Hadi · Privacy Notice

Last updated: 3 November 2026

This notice explains how your personal data is processed when you use the Hadi web app at heyhadi.com. It is both the information notice under Article 10 of Turkey's Personal Data Protection Law No. 6698 (KVKK) and the privacy notice under Article 13 of the EU General Data Protection Regulation (GDPR). Hadi is currently a closed, free beta.

1. In short

• Your trips, saved records, chat and documents stay only in your browser; they don't go to a server unless you share a trip.
• What does reach a server: your account (e-mail), what you send to the AI, short technical logs and trips you choose to share.
• No ads, no analytics, no tracking. We don't use cookies. Your data is not sold.

2. Controller

• Controller: Gezerken Kazan LLC (a limited liability company formed in Wyoming, USA; authorised person: Emre Durmuş)
• Address: 30 N Gould St, Ste R, Sheridan, WY 82801, USA
• E-mail (privacy and data protection requests): kvkk@heyhadi.com
• VERBİS (Turkish data controllers' registry): as a controller based outside Turkey, registration and the appointment of a Turkish representative will be completed during the beta

This notice covers the Hadi web app at heyhadi.com. The Hadi Chrome extension (formerly Trip Radar) has its own privacy policy. The sites you save, Google, Anthropic and the other services named below have their own privacy policies.

3. Account and sign-in

• E-mail sign-in: a sign-in link and a 6-digit code are sent to your e-mail address. Your e-mail address is processed for this. There are no passwords.
• Google sign-in: when you allow it, Google passes us your name, e-mail address, profile picture address and Google account ID. Your relationship with Google is governed by Google's own terms.
• Sign-in is provided by Supabase, which logs IP address, browser details and sign-in times to keep sessions secure. The session key is stored in your browser.
• Closed beta: the beta list holds your e-mail address and a short note to recognise you (e.g. your name). The AI is open only to accounts on the list.

4. What stays in your browser

Your trips, what was read from the links and pictures you saved, your notes, chat history, the documents you add (tickets, policies), your settings and profile are kept only in this browser (IndexedDB and localStorage). We can't see them and can't bring them back.

• Settings > Data > Export makes a backup; Restore from a backup brings it back. Files' contents are not in a backup.
• If you tick "Also delete the trips and files on this device" when you sign out, the data in this browser is deleted. Deleted records stay in your browser's trash for 30 days.
• Settings > Data > Delete my account deletes the data in this browser (the trash included) along with your account.

5. AI

Chat, suggestions and reading go through Hadi's AI gateway (Supabase, Frankfurt) to Anthropic's Claude models.

• What is sent: the messages you write; the content of links and pictures you drop into the chat (e.g. a screenshot of a booking confirmation); documents you ask it to read; the trip details needed for the answer (cities, dates, number of travellers, your records, notes and requirements).
• The gateway does not keep content. For each call it logs: time, user ID, model, which step asked (the first line of our own instructions, not what you wrote), the names of tools used, number of messages and pictures, request size, result and error message, token counts, estimated cost and duration. Daily requests and cost per person are also counted.
• Anthropic does not use content sent to its commercial API to train models and keeps it for a short period under its terms. We don't train models on your content.
• Everything visible in a screenshot or document (e.g. your name, a booking number) goes to the AI. Don't have it read a document you want to keep private (e.g. a passport page).
• Health and similar information: you don't need to enter health information (e.g. a wheelchair) or a diet in a trip's requirements. If you do, it is processed only for the suggestion you asked for and with your explicit consent; you can delete it at any time.
• The AI can be wrong. Hadi makes no automated decision about you with legal or similarly significant effects; it only makes suggestions.

Google Gemini is used only in the Hadi Chrome extension (with your own key or an invitation); on the web the AI is Claude.

6. Error log

If the page hits an error while you are signed in, a record is written with: time, your user ID, version, which part of the page, the error's name, its message (up to 300 characters) and the first lines of the stack. Your IP address, the page address, your trip and saved content are not put in this record; the message is shortened so content doesn't slip in. At most 50 records per user per day are written, and they are deleted after 90 days.

7. Sharing and lookups (through our server)

If you share a trip, the sharing server (Supabase, EU, Frankfurt) receives: the trip's settings (the travellers' names, number of people, children and rooms, where others travel from), the text of the pages and pictures you saved (up to 120,000 characters per record), their address and a reduced screenshot (about 150 KB at most), likes and reactions, members' names and small profile photos (128 pixels), and the last 200 versions of the shared settings (with who changed them and when). Anyone who knows the trip's secret code or link can access this data; share the link only with people you trust. Think before sharing records with personal details, such as a booking confirmation. "Stop sharing" only stops syncing on this device. "End sharing and delete from the server" in the Share window deletes the trip's server copy (saves, likes, profile photos, settings history) for everyone; the trip stays on this device. Shares opened before this version stay on the old server (Supabase, India, Mumbai); they will be moved to the EU later, and the same button deletes them there too.

Lookups go through a separate server for now (Supabase, India, Mumbai) and send only what the search needs; your name and e-mail are not sent, and the server doesn't store who asked:

• Suggestions: for flights, two airport codes, the day and number of travellers; for stays, the city, country, dates and number of travellers; for activities, the city, days, number of travellers and the card's name; for eSIMs, the country and days; for intercity travel, two cities and the number of travellers. Sources: Travelpayouts (Aviasales), RapidAPI (Tripadvisor), Xotelo, SerpApi and SearchApi (Google Flights / Google Hotels results), Google Places, Viator, our own flight price service (hosted at Hetzner); Airalo's and Omio's public lists are downloaded whole. Public results are cached by place and day so the same question isn't asked again.
• Transfers (Google Routes): two place names or addresses (possibly where you are staying) and the day. The result is not stored on the server.
• Flight status (AeroDataBox, via RapidAPI): only the number and day of a flight you have booked.
• Web search (Google Gemini with Google Search): only the search question (it may contain a place or event name). Results are cached for a few days; for the daily limit, your device's random ID and a one-way hash of your IP address are kept for 48 hours.
• City photos: the search word (e.g. "Lisbon") is asked of Unsplash, then Pexels if nothing is found.

8. Requests straight from your browser, and hosting

These services receive requests straight from your browser, with only what the task needs; like any web request, they see your IP address and browser details: OpenFreeMap (map tiles for the area on screen), OpenStreetMap Nominatim (the name of an address or place), Open-Meteo (the city's location and the trip's days), Frankfurter (a currency pair), Wikipedia / Wikimedia (place names and photos), Unsplash's and Pexels' image servers, Kiwi.com and Aviasales (a two-letter code for an airline logo), and the image servers of the sites you saved.

The site is served through Cloudflare, which processes connection details such as IP address, browser details and the requested address to run and secure the service.

9. Purposes and legal bases

Data is collected electronically through the sign-in form, Google sign-in, the chat and files you drop into it, and automatically for the logs.

10. Recipients and processors

We don't transfer your data to anyone in Turkey. We provide the service with these providers:

11. International transfers

None of our servers is in Turkey: Supabase (EU and India), Cloudflare, Anthropic and Google (USA and other). These transfers under Article 9 of the KVKK are made with the standard contracts published by the Turkish Data Protection Board (the providers' data processing agreements); signing them and notifying the Board is being completed during the beta. Only search details and shares opened before this version go to India. For transfers from the EU to countries outside it (USA, India), the European Commission's standard contractual clauses (SCCs) apply and, where the provider has joined it, the EU-US Data Privacy Framework. You can ask for a copy of the safeguards at kvkk@heyhadi.com.

12. Retention

When a period ends, the data is deleted or anonymised. When your account is deleted, the AI call log and error log tied to it are deleted and your e-mail leaves the beta list; the daily usage counter is de-identified (no longer linked to you, kept only for the total spend).

13. Storage on your device and cookies

We don't use cookies; there are no ads or analytics. Hadi uses only local storage that is strictly necessary for the service to work, so there is no consent banner:

• the session key (localStorage, sb-…-auth-token),
• your settings and small state flags (localStorage, trip-radar:local:…; sessionStorage),
• your trips and documents (IndexedDB, trip-radar),
• a copy of the page so it opens offline (Service Worker cache), and a request that the browser keep this data.

You can delete these with Sign out ("also delete on this device") or your browser's site data settings. Cloudflare may set a cookie that is strictly necessary for security. When you click an affiliate link, Travelpayouts and the site you go to set their own cookies.

14. Affiliate links

Some booking links are affiliate links. A page of a brand that is a Travelpayouts partner (such as Booking.com, Agoda, Trip.com, GetYourGuide, Viator, Aviasales, Airalo, Omio; a link you saved yourself included), opened from Hadi, passes through Travelpayouts' redirect (tp.media) as you click it and lands on the same page; Travelpayouts sees that page's address. The price doesn't change; if you book, Hadi may earn a commission. Booking management, confirmation, account and sign-in pages are never turned into affiliate links.

15. Age

Hadi is for people aged 18 and over. We don't knowingly process the data of anyone under 18; if you notice this has happened, write to us and we will delete it.

16. Your rights and requests

Under Article 11 of the KVKK you have the right to learn whether your personal data is processed and, if so, to request information about it; to learn the purpose of processing and whether it is used accordingly; to know the third parties in Turkey or abroad to whom it is transferred; to ask for it to be corrected if incomplete or wrong, and erased or destroyed under Article 7, and for these to be notified to those third parties; to object to a result against you arising solely from automated analysis; and to claim compensation for damage caused by unlawful processing.

If the GDPR applies to you, you also have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21), not to be subject to automated decisions (Art. 22), and to withdraw consent at any time.

Requests: write to kvkk@heyhadi.com from the e-mail address you use with Hadi. We reply free of charge within 30 days at the latest. You can delete your account yourself with Settings > Data > Delete my account, or ask for it to be deleted the same way; your account and the related records on the server are deleted, and the data in this browser too when you do it yourself. The server copy of trips you shared isn't deleted by this, as it's the other members' data too; delete it with "End sharing and delete from the server" in the Share window.

Complaints: in Turkey, to the Personal Data Protection Board (KVKK); in the EU, to the data protection authority of the country where you live.

17. Security

All connections are encrypted (HTTPS). Only an authorised server role can access the tables on the server. A shared trip is reached with a code that is hard to guess. No system is completely secure; if a data breach happens, we notify the Board, the supervisory authority and the people affected as the law requires.

18. Changes

If this notice changes, the date above is updated. Significant changes, such as a new kind of data or a new recipient, are also announced in the app or by e-mail.