Privacy Policy

1. Data controller

• Company: [PLACEHOLDER: Company legal name]
• Address: [PLACEHOLDER: Registered address]
• Tax ID / MERSIS No: [PLACEHOLDER: Tax ID / MERSIS number]
• Data protection contact: [PLACEHOLDER: KVKK / privacy contact email]
• Registered e-mail (KEP): [PLACEHOLDER: KEP address, if any]

2. Data we process

• Account data: first name, last name, email address, phone, Turkish national ID number, occupation, city, organization or company name and an optional profile photo. Your password is held only by Firebase Authentication in hashed form; we cannot see it.
• Property and financial records: buildings, flats and commercial units; rent, dues, gas, electricity, water and other bill records; expenses, recurring payments, maintenance records and the contacts you add to the service directory.
• Data you enter about tenants and other third parties: name, contact details, rental agreement details, deposit and payment history.
• Photos and documents: receipt photos, rental agreement files and other documents you upload.
• Device and notification data: push notification token, notification preferences, app version and operating system.
• Error reports: when an error occurs in the app, the error details, app version, device platform and operating system version.
• Website data: the details you enter in the contact, trial and account deletion forms (name, email, subject, message), IP address and browser information (user agent), and the language preference cookie. See the Cookie Policy.

Biometric lock (Face ID, fingerprint) is verified by your device's operating system; biometric data are never sent to us. The Service uses no advertising or third-party analytics tools.

3. Purposes

• Creating your account, authenticating you and providing the Service
• Storing your records, syncing them across your devices and generating reports and export files
• Sending you notifications and announcements about payment due dates, overdue payments, agreement end dates and your trial or subscription period
• Answering support and account deletion requests
• Keeping the Service secure, preventing abuse and fixing errors
• Complying with legal obligations

4. Legal bases

Under KVKK art. 5/2 we process your personal data because it is necessary to conclude and perform our contract with you (c), to comply with our legal obligations (ç), to establish, exercise or defend a right (e), and for our legitimate interests provided that they do not harm your fundamental rights and freedoms (f). Where none of these applies, we process data only with your explicit consent.

5. Your tenants' data

For the data you enter about your tenants and other third parties, you are the data controller. We process those data only on your behalf and to provide the Service (as a data processor). You are responsible for informing these people and for having a legal basis for the data.

6. Service providers and international transfers

We use the following service providers to run the Service. Your data are not sold and not shared for advertising.

• Google LLC (Firebase Authentication; Cloud Firestore — US multi-region nam5; Cloud Functions — US us-central1; Cloud Run — Belgium europe-west1; Cloud Storage — [PLACEHOLDER: Cloud Storage region]): authentication, database, file storage, backups and server processing
• 650 Industries, Inc. (Expo), USA: delivering push notifications to your device (push token and notification content) and distributing app updates
• Twilio Inc. (SendGrid), USA: sending account and subscription emails
• Resend, USA: forwarding website form messages to our team
• [PLACEHOLDER: Website hosting provider and location]

Because some of these providers are located abroad, your personal data are transferred outside Türkiye. Such transfers are based on the standard contracts published by the Turkish Personal Data Protection Board under KVKK art. 9 ([PLACEHOLDER: dates the standard contracts were signed and notified to the Board]).

Information is disclosed to authorized public authorities only when there is a legal request or obligation.

7. Retention

• Account data and records are kept for as long as your account exists.
• When you ask to delete your account, it can be recovered for 30 days. After that period, your account and related data are deleted automatically. Details: Account deletion.
• Daily backups are kept for 14 days and then deleted; data of deleted accounts leave the backups at the latest when that period ends.
• Contact and account deletion form messages are kept for [PLACEHOLDER: retention period for form messages].
• Records that the law requires us to keep longer are kept for the statutory period.

8. Deleting your account

You can delete your account in the app under Settings > Delete Account, or without the app using the form on the Account deletion page.

9. Security

Data travel between your device and our servers over an encrypted connection (TLS) and are stored encrypted on Google infrastructure. Access is restricted by per-account authorization rules. You can also protect the app with a biometric lock.

10. Your rights

Your rights under KVKK art. 11 and how to exercise them are described in the KVKK Privacy Notice. Requests are answered free of charge within 30 days at the latest.

11. Children

The Service is not intended for people under 18 and we do not knowingly collect data from them.

12. Changes

We may update this policy. The current version is published on this page and the date at the top is changed. We also announce important changes in the app or by email.

13. Contact

For questions about this policy, write to [PLACEHOLDER: KVKK / privacy contact email] or use the contact form.