Cart Rush Privacy Policy

Last updated: 2026-10-16

This policy explains how personal data is processed in the Cart Rush ikas app provided by Yunus Acar ("Cart Rush", "we").

1. Roles

• Store owner (data controller): The ikas store that installs Cart Rush. Data of visitors who play the game and claim coupons is processed on behalf of the store owner. The privacy notice for visitors is the store owner's own notice under the Turkish Personal Data Protection Law No. 6698 (KVKK) and is shown as a link in the game.
• Cart Rush (data processor): We process this data only on the store owner's instructions and in order to provide the service.
• The store owner's own data: We are the data controller for the store name, the store owner's email address and region, which we receive from ikas when the app is installed.

2. Data we process

Visitors (game and coupons):

• Email address, mobile phone number and optional name entered in the coupon form
• Acknowledgement of the KVKK privacy notice and a separate, optional consent to commercial messages; time of consent, text version, IP address and browser information
• Game records: start time, game inputs (for score verification), distance; a random identifier for the device and a one-way hash of the IP address (abuse prevention)
• The coupon code issued and whether the coupon was used in an order (order number and amount)

Store owners: store name, email address, region, ikas access tokens (over an encrypted connection, kept on the server only), plan and payment status.

3. Purposes and legal bases

• Running the game, verifying scores against cheating and generating coupons (performance of a contract, legitimate interest)
• Enforcing the coupon limit per person and per device and preventing abuse (legitimate interest)
• Keeping proof of consents (legal obligation)
• Passing the details of people who consented to commercial messages to the store owner (explicit consent)
• Sending plan and trial notifications to the store owner (performance of a contract)

4. Transfers and sub-processors

We do not sell data or use it for advertising. We work with the following providers to deliver the service:

• ikas (store, coupon and order data, Türkiye)
• Vercel Inc. (application hosting, EU/Frankfurt region)
• Neon Inc. (database, EU/Frankfurt region)
• Resend (notification emails to store owners)
• Sentry (error logs; configured so that they contain no visitor data)

Because the data is stored on servers in the European Union, it is transferred abroad. This transfer is carried out under Article 9 of the KVKK using standard contracts and the required notifications. Where the EU General Data Protection Regulation (GDPR) applies (for example, for stores or visitors in the EU), transfers to sub-processors outside the EU are safeguarded by the European Commission's standard contractual clauses.

5. Retention

• Visitor data is kept for as long as the store uses the app and can be exported by the store owner as a CSV file.
• When the app is uninstalled, the store's visitor, game and coupon data is deleted within 72 hours at the latest.
• Rate-limit records are kept for a short time and deleted automatically.

6. Security

All connections are encrypted (HTTPS). Access tokens are kept on the server only, and each store's data is kept separate from all others. Coupon codes are generated only on the server, after the score has been verified.

7. Your rights

For your rights under Article 11 of the KVKK (and, where the GDPR applies, your rights of access, rectification, erasure, restriction, data portability and objection, as well as your right to lodge a complaint with a supervisory authority):

• If you are a visitor: please contact the store where you claimed the coupon first. The store owner will request our support.
• If you are a store owner: you can write to info@itsyunusacar.com.

8. Contact

Yunus Acar · Türkiye · info@itsyunusacar.com