Privacy Policy

Last updated: 6 October 2026 · yournext.tours

This Privacy Policy has been prepared in order to explain and inform you how your personal data is processed under Personal Data Protection Law No. 6698 ("KVKK") when you use the Your Next Tours service.

The data controller is First Point Yazılım Limited Şirketi (providing services under the Your Next Tours brand). Address: Balgat Mah. Ceyhun Atuf Kansu Cad. No: 36 İç Kapı No: 6, Çankaya, 06520, Ankara, Türkiye. MERSIS No: 0386104970700001. Trade Registry No: 513972 (Ankara Trade Registry Directorate). Tax Office/No: Hitit / 3861049707. Registered electronic mail (KEP): firstpointyazilim@hs01.kep.tr. Contact: contact@firstpoint.com.tr, +90 505 794 47 75.

We collect your data electronically, while you use the service, through our website and panel, the guide (tour leader) mobile application and the participant web client. Each data category below is stated together with the legal ground on which it relies.

Account data: e-mail address, display name, organisation (company) name if any, language preference and profile image (avatar). This data is processed on the legal ground of the establishment and performance of a contract (KVKK Art. 5/2(c)).

Usage data: tour sessions and their durations, participant counts, rating scores and comments, and the name entered by the participant, if any. This data is processed on the legal grounds of the performance of the contract and our legitimate interest in measuring and improving service quality (KVKK Art. 5/2(c), Art. 5/2(f)).

Configuration data: wallet addresses (network and address), WiFi profile information (SSID and password) and tour templates. This data is processed on the legal ground of the performance of the contract (KVKK Art. 5/2(c)).

Support data: the content of and correspondence relating to the support requests you open. This data is processed on the legal grounds of the performance of the contract and our legitimate interest (KVKK Art. 5/2(c), Art. 5/2(f)).

Pre-tour check-in data: the name entered by the participant, phone model, headphone/power bank status and free-form notes. This data is processed on the legal ground of the performance of the contract (KVKK Art. 5/2(c)). We kindly ask that you do not enter special categories of personal data, such as health data or biometric data, into free-text fields such as support requests and check-in notes; these fields are not designed for the collection of special categories of personal data.

Payment data: If you purchase a paid plan or credits, your billing information such as invoice title, address and tax identification number is processed in order to fulfil our statutory invoicing obligation; this processing relies on the legal ground of compliance with a legal obligation (KVKK Art. 5/2(ç)). Payment transactions are carried out through payment institutions such as iyzico, PayTR or Polar; card data such as the card number, expiry date and security code is not stored by us. Such data is held by the relevant payment institution and is transferred to that institution solely for the purpose of executing the transaction (KVKK Art. 5/2(c), performance of the contract).

Mobile app analytics and advertising measurement data (only with your consent): usage events from the guide app (Google Analytics for Firebase), linked to an identifier tied to your account that contains no name or email address; selected app events sent to Meta (see section 5); and the device advertising identifier. On iOS the advertising identifier (IDFA) is read only if you allow tracking in the system dialog. On Android the Android advertising ID can be read only on Android 12 and earlier; on Android 13 and later the app does not have permission to read it. Analytics is off by default and is turned on only with your permission. Crash reports (Firebase Crashlytics: device model, operating system and app version, and technical error records) are on by default and can be turned off. Usage events, Meta events and the advertising identifier are processed on the basis of your explicit consent (KVKK Art. 5/1); crash reports on the basis of our legitimate interest (KVKK Art. 5/2(f)).

Website analytics data (only with your consent): if you allow analytics in the cookie preferences on yournext.tours, Google Analytics 4 collects the pages you view, where you came from (referring site and campaign parameters), scrolls, clicks on links leaving our site and file downloads, device and browser type, screen size, language, and an approximate location (city/country) derived from your IP address. Google places cookies containing a random identifier on your device (see the Cookie Policy). Your name, email address and account ID are not sent; link tokens in addresses and ad click identifiers are removed before anything is sent to Google. Analytics is off by default; if your browser sends a Global Privacy Control signal, you are not asked and analytics does not run. This data is processed on the basis of your explicit consent (KVKK Art. 5/1).

Network and audio quality diagnostic data: during and at the end of a live tour broadcast, the guide app and our broadcast servers record technical data about connection and audio quality. This covers the guide device's model, operating system and app version; tour duration and participant counts; audio packet and connection counters, the audio transport path used and 30-second quality samples; the local network's subnet pattern (e.g. 192.168.1.x), the local address of the network device (router) and the make/model derived from its administration page title; for listener devices (app or browser), the device model, operating system, app or browser version, connection quality counters (dropouts, reconnections, audio buffer state, network type) and, on Android, WiFi band, link speed and signal level; and connection events (join and leave times, disconnect codes). Each listener appears only under a random identifier created for that session, which cannot be matched to any other session. This data does not contain participant names, network names (SSID/BSSID), participants' IP addresses or location, and it is not linked to any participant. This data is processed on the basis of our legitimate interest in keeping broadcasts stable (KVKK Art. 5/2(f)).

Online live broadcast audio recording (diagnostics): for live broadcasts that a guide runs over the internet (online) through the app, the guide's broadcast audio may be recorded on our servers to diagnose technical faults. The recording contains only the audio the guide sends to the broadcast; no audio is captured from participants' devices, translation audio is not recorded, and local network (offline) tours are not recorded. Speech around the guide (for example participants' questions) may be audible in the guide's audio. The recording is accompanied by the times of connection interruptions during the broadcast. This processing is based on our legitimate interest in keeping broadcasts stable (KVKK Art. 5/2(f)).

Trip participant phone number (optional): when you join a trip in the app you can add your phone number. It is stored in your participant account, so that the app can suggest it next time, and in that trip's participant list. A guide can also add a participant's phone number to the list manually. This data is processed on the legal ground of the performance of the contract (KVKK Art. 5/2(c)).

Local tour WiFi details: if the guide runs a tour over their own local WiFi network and has selected a WiFi profile for that broadcast, the network name (SSID) and password are sent from the guide's phone to listeners' devices over that local network only, so that listeners can connect and show a WiFi QR code to invite others. This exchange does not pass through our servers. The listener app keeps these details only in memory while the tour is open and does not save them; if a listener chooses to join the network, the phone's operating system makes the connection. This data is processed on the legal ground of the performance of the contract (KVKK Art. 5/2(c)).

We process data in order to provide and maintain the service, manage your account, provide support, measure and improve service quality, and fulfil our legal obligations.

Mobile app analytics and advertising measurement: understanding how the guide app is used and measuring whether our own advertising campaigns on Google and Meta lead to app installs, sign-ups and subscriptions. This relies on your explicit consent (KVKK Art. 5/1; for users in the EU/EEA, GDPR Art. 6(1)(a)). Analytics is off by default. On iOS it is turned on if you tap Allow in the App Tracking Transparency dialog; on both platforms you can turn it on or off at any time in the app under Settings > Data & privacy > Usage analytics. Once you turn it off, nothing more is sent to Google or Meta; data already sent is not affected. On iOS you can also withdraw tracking permission in iOS Settings > Privacy & Security > Tracking. Crash reports keep the app stable (legitimate interest) and can be turned off on the same screen.

Website analytics: understanding how our website and the panel sign-in and sign-up pages are used, which channels visitors come from and which content works, and improving the site. This processing relies on your explicit consent (KVKK Art. 5/1; GDPR Art. 6(1)(a) for users in the EU/EEA). You can withdraw it at any time from the “Cookie preferences” link at the bottom of every page; when you do, the Google Analytics cookies are deleted and no new data is sent, while data already sent is not affected.

Network and audio quality diagnostics: measuring the stability of live broadcasts on the local network and through our servers, understanding the causes of dropouts and delays by network hardware and device type, and improving the service, based on our legitimate interest (KVKK Art. 5/2(f)). This data is used only for technical analysis and is not shared with third parties.

Online live broadcast audio recording: identifying and fixing audio dropouts, delays and distortion in online broadcasts by listening to them; based on our legitimate interest (KVKK Art. 5/2(f)). Recordings are not used for marketing, profiling or training artificial intelligence models and are not shared with third parties. Only authorized technical staff can access recordings, and every access is logged.

Trip participant phone number: letting the guide running the trip reach you, for example during roll call or if you get separated from the group. Giving a number is optional; it is processed to provide the trip service you joined (KVKK Art. 5/2(c)). For the trip's participant list, the tour company or guide running the trip is the data controller and we process the list on their behalf (see the KVKK Disclosure Notice).

Local tour WiFi details: letting listeners connect to the tour network and invite others. This is part of the tour service that the guide sets up (KVKK Art. 5/2(c)).

Processing relies on the establishment and performance of a contract (KVKK Art. 5/2(c)), compliance with our legal obligation (KVKK Art. 5/2(ç)), our legitimate interest (KVKK Art. 5/2(f)) and, where necessary, your explicit consent (KVKK Art. 5/1).

For example, your account and subscription data is processed on the basis of the performance of the contract, your billing data on the basis of a legal obligation, and the channel measurement data described in Section 8 on the basis of our legitimate interest.

Mobile app analytics and advertising measurement, including the transfer of this data abroad to Google and Meta, rely on your explicit consent (KVKK Art. 5/1 and Art. 9/6(a)). You can withdraw it at any time in the app under Settings > Data & privacy.

Website analytics, including the transfer of this data abroad to Google, relies on your explicit consent (KVKK Art. 5/1 and Art. 9/6(a)). You can withdraw it at any time from the “Cookie preferences” link at the bottom of every page.

For the purpose of providing the service, your data may be shared with hosting and infrastructure providers, our e-mail delivery service provider and, where used, payment institutions. These providers act in the capacity of data processors, solely in accordance with our instructions and under contractual security obligations.

Some recipients, such as our hosting/infrastructure provider and our e-mail delivery service provider, are established abroad. Pursuant to Article 9 of the KVKK, such transfers are carried out on the basis of one of the appropriate safeguard mechanisms provided for in Article 9 of the KVKK, such as the execution of the standard contract published by the Personal Data Protection Board, transfer to a country affording an adequate level of protection, or, where necessary, your explicit consent. Where a payment institution is used, the transfer to that payment institution is likewise made solely for the purpose of executing the transaction and in accordance with one of the safeguard mechanisms set out above.

Google LLC (United States) acts as a processor for the mobile app analytics and advertising measurement described above (Google Analytics for Firebase, Firebase Crashlytics, Google Ads measurement) and for website analytics (Google Analytics 4). Data is shared with Google for that measurement only; we do not sell it and do not share it with data brokers.

Meta: if you have turned usage analytics on, the Meta SDK in the guide app sends app events to Meta Platforms Ireland Limited (Ireland) and Meta Platforms, Inc. (USA) so that we can measure our Meta ad campaigns. These events are: completed sign-up (with the sign-up method), completed onboarding (with the chosen role), started subscription checkout (with the billing period), started a broadcast, and started listening (with the connection type). The SDK also automatically logs app installs, app launches, and in-app purchases and subscriptions together with the product, price and currency. With these events Meta receives the device advertising identifier (on iOS only if you allowed tracking; on Android only where the device makes it available, see section 2), an app-specific anonymous identifier created by the SDK, technical device details (such as model, operating system and app version, language and time zone) and your IP address. We do not send your name, email address, phone number or account ID to Meta. Meta uses this data to provide measurement to us and, under its own terms and privacy policy, also for its own purposes such as improving its advertising systems; for those purposes Meta is an independent data controller. Meta decides how long it keeps this data (facebook.com/privacy/policy). If you have a Facebook or Instagram account, you can review and disconnect activity that apps share with Meta under Accounts Center > Your information and permissions > Your activity off Meta technologies.

Transfers abroad (Google and Meta): Google LLC and Meta are established outside Türkiye (USA and Ireland). The transfers made for mobile app analytics, advertising measurement and website analytics rely on the explicit consent you give for this transfer when you turn the relevant analytics on (KVKK Art. 9/6(a)) or, to the extent they are in place, on the appropriate safeguards provided for in KVKK Art. 9 (such as standard contracts). The receiving countries may not offer the same level of protection as Türkiye; you can withdraw your consent at any time as described in section 3. For users in the EU/EEA, transfers to the USA rely on the EU-U.S. Data Privacy Framework, in which Google LLC and Meta Platforms, Inc. participate.

Trip guide: the phone number you add when joining a trip is visible only to the guide running that trip, in their app and panel, so that they can call you about the trip. It is not shown to other participants and we do not use it for marketing.

Tour listeners: when a guide runs a tour on a local WiFi network, the network name and password of the selected profile are shared only with the listeners connected to that network, as described in section 2.

In order to ensure the security of your data, we apply appropriate technical and administrative measures, in particular encryption, access control and the principle of least privilege.

We retain personal data only for as long as necessary for the purposes of processing and for the periods prescribed by the applicable legislation. The retention period may vary according to the data category (for example, billing data is retained for the period prescribed by the applicable tax legislation). Once the period expires, the data is deleted or anonymised.

Network and audio quality diagnostic reports, being technical data that does not identify a person, are retained without a fixed time limit for as long as the purpose of improving the service continues.

Trip phone numbers are kept in your participant account and in the trip's participant list for as long as your account exists. When you delete your account, the number is removed from your account and from every trip list it appears in. You can ask us to delete it earlier at contact@firstpoint.com.tr.

Connection event logs that our broadcast servers keep for diagnostics are deleted after 180 days. Data sent to Meta is kept by Meta under its own retention policy.

Online live broadcast audio recordings are kept for at most 14 days and are deleted automatically at the end of that period. When a guide account is deleted, the recordings belonging to that guide are deleted immediately.

Website analytics data is kept in Google Analytics for 14 months and then deleted automatically. The Google Analytics cookies in your browser last up to 2 years and are deleted when you withdraw your consent.

Pursuant to Article 11 of the KVKK, as a data subject you have the following rights: (a) to learn whether your personal data is processed, (b) to request information if it has been processed, (c) to learn the purpose of processing and whether the data is used in accordance with that purpose, (ç) to know the third parties to whom the data is transferred domestically or abroad, (d) to request rectification if the data has been processed incompletely or inaccurately, (e) to request erasure or destruction of the data within the conditions set out in Article 7 of the KVKK, (f) to request that the actions taken pursuant to subparagraphs (d) and (e) be notified to the third parties to whom the personal data has been transferred, (g) to object to a result to your detriment arising from the analysis of the data exclusively by automated systems, (ğ) to claim compensation if you suffer damage due to unlawful processing. Your applications are concluded free of charge within 30 days at the latest, depending on their nature.

You can delete your account yourself from inside the app or from the panel; if you cannot sign in, you can request deletion at yournext.tours/account-deletion. That page also lists what is deleted, what is kept, and for how long.

You can delete your account from the panel. You may submit requests relating to the rights set out above to contact@firstpoint.com.tr.

The website uses no tracking for advertising. Website analytics with Google Analytics 4 runs only with your consent (sections 2, 3, 4, 5 and 6); the mobile app's analytics and advertising measurement are described in the same sections. We store strictly necessary data in your browser in order to keep you signed in (dw_refresh, dw_remember); this storage does not require consent.

To measure which channel brought you to us, we also store first-party channel measurement data (dw_attr_first, dw_attr_last): the first page you visited, the referring site and (if you arrived via a campaign or referral link) the campaign parameters and the referral code. This relies on our legitimate interest (KVKK Art. 5/2(f)), does not identify you and is not shared with third parties. We do not read or store ad click identifiers; see our Cookie Policy for the full list.

For analytics cookies a cookie consent banner is shown on your first visit; “Reject” and “Accept analytics” are offered in the same way, and you can change your choice from the “Cookie preferences” link at the bottom of every page. Your choice is stored in your browser under the dw_consent key; see our Cookie Policy for details.

You can reach us at contact@firstpoint.com.tr with any questions regarding this policy.