App privacy notice
Last updated: 2026-12-01
1. Who we are
Osilera is a product of D4 Dijital Çözümler A.Ş., Hüseyinağa Mah. İstiklal Cad. GrandPera No:56-58 İç Kapı No: 5, Beyoğlu, İstanbul, Türkiye, tax number 2650762428 (Beyoğlu Tax Office), MERSİS number 0265 0762 4280 0001 ("D4", "we"). For your account, your personal account's data and the record of sensor use, D4 is the data controller. For the data of a company's team, D4 processes it on that company's behalf under its agreement with the company; questions about it go to the company first. Contact: privacy@osilera.com, or by post to the address above.
2. What we collect and why
| Data | Purpose | Legal basis (GDPR / KVKK) |
|---|---|---|
| Name, email address, each sign-in provider and its account identifier, whether the address is verified | Creating your account, letting you sign in, showing you invitations sent to your verified addresses | Contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) |
| The version of the terms you accepted and when | Proving what you agreed to | Contract; legitimate interest in proving acceptance (GDPR Art. 6(1)(b), (f); KVKK Art. 5(2)(c), (e), (f)) |
| Your choice about product news | Sending news only if you chose it | Consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)) |
| Your phones: an identifier per phone, its notification token, when it last checked in | Unlocking your readings on your phones; telling a phone when access changed | Contract |
| Record of sensor use: which account and team used which sensor serial, first and last use; requests for sensor keys; the dealer a sensor was sold through | Protecting sensors and keys against misuse; support; registration | Legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) |
| Sensors registered to you, purchases and subscriptions, the features they give; proof of purchase if you report a sensor lost or stolen | Giving you the features you are entitled to; blocking a lost or stolen sensor | Contract |
| Security records: sign-ins, blocks, audit entries | Protecting accounts and data; showing a team who did what in it | Legitimate interest; legal obligation (GDPR Art. 6(1)(f), (c); KVKK Art. 5(2)(f), (ç)) |
| Readings and machines you back up to your personal account (with the backup subscription only) | Backup and restore | Contract |
We receive this data from you, from the sign-in provider you choose (Google, Apple, Microsoft), and from your phone and sensors when you use the app. The account data in the first row is needed to have an account; without it we cannot create one.
The record of sensor use is seen by D4 staff only, never by another company. The app sends no advertising identifiers and contains no advertising, and we do not sell personal data. We take no decision about you solely by automated means that has legal or similarly significant effects. Product news by email is sent only with your consent, which you can withdraw at any time in the app; the Turkish rules on commercial electronic messages (Law No. 6563) apply as well. If crash reporting is added to the app (Firebase Crashlytics), the app tells you at its first start and this notice names it before it is switched on.
3. What stays on your phone
Your readings, photos and notes are kept on your phone, locked with your account's key. They leave the phone only when they belong to a team's machine (sent to that team) or when you hold the backup subscription (copied to your personal account). If several people use one phone, each person's records stay locked under their own key. When you delete your account, the app clears your records on the phone where you delete it, and on your other phones the next time they connect to Osilera; before that it offers to back them up to a file you keep.
The app asks for these permissions, only when it needs them:
- Bluetooth, to find and connect to Osilera sensors. On Android 11 and older, Android requires the location permission for Bluetooth scanning; the app does not read or store your location.
- Camera, for photos of measurement points and to measure shaft speed. Photos you take are also saved to your gallery.
Backups and exports are files the app creates only when you ask, and they go where you send them.
4. Who receives data
Google Cloud (hosting in the EU, region europe-west1, Belgium; sign-in through Google Identity Platform; phone notifications through Firebase Cloud Messaging, which carry no content, only a notice that your access changed), Mailgun (email, EU region), Apple, Google and Microsoft for sign-in with their accounts, Apple and Google for purchases in their stores, and RevenueCat for in-app purchases once they are offered. Each works under a data-processing agreement. We will update this list before we add a provider.
When you join a team, the team's administrators see your name, your email address and the readings you send to that team. We disclose data to authorities only where the law requires it.
Your data is stored in the EU. For data from Türkiye that is a transfer abroad under KVKK Art. 9, made under standard contracts in the form announced by the Personal Data Protection Board and notified to the Authority within five business days of signing. Where a provider may access data from outside the EU, the transfer relies on the European Commission's standard contractual clauses, on the EU–US Data Privacy Framework where the provider is certified under it, or on an adequacy decision.
5. How long we keep it
Account data for as long as the account exists. When you delete your account, your sign-ins, phones and keys are removed at once, the app clears your records from your phones (section 3), your personal account is deleted within 30 days, and the record of sensor use keeps no name. Readings you sent to a team stay with that company under its agreement, marked as taken by a deleted person. Security records for 12 months, longer where a team's plan keeps a longer history. Where the law requires us to keep a record (for example a purchase record), we keep it for the period the law sets.
6. Your rights
You may ask for access to, correction, deletion or restriction of your personal data, object to its use, withdraw a consent you have given, and receive your data in a portable format (GDPR Art. 15–21; KVKK Art. 11). You can export your readings and delete your account in the app yourself, or ask for deletion at osilera.com/account/delete; for anything else write to privacy@osilera.com or to the address above, saying who you are and what you ask. We answer free of charge within 30 days. You may also complain to your data-protection authority — in Türkiye the Kişisel Verileri Koruma Kurumu, in the EU the authority of your country.
7. Security
We protect data with technical and organisational measures: your records on the phone are locked with your account's key, connections are encrypted, access inside D4 is limited to those who need it, and security records show who did what. If a breach puts your data at risk, we notify the authority and, where the law requires, you, within the time the law sets (72 hours for the authority under both GDPR and KVKK).
8. Children
Osilera is a professional tool for people aged 18 and over. We do not knowingly collect children's data.
9. Changes
We publish any change here with its date, and tell account holders of material changes in the app or by email.