Draft — pending legal review. This text must be reviewed by a lawyer or data protection adviser before publication, including which laws apply to customers outside Türkiye (for example the EU/UK GDPR). Fields in square brackets must be filled in.

Privacy Notice

Version: 2026-10-draft · Last updated: [date]

1. Who is responsible

Your personal data is processed by [COMPANY NAME] (“Hesap”), [address], [registration / tax no], as the controller, as described below. This notice is prepared under Türkiye's Personal Data Protection Law No. 6698 (“KVKK”) [and, where applicable, the EU/UK GDPR — legal review]. Contact: ayhanselek@gmail.com.

2. Personal data we process

Identity and contact: your email address; company names you choose to enter.
Account security: a one-way hash of your password (the password itself is not stored), session data, sign-in times, IP address and browser information, results of bot protection (Cloudflare Turnstile).
Your business records: cash accounts, contacts, income, expenses and similar financial entries you make in the app, and their descriptions.
Legal records: the date and version of the terms you accepted, your interface language, and the activity log of your account (audit trail).

3. Why we process it

to create your account, verify your identity and give you access to the Service,
to provide the bookkeeping Service: storing your entries, producing reports and sharing them with the people you authorize,
to manage plans and subscriptions,
to keep the Service secure and prevent abuse and automated (bot) sign-ups,
to send confirmation, password reset, invitation and other required service emails,
to meet legal obligations and to protect our rights in case of disputes.

We do not send marketing emails.

4. How we collect it and legal bases

We collect personal data directly from you when you sign up and use the Service, and automatically in electronic form. We process it on the basis of performing a contract with you, complying with legal obligations, establishing, exercising or defending legal claims, and our legitimate interests where these do not override your fundamental rights and freedoms. [Legal review: mapping of each purpose to a legal basis under KVKK art. 5 and, where applicable, GDPR art. 6.]

5. Sharing and international transfers

To provide the Service we share data with the following providers, only as far as necessary:

Supabase Inc. (USA) — database and authentication infrastructure. Data is hosted on servers in the European Union (Frankfurt, Germany).
Cloudflare, Inc. (USA) — website hosting, content delivery, security (bot protection) and email delivery. Traffic may be processed across Cloudflare's global network.
Creem [legal entity and country — to be confirmed] — payment collection and invoicing for paid plans bought on the website (as merchant of record). Your card details never reach Hesap; Hesap stores only the subscription and customer IDs, the plan and the billing period.

Because these providers are established abroad, your data is transferred internationally. [Legal review: transfer mechanisms — standard contractual clauses and notifications under KVKK art. 9 / GDPR chapter V.] People you add to your account only see the records of the companies or accounts you give them access to. Data may be disclosed to competent authorities where required by law.

6. How long we keep it

We keep your data while your account is open and for the periods required by law. When you ask us to close your account, your data is deleted or anonymized, subject to legal retention obligations. [Retention periods — legal and accounting review.]

7. Your rights

You can ask us to:

confirm whether we process your personal data and, if so, give you information about it,
tell you the purposes of processing and whether data is used accordingly,
tell you the third parties in Türkiye or abroad to whom data is transferred,
correct incomplete or inaccurate data, delete or destroy it where the legal conditions are met, and notify these actions to third parties it was transferred to,
object to a decision against you that results solely from automated processing,
compensate damage you suffer because of unlawful processing.

[Where the GDPR applies: rights of access, rectification, erasure, restriction, data portability and objection, and the right to complain to your supervisory authority — legal review.] Send your requests to ayhanselek@gmail.com. We respond within thirty days at the latest.

8. Data about others that you enter

For information about your customers, suppliers and other business contacts that you enter in the app (such as contact names and descriptions), you are the controller; Hesap acts as a processor that handles this data only on your behalf and on your instructions. See the Terms of Use for details.