and why, your name, your email address, and that you ticked the good-faith statement. The link or reference is kept as you wrote it, so that the person handling the report can read it at a glance. Your explanation, your name and your email address are kept encrypted. We do not keep your IP address with it.

Who sees it: a person on our team reads the link or reference and your explanation, and decides. Your email address is opened only to send you two emails: a receipt with your reference at once, and our decision later. Your name is not shown to anyone. The person you report is never told who you are.

Who else handles it: the same as for the waiting list in section 8. Cloudflare runs the check that you are not a bot and passes the form on to our server, Fly.io runs that server in Frankfurt (EU), Neon keeps it in a database in the EU, and Twilio SendGrid sends the two emails.

[LAWYER: On what basis do we keep a notice (GDPR Article 6(1)(c), the Digital Services Act Article 16?), and for how long? Nothing deletes a notice yet; the other moderation records are planned to be kept for three years. Which of the rights in sections 6 and 8 apply to a notice, and how should this section say it? Consent is not its basis, and deleting a moderation record may be limited.]