Privacy Policy

This Privacy Policy explains how BunkerIstanbul collects, processes, and protects personal and operational data.

1.Data Collected

We collect the following types of data:

• User identity and contact information
• Account credentials
• Vessel and operational data (IMO, ports, fuel inquiries)
• Usage logs and communications

2.Purpose of Processing

Your data is processed for:

• Platform operation
• Inquiry and offer workflows
• Notifications and emails
• Security and compliance

3.Legal Basis

Processing is based on contractual necessity, legitimate interest, legal obligation, and user consent (GDPR / KVKK).

4.Data Sharing

Data is never sold. It is shared with authorities when legally required. To run the platform, the services below receive the data listed with each:

• Supabase: our database, sign-in, file storage and server functions. Everything you enter or upload is stored and processed there.
• Vercel: hosts the website. It receives your browser's requests for the site (your IP address, browser details and the address requested) and cookie-free page-speed measurements (see section 8).
• Resend: sends our emails. It receives the recipient's email address and the content of each message, such as invitations, offers, and contract and delivery notices.
• OpenRouter and the AI model providers it passes text to: the text of the AI features. On the office side: offer text pasted into Magic Paste, voyage and cargo details for the voyage-planning advice, your procurement or sales figures for the dashboard advisor, and a request being compared (vessel name, port, fuel, quantity, ETA) with its offers (prices, delivery and payment terms, supplier ratings; suppliers are labelled A, B, C). On the crew side: the remarks of each new voyage diary entry, and the captain's comment when a voyage is closed, with the voyage's delays, planned strategy and profit and carbon variance. Free models (for example Meta Llama, Qwen and Nous Hermes) are tried first, and OpenAI GPT-4o mini is the paid fallback. OpenRouter passes the text to the company that runs the chosen model.
• Weather and map services, which your browser contacts directly and which therefore also see your IP address. Open-Meteo receives points along a planned route, for the wave forecast. OpenWeatherMap receives the arrival port's coordinates, for the arrival weather. OpenStreetMap's Nominatim receives a port name when the voyage planner has no coordinates for that port. Esri (ArcGIS Online) and OpenSeaMap receive the map tile requests of the voyage maps, which show the area on screen. When the deck journal weather is switched on, Open-Meteo also receives from our server, not your browser, the positions of a ship's journal hours rounded to about 6 nautical miles, the points of a planned route and the place and time of a reported weather delay.
• Push notifications. If you turn on browser notifications, your browser maker's push service delivers them, encrypted so that no one but your browser can read them. For the mobile app, each notification's title, text and link and the device's push token go to Expo, which passes them to Apple or Google.
• AISStream: while live vessel tracking runs, the MMSI numbers of the vessels on active voyages, to receive their position reports.
• In the mobile app: the live tracking map loads map tiles from Esri (ArcGIS Online) and OpenSeaMap and the map library from unpkg, which see the phone's IP address and the map area on screen. Voice input uses the phone's own speech recognition, which can send the spoken audio to Apple or Google to turn it into text.

Public sources our servers download data from (ECB exchange rates, EIA and EEX prices, the EU Publications Office and the Paris MoU) receive no data about you.

5.Storage & Security

Data is stored securely using encryption and access controls.

6.Retention

Data is retained only as long as required for operational or legal purposes.

7.User Rights

Users may request:

• Access to their data
• Correction of inaccurate data
• Deletion of their data
• Data portability

8.Cookies

Essential cookies are used for authentication and functionality; these cannot be turned off without breaking sign-in. We use no analytics or advertising cookies, no third-party analytics and no session recording. Our host measures page load speed without cookies (Vercel Speed Insights); this measurement is not sent from the journal, compliance and crew screens.

9.International Transfers

Our database is hosted in the EU (Sweden). Data may be processed internationally with appropriate safeguards.

10.Updates

Policy updates take effect upon publication.

11.Contact

Privacy inquiries: support@bunkeristanbul.com