KVKK Information Notice

Last updated: October 13, 2026

This English text is a convenience translation. The Turkish notice is authoritative.

Under Turkish Personal Data Protection Law No. 6698 (“KVKK”), the data controller for Expensia is Ulaş Sancak, Bakırköy, İstanbul, Türkiye. Contact: ulas.san@gmail.com.

1. Personal-data categories

The website stores only a language preference in browser local storage and currently uses no advertising, analytics, or tracking cookies.

2. Purposes

Data is processed to create and secure accounts; provide, sync, export, and delete expense features; generate recurring records; operate budgets, receipts, widgets, notifications, and subscriptions; prevent abuse; diagnose faults; improve reliability; answer requests; establish or protect legal rights; and comply with legal duties.

3. Collection methods and legal grounds

Data is collected electronically through the app, website, Apple or Google authentication, Apple transactions, support communications, and the providers listed below, by wholly or partly automated means. Depending on the activity, the legal ground is KVKK Article 5(2)(c) (performance or formation of a contract), 5(2)(ç) (legal obligation), 5(2)(e) (establishment, exercise, or protection of a right), 5(2)(f) (legitimate interests without harming fundamental rights), or Article 5(1) explicit consent where required.

4. Recipients and transfers

Data may be transferred, limited to the relevant purpose, to Apple (authentication, App Store transactions, platform services), Google (Sign-In and Firebase Analytics, Crashlytics, and Messaging), Supabase (authentication, database, and private storage), RevenueCat (subscription entitlement), authorized public bodies, and professional advisers when legally necessary.

Because some providers operate abroad, data may be transferred internationally only under a method permitted by KVKK Article 9, such as an adequacy decision, an appropriate safeguard, or an applicable statutory exception. The method used for each live provider must be assessed against the then-current service configuration.

5. Retention and security

Product data and private receipt photos are generally retained until deletion of the relevant record or account, subject to legal obligations, disputes, fraud prevention, and limited backup cycles. Diagnostic, security, and subscription records follow the applicable legal period and provider settings. Reasonable technical and organizational safeguards include access controls, encryption in transit, and owner-scoped private storage.

6. Article 11 rights

You may: (a) learn whether your personal data is processed; (b) request information if it is processed; (c) learn the purpose and whether it is used accordingly; (ç) know domestic or foreign recipients; (d) request correction of incomplete or inaccurate data; (e) request erasure or destruction under Article 7; (f) request notice of corrections or erasure to recipients; (g) object to a result against you arising exclusively from automated analysis; and (ğ) claim compensation for damage caused by unlawful processing.

7. Applications

Send your request from the email associated with your account to ulas.san@gmail.com. Include your name, the request, an address or email for the response, and information reasonably needed to identify you and locate the relevant processing. You may also use another application method recognized by the applicable KVKK rules. Requests are answered as soon as possible and no later than 30 days, subject to legally permitted fees.

8. Account deletion and updates

You can delete your account in the app’s Settings after fresh authentication, or after confirmation for a guest account. This does not cancel an App Store subscription; manage it through Apple. We may update this notice when processing or law changes and will provide notice where required.