KVKK Privacy Notice
This English text is a courtesy translation. The Turkish original is the legally binding version and prevails in case of any difference.
This notice has been prepared under Article 10 of Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, to inform users of the Harcama Atlası website, web app and mobile apps (the “Service”).
1. Data controller
[Company name], [Address] (MERSIS: [MERSIS no]). Contact:[Email], KEP: [Registered email (KEP)].
2. Personal data processed
| Category | Data |
|---|---|
| Identity and contact | Name, email address; when signing in with Google, the name and email Google shares. |
| Account security | An irreversible hash of your password, sign-in and session records, account creation and last sign-in time. |
| Financial records (entered by you) | Expense, income and refund records, categories, groups, budget, recurring payments, debts, goals, assets and settings. |
| Test and coach | Financial Map test answers and result; on Plus+, the messages you send the coach and its replies. |
| Shared groups | Expenses you add to a group, memberships, invitations and expense splits. |
| Subscription and payment | Plan, period, subscription status, payment amount and date, customer and subscription numbers at the payment provider. Card details never reach us. |
| Transaction security | IP address, browser information and server logs (technical logs of hosting providers). |
Statements, PDFs and screenshots you upload are read on your device; the files themselves are not sent to or stored on servers. Only the transaction rows you approve are saved. We never ask for your full card number, CVV or bank password.
3. Purposes and legal grounds
- Opening your account, storing your records and syncing them across devices, running shared groups, managing your subscription: formation and performance of a contract (KVKK Art. 5/2-c).
- Retention obligations under invoicing, tax and consumer law: expressly provided by law and legal obligation (Art. 5/2-a and ç).
- Security of the Service, preventing abuse, fixing errors: legitimate interest (Art. 5/2-f).
- Protecting our rights in legal claims: establishment, exercise or protection of a right (Art. 5/2-e).
- Website visit statistics and marketing emails: only with your explicit consent (Art. 5/1). No marketing emails are currently sent.
Your financial records are never used for advertising, profiling or sale.
4. Collection method
Data is collected electronically through sign-up forms, information you enter in the app, the Financial Map test, subscription notifications from the payment provider and automatic logs of hosting providers.
5. Transfers
Your personal data is transferred only to the following service providers, and only as far as needed to run the Service:
| Recipient | Purpose | Location |
|---|---|---|
| Supabase | Database, accounts, syncing, verification emails | Germany (Frankfurt) |
| Paddle.com Market Ltd | Taking payment as merchant of record, invoicing and subscriptions | United Kingdom |
| OpenAI | Generating the Plus+ coach’s replies (name and email are not sent) | USA |
| PostHog | Website visit statistics, only if you consent | EU (Germany) |
| Cloudflare, GitHub | Hosting the website and web app | USA and global network |
| Authentication, only if you choose to sign in with Google | USA |
Transfers abroad are made in line with Article 9 of the KVKK, using standard contracts announced by the Board or other safeguards listed in the law. Information may also be shared with competent public authorities where legally required.
6. Retention periods
- Account and financial records: as long as your account is open. When you delete your account they are deleted from the cloud immediately and permanently.
- Subscription and payment records: for the periods set by tax and commercial law (up to 10 years).
- Financial Map tests taken on the web and never linked to an account: up to 12 months.
- Server and security logs: for the providers’ technical retention periods, up to 1 year.
7. Your rights (KVKK Art. 11)
By applying to the data controller, you have the right to:
- learn whether your personal data is processed and, if so, request information about it,
- learn the purpose of processing and whether data is used in line with that purpose,
- know the third parties in Turkey or abroad to whom data is transferred,
- request correction of incomplete or inaccurate data, deletion or destruction under the conditions of KVKK Art. 7, and notification of these actions to recipients,
- object to an outcome against you arising solely from analysis by automated systems,
- claim compensation for damage caused by unlawful processing.
8. How to apply
You can send your request with information verifying your identity to [Email] from your account’s email address, via KEP to[Registered email (KEP)], or in writing to [Address]. Requests are concluded free of charge within 30 days at the latest. You can also delete your account or reset your data yourself in the app under Settings > Delete data.