ShopLens AI — Privacy Policy

Effective 12 August 2026 · BarbarOS Technologies LLC · Türkçe sürüm

1. Who is responsible

The ShopLens AI mobile application is operated by BarbarOS Technologies LLC, which is the controller under the GDPR and the veri sorumlusu under Turkish law (KVKK):

2. What we collect — the complete list

• Email address and password. To create and access your account. The password is never stored in clear text; only a bcrypt (cost 12) hash is kept. Legal basis: performance of a contract, Art. 6(1)(b).
• Your search queries. The product text you type is sent to our server to run the price search.
• Approximate location (latitude/longitude). Sent only if you grant permission, and only at the moment of a search, to filter offers to branches near you. Your location is never written to our database — it is discarded when the request ends. Declining the permission does not disable the app; only the distance filter is skipped. Legal basis: consent, Art. 6(1)(a), withdrawable at any time in system settings.
• Your watchlist. Products you track and any target price you set.
• Target prices and price alerts. If you set a target price for a product, we store it and create an alert record when a recorded price falls below it, to be shown inside the app. The record belongs to your account and is deleted with it. We do not send push notifications and do not collect the device token that would be required for them.
• Usage counters. A per-day count used to enforce request quotas — how many times you searched, not what you searched. Legal basis: legitimate interest in preventing abuse, Art. 6(1)(f).
• Server logs. IP address, timestamp, requested URL and client string, recorded as a technical necessity of serving the request.

3. What we do NOT collect

We can state these as facts because the app contains no code that does them:

• We do not access your photos or camera roll. The camera is opened only to scan a barcode; the frame is discarded after decoding, is never uploaded, and is never stored. The app has no gallery access.
• No advertising identifier (AAID/IDFA) and no ad network in the app.
• No analytics or behavioural tracking SDK (no Firebase Analytics, no Facebook SDK).
• No access to contacts, call logs, SMS or files.
• We do not sell your data and do not share it for advertising.

4. Who we share it with

• Price source — marketfiyati.org.tr. For Turkish grocery prices, your search term is forwarded to this service. No identifier of yours (email, user id) is sent — only the search text and, if permitted, coordinates.
• Product images. Product photos are hosted by the price source. We fetch them through our own server, so your device never connects to that host directly and your IP address is not exposed to it. Fetched images are cached, so the source is not contacted again for the same image.
• Hosting. Our server and database run in a data centre in Germany.

Because the company is registered in the United States, access to your data may constitute an international transfer. Such transfers rely on Standard Contractual Clauses (GDPR Art. 46) and, for Turkish users, on the mechanisms of KVKK Art. 9.

5. Retention

• Account data: for as long as your account exists; removed immediately on deletion (see §6).
• Watchlist: until you remove it or close the account.
• Usage counters: deleted with the account.
• Server logs: at most 90 days, then rotated.
• Price history: kept indefinitely — but it belongs to products, not to you. It contains no field pointing to any user, and deleting your account does not affect it.

6. Deleting your account and data

Two routes, both permanent and immediate:

• In the app: Settings → Hesabımı Sil (Delete my account). Requires your password and an explicit confirmation.
• Without installing the app: barbarostechnologies.com/shoplens/hesap-sil

Deleted: your account record, email, password hash, watchlist and usage counters. Not deleted: the product price history described above (not personal data) and server logs, which rotate within 90 days.

7. Your rights

Under GDPR Art. 15–22 and KVKK Art. 11 you may access, rectify, erase, restrict, port and object to the processing of your data, and withdraw consent where processing relies on it (location). Withdrawal does not affect the lawfulness of processing before it.

Requests: legal@barbarostechnologies.com. We respond within 30 days. You may also complain to your national data protection authority in the EU/EEA, or to the Turkish Personal Data Protection Authority (KVKK).

8. Children

ShopLens AI is not directed at children under 13 and we do not knowingly collect their data. If we discover such an account we delete it.

9. Security

All traffic is encrypted with TLS. Passwords are hashed with bcrypt (cost 12). Session tokens are held in the operating system's secure store (Android Keystore / iOS Keychain). No system is perfect; if a breach occurs and poses a risk to your rights, we will notify you and the relevant authority within the statutory deadline.

10. Changes

If we update this policy we change the effective date above, and we notify you in-app for material changes.

BarbarOS Technologies LLC · Last updated 12 August 2026 · Terms of Service · Account deletion