Couriero · 2026-11-02-retention-draft

Personal data policy

How Couriero uses visitors’ and members’ data.

Draft status and contact

This is a draft. The owner has not supplied the controller’s legal name, correspondence address or email. The policy is not legally finalized. Contact the owner via Telegram @kuryero_com. Do not send passports, passwords or payment details to support.

Data used

Bot sign-in supplies a Telegram ID, private chat ID, display name and username. The website retrieves a Telegram profile picture and converts it to a small WebP without original metadata. It stores listings, routes, dates, categories, declared weight, text, selected WhatsApp/Telegram contacts, responses, favorites and settings. Do not include document numbers, diagnoses or other sensitive information in descriptions.

Purposes

Data is used for sign-in, listing management, search, administrator moderation, selected notifications and delivering responses. A contact click does not confirm delivery. Country-specific purposes and lawful bases must be finalized by the controller. This draft does not replace separate consent where required.

Visibility

Published listings show the author’s display name and listing information. Profile pictures appear only when enabled. Contacts are available to signed-in users only when the author enables that method. Sending a response requires separate confirmation to share your Telegram with its recipient. The moderator sees listing details and enabled contacts. Publish only information you are entitled to share.

Providers and storage locations

The app is hosted on Vercel. Neon PostgreSQL and private avatar storage are configured in Frankfurt, Germany. Vercel operates a global delivery network and technical logs. Telegram handles sign-in confirmation and selected notifications. WhatsApp and Telegram also apply their own policies when opened. The owner being in Türkiye does not mean data is stored in Türkiye or Russia. Localization and international transfer requirements remain unresolved.

Cookies, drafts and location

Only necessary sign-in cookies are used: up to 5 minutes for a login request and up to 7 days for a session. Theme, language, catalog layout and drafts are stored on your device. Drafts older than 7 days are removed when next accessed. The app has no advertising analytics or marketing cookies. “My city” requests device permission only when selected; coordinates are used locally to choose a city and are not sent to Couriero’s server.

Deleting data

Use My listings → Profile settings → Delete account and data. The live profile, listings, associated responses, favorites and sessions are removed immediately. To investigate substantiated complaints and protect rights, a private encrypted archive retains the account identity and contacts, up to 100 latest listings and up to 100 own responses for 30 days. Only the authorized administrator can access it, with an audit record. It is excluded from search. Login tokens, sessions and photos are not archived. Avatar removal is retried in a durable queue. Drafts are cleared on this device; clear other devices separately.

Deletion limits and retention

Archive access stops at 30 days; physical purging runs in daily maintenance. The controller must establish the necessity, proportionality and applicable legal basis; this is not blanket permission to retain personal data. Contact support to request restriction or earlier erasure. A substantiated ban separately retains a keyed Telegram identity hash until the ban is lifted, to prevent the same Telegram account signing up again. This is pseudonymized data, not anonymous data. Minimal erasure and administrator audit records are separate; applicable KVKK erasure-operation records have a minimum three-year period. Other people’s messages, screenshots and provider backups are not instantly erased; provider retention periods still require confirmation.

Requests

Contact the administrator to request access, correction, discontinuation of optional notifications or deletion. Verify identity using your linked Telegram account; do not send passport copies in chat. Disable notifications in settings or with /notifications_off in the bot. Controller details and legally required request channels must be added before legal finalization.