Privacy Policy / Gizlilik Politikası
GDPR Articles 13–14 notice for users in the EU/EEA and UK; Turkish users see the KVKK Aydınlatma Metni (01), which prevails for them. English core below; Turkish summary at the end.
Last updated: [doldurulacak] YYYY-MM-DD
1. Who we are
[doldurulacak] [Company legal name], [address], [contact email] ("Gelecek", "we"). [hukukçu onayı bekliyor] If the controller is established outside the EU, appoint an EU representative under GDPR Art. 27 and name them here. Data protection contact: [doldurulacak] privacy@[domain].
2. What we process, why, and on which legal basis
| Data | Purpose | Legal basis (Art. 6(1)) |
|---|---|---|
| Email, password hash, MFA secret, session/IP logs | Account, login, security | (b) contract; (c) legal obligation (Art. 32); (f) legitimate interest (security) |
| Financial records you enter: accounts, balances, transactions, debts, assets, plans | The service itself: budgeting, debt strategy, projections | (b) contract |
| Uploaded bank/card statement PDFs | Extracting transactions at your request | (b) contract |
| Third-party contact data you add (customers' names, emails, phones) | Receivables tracking and reminders you send — you are the controller for these people | (b) contract; (f) legitimate interest |
| Event log (who did what, when, from which IP) | Security, audit, incident investigation | (c) legal obligation; (f) legitimate interest |
| Stripe customer/subscription IDs, invoice status (no card numbers) | Billing | (b) contract; (c) legal obligation (tax) |
| Country, language, currency, consents | Personalisation | (b) contract |
2.1 Marketing site (visitors who have not signed up)
| Data | Purpose | Legal basis |
|---|---|---|
| Cookieless usage event (page viewed, calculator used, link clicked — no cookies, no IP stored) | Measuring which content is useful | (f) legitimate interest |
| Newsletter: email, consent timestamp, signup source | Monthly "debt plan" email | (a) explicit consent — unsubscribe link in every email |
Numbers you type into a calculator never leave your browser; the calculation runs entirely client-side.
AI assistant — only with your explicit consent (Art. 6(1)(a), Art. 49(1)(a) for transfer): a summary of your financial data is sent to OpenAI (US) to generate advice. Withdraw anytime in Settings. No decision with legal or similarly significant effect is made solely by automated means (Art. 22).
We do not process special-category data (Art. 9). Please do not enter health, religious or similar information in free-text fields.
3. Recipients and international transfers
| Processor | Location | Role | Transfer mechanism |
|---|---|---|---|
| Supabase Inc. | EU (Ireland) hosting; US company | Database, auth, storage | SCCs (Module 2) + DPA [hukukçu onayı bekliyor] |
| Vercel Inc. | US / global edge | App delivery | SCCs + DPA |
| Stripe Inc. | US | Payments | SCCs + DPA; Stripe is an independent controller for payment data |
| Resend | US | Transactional email | SCCs + DPA |
| OpenAI L.L.C. | US | AI assistant (consent only) | Art. 49(1)(a) explicit consent + SCCs |
| Twilio | US | WhatsApp reminders (receivables feature only) | SCCs + DPA |
Hukukçu notu: Confirm current SCC modules, the EU–US Data Privacy Framework status of each vendor, and complete transfer impact assessments (TIA) where required.
We do not sell personal data and do not use it for advertising.
4. Retention
- Account data: while your account exists.
- After you delete your account: 30-day grace period (restorable), then permanent deletion; removal from backups completes within a further ~7 days.
- Event log: user identifiers and IP addresses are pseudonymised after 24 months.
- Billing records: as required by tax law [hukukçu onayı bekliyor] (state duration).
5. Your rights (Art. 15–22)
Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. Most can be exercised directly in Settings (download all data as JSON/CSV; delete account; withdraw AI consent). Otherwise email [doldurulacak] privacy@[domain]. We respond within one month. You may lodge a complaint with your supervisory authority; [hukukçu onayı bekliyor] name the lead authority if applicable.
6. Security
TLS in transit, encryption at rest, per-tenant row-level isolation enforced by the database, optional two-factor authentication, audited privileged access, daily backups [doldurulacak] (once the Pro plan is enabled).
7. Cookies and local storage
See the Cookie Notice (04). The app uses only strictly necessary storage (session token, your last-used preferences). The marketing site uses analytics only with consent.
8. Children
The service is not directed to persons under 18.
9. Changes
We will notify you in-app of material changes and, where required, ask for renewed consent.
Türkçe özet
Bu politika AB/İngiltere kullanıcıları içindir. Türkiye'deki kullanıcılar için KVKK Aydınlatma Metni (01) esastır. İki metin aynı ürün gerçeklerine dayanır: veriler AB'de (İrlanda) barındırılır; e-posta, ödeme ve yapay zekâ sağlayıcıları ABD'dedir; AI danışman yalnızca açık rızayla çalışır; hesap silme 30 gün bekleme sonrası kalıcıdır; haklarınızı Ayarlar ekranından doğrudan kullanabilirsiniz.