Tekno Portal Privacy Policy

A separate privacy policy applies to the Windows version installed from the Microsoft Store: Tekno Portal — Microsoft Store edition. This page applies to the iOS and Android versions and to the Windows version distributed directly by the company.

This Privacy Policy explains what information the Tekno Portal application (the “App”) processes about its users, the purposes it is used for, who it may be shared with, and how it is protected. The policy applies to the iOS, Android, and Windows versions of the App.

Tekno Portal is a B2B self-service application for customers of Tekno İklimlendirme. A customer can review their own account, balance, invoice and payment activity, orders, and quotes, pay by card, and place orders from their own product catalog. Each account can only reach data belonging to its own set of customer accounts; no other customer's data is visible.

Accounts cannot be created in the App. User accounts are set up by Tekno İklimlendirme, and credentials are provided through a sales representative.

1. Summary

The App contains no advertising, no advertising identifier, and no third-party tracking or analytics SDK.
Firebase Crashlytics is used for crash diagnostics only; usernames, customer account details, balances, and card data are never sent to it.
No location, camera, microphone, contacts, or sensor permission is requested.
Card details are never saved on the device; payment completes on the bank's 3D Secure page.
The session runs on a time-limited access token stored encrypted on the device. On the Windows and iOS versions, so that your session can continue the next time you open the app, your user name and password are also stored encrypted on your device; they are never sent to a server or a third party, and they are deleted when you sign out. On the Android version the password is not stored on the device.
The IBANs and addresses you enter under Profile are never sent to the server and stay on your device only.
The commercial data the App processes is the data of your own customer account.

2. Data Processed

Account and Session Data

Username and password (transmitted to the server in the sign-in request)
User ID, full name, and role
The customer account code linked to the login and its access permissions
Session token and its expiry

The session is kept locally on your device with a secure access token. On the Windows and iOS versions, so that your session can continue the next time you open the app, your user name and password are also stored on your device: on Windows they are encrypted with the Windows data protection mechanism (DPAPI) and can be decrypted only by the same Windows user; on iOS they are held in the Keychain, marked valid on this device only and never synced through iCloud. On both versions this data is never sent to a server or a third party, and it is deleted when you sign out. On the Android version the password is not stored on the device; there, session continuity relies solely on the time-limited session token.

Account and Financial Data

Customer account code, trade name, and display name
Balance, debit, and credit status
Account activity (statement) history
Invoice details, invoice line items, and invoice PDF documents
Collection receipts and records of past card collections
Billing details: trade name, address, district, province, tax office, tax number, phone, and email

On the billing details screen, only the address, district, and phone fields can be updated by the user. Trade name, tax office, tax number, and province cannot be changed from the App.

Order, Quote, and Product Data

Product information from your own catalog and per-product price queries
Orders you create and their line items
Pending orders and quote records
Your own past product (stock) activity

The order request body carries neither the price nor the customer account code — the server derives both. A single-use request identifier generated for each basket prevents the same order from being recorded twice.

Card Payment Data

Cardholder name, card number, expiry date, and CVV (only at the moment of payment)
Payment amount, number of installments, and the account the payment is booked to
Payment result: transaction number, date, amount, bank authorization code, card type, and the last four digits of the card number

Data Kept on the Device Only

Your own IBAN and location records. The bank account and address entries you add under Profile are never sent to the server; they are kept only in the App's private storage on the device. These records contain no coordinates — the map is searched using the address text you typed.
Downloaded product catalogs (PDF) and the statement, invoice, and receipt documents you view
Unfinished order drafts and temporary input in the calculation tools
Simple app preferences, such as whether the “What's new” screen has been shown

Technical Data

App version and application identifier (sent so the server can enforce its minimum version check)
Network connectivity status (read on the device only, to tell “no internet” apart from “server unreachable”)
Technical information captured at the moment of a crash: the error log (stack trace), device model, operating system version, app version, and the time of the crash (sent only to the crash reporting service; see Section 5)

The App uses no usage analytics, screen tracking, or telemetry service, and collects no advertising identifier. Device model and operating system version are transmitted only when a crash occurs, to the crash reporting service for diagnostic purposes; they are not sent to the company's own server.

Permissions Not Requested

The App does not request access to location, camera, microphone, contacts, calendar, health, or sensor data, and does not collect such data. On Android, only the internet and network-state permissions are declared. Map links shown in the App open the device's map application with an address string, without reading the device's location.

3. Purposes of Processing

Authenticating the user and managing the session
Showing the user only the data belonging to their own customer accounts
Presenting statements, balances, invoices, and collection information
Running order and quote workflows
Initiating and completing card payments and generating the collection receipt
Downloading and viewing product catalogs and documents
Running the term-difference and discount calculation tools
Checking the minimum app version and showing an update prompt when required
Enforcing permission-based access control
Monitoring app stability and reviewing crash reports to diagnose and fix errors

Data is not used for advertising, ad targeting, profiling, or third-party marketing.

4. Card Payment and 3D Secure

Card payments complete through the 3D Secure flow operated by the bank. The process works as follows:

Card details are entered in the payment form and sent over HTTPS to the company server (api.teknoiklimlendirme.com), which opens the 3D session with the bank's virtual POS infrastructure.
The verification step completes on the bank's own page, inside a secure browser component within the App. SMS verification codes and similar information belong to the bank; the App does not read them.
The card number, expiry date, and CVV are never stored on the device: they are not written to disk, not backed up, not written to logs, and not held in any persistent store while moving between screens. They exist in memory only for the duration of the payment request and are cleared once it is sent.
After payment, the server retains only the transaction record and the last four digits of the card number. The full card number and the CVV are not retained.
Screenshot and screen-recording protection on the screens where card details are entered and shown differs by platform: on Android, screenshots are blocked; on iOS, sensitive areas are masked when screen recording or mirroring is detected (iOS offers no interface for blocking screenshots, so the protection there covers recording and mirroring only). The Windows version has no screenshot or screen-recording protection on these screens.
The App offers no card-on-file feature for reusing a card in later payments.

The entries listed on the “My cards” screen are past collection receipts booked to your account. They contain no card credentials — only date, amount, installments, bank, and, where available, the last four digits of the card.

5. Advertising, Analytics, and Tracking

Tekno Portal shows no advertising and uses no ad network or social media tracking SDK.

The App uses the Google Firebase Crashlytics service to monitor its stability. This service collects the error log (stack trace) recorded at the moment of a crash, the device model, the operating system version, the app version, and the time of the crash. The information collected is used solely to diagnose and resolve errors; usernames, customer account details, balances, and card data are not collected in this scope and are never transmitted to Crashlytics.

The App does not use Firebase Analytics or Firebase Cloud Messaging, and no advertising identifier (Advertising ID) is collected. The App contains no push notification infrastructure and processes no device notification token.

On iOS, the Apple Advertising Identifier (IDFA) is not collected and App Tracking Transparency permission is not requested. The App's PrivacyInfo.xcprivacy manifest declares that no tracking takes place; the only declared data type is the user ID, processed for authentication and app functionality. On Android, the Google Play Services advertising ID is not used.

6. Data Transfer and Sharing

The App transmits account, customer, financial, and order data only to the company's own server at api.teknoiklimlendirme.com, over HTTPS. The sole exception is the technical error data sent to the crash reporting service listed below. Data is not sold or transferred to third parties for marketing purposes.

Banks and virtual POS providers: card payments run through the relevant bank's 3D Secure infrastructure. Card and transaction data is transmitted to the bank, which acts as a separate data controller under its own privacy policy.
App stores: distribution and updates are handled by the App Store, Google Play, and the Microsoft Store. Data related to downloads and updates is subject to the respective store provider's policies.
Map application: tapping a link on the location screen opens the device's map application with an address string. From that point the map provider's privacy policy applies; the App neither reads nor transmits the device's location.
Crash reporting: Google Firebase Crashlytics (technical error data only; see Section 5).

7. Data Security

All server communication uses HTTPS (TLS); cleartext HTTP connections are not permitted.
Requests are authorized with a server-validated API key (x-api-key) and, for signed-in users, a time-limited session token (Authorization: Bearer).
Session data is held in platform-specific secure storage: an encrypted preference store on Android, the Keychain on iOS (this-device-only, with iCloud sync disabled), and the operating system's data protection (DPAPI) mechanism on Windows.
The user name and password kept for silent sign-in are held in a record separate from the session token and are separately encrypted: on Windows in a separate file, again with the Windows data protection mechanism (DPAPI) and decryptable only by the same Windows user; on iOS in a separate Keychain entry, marked valid on this device only. This record is deleted when the user signs out. On Android the password is never stored; there, session continuity relies solely on the time-limited session token.
On Android, session data is excluded from cloud backup and device transfer; on iOS, the session token is not synced through iCloud.
File sharing is narrow and controlled: only the downloaded catalog and document folders are exposed for sharing, and areas holding session data cannot be shared.
On the server, every request is validated against the set of accounts the user may reach; a request for an account outside that set is rejected.

8. Data Retention

Session data stored on the device becomes invalid when the user signs out or when the session token expires; removing the App deletes all local data from the device. On the Windows and iOS versions, the user name and password kept for silent sign-in are not deleted when the token expires — continuing the session in exactly that situation is the purpose of silent sign-in; that record is deleted when the user signs out.

Downloaded catalogs are kept persistently on the device, while statement, invoice, and receipt documents are kept in a temporary cache that the operating system may clear.

Because the IBAN and address records you enter under Profile are held on the device only, they are lost when the App is removed or the device is replaced; they are not synced between devices.

Commercial, financial, and operational data on the server is retained in line with the company's internal retention policies and applicable legal obligations (for example, legislation on the retention of commercial books and records).

9. Account Creation and Closure

New accounts cannot be created in the App; accounts are set up by Tekno İklimlendirme. To request closure of your account or suspension of your access, contact your sales representative or use the contact addresses below. Closing an account does not prevent commercial and financial records from being retained in company systems for their statutory retention periods.

10. User Rights

Users can:

Sign out of the App to delete the session data stored on the device.
Remove the App to clear all local data from the device.
Delete the IBAN and address records they entered under Profile at any time.
Submit requests to access, correct, or delete their personal data, or to object to its processing, to the data controller. Requests are handled in accordance with applicable legislation.

11. Children's Privacy

This App is intended solely for authorized users of corporate customers. Data is not knowingly collected from individuals under the age of 18.

12. Changes to This Policy

This Privacy Policy may be updated as new modules are added to the App. The updated version is published on this page and the “Effective date” is revised. Significant changes may be announced in the App or through the company's official communication channels.

13. Contact

Company / Data Controller: Tekno İklimlendirme
Email: info@teknoiklimlendirme.com
Web: teknoiklimlendirme.com

Technical Developer: Mehmet Gümrah
Email: support@mgumrah.com
Web: mgumrah.com