Privacy Policy & KVKK Disclosure

At FinPusula, we care about the security of your personal data. This text explains how your data is processed under Türkiye's Law No. 6698 on the Protection of Personal Data ("KVKK").

1. Data Controller

Data Controller: Metehan Demircioğlu

Address: Mürsel Uluç Mah. 942. Cadde 40/6 Çankaya/Ankara

E-mail: info@finpusula.com

2. Personal Data Processed

• Identity and contact: name, e-mail address (for account creation and sign-in; if you turn the feature on, your e-mail address is also used to send you payment reminders).
• User content (financial data): data you enter yourself, such as income, expenses, credit card, installment, loan, savings and goal information. If you use the relevant features, this also covers the receipt photos and card statement documents you upload for automatic entry.
• Payment transaction data: the status and amount of a subscription transaction. Payment instrument details such as card numbers are never seen or stored by us. On the web they are processed directly by the Merchant of Record, Paddle; in the iOS app every purchase is made through Apple In-App Purchase and is processed by Apple.
• Usage/analytics data: anonymized usage statistics collected to improve the app.

3. Purposes of Processing

• Providing the service, creating and managing your account.
• Secure cross-device synchronization and backup of your data.
• Sending payment reminder e-mails to your sign-in address — only if you switch this option on in the app, and you can switch it off at any time.
• Carrying out premium subscription and payment transactions.
• Generating AI-powered financial analysis and suggestions upon your request.
• Improving the service, ensuring security and fulfilling legal obligations.

4. Legal Grounds

Your data is processed based on grounds set out in Articles 5 and 6 of the KVKK, such as the establishment/performance of a contract, the establishment and exercise of a right, the fulfilment of legal obligations, and your explicit consent (e.g. for cross-border transfers and analytics).

5. Transfer of Data

To provide the service, your data may be processed through the infrastructure of the service providers below. As some of these providers are located abroad, such transfers rely on your explicit consent and/or appropriate safeguards under Article 9 of the KVKK:

• Supabase — hosting of account and sync data (database, authentication).
• Paddle (Paddle.com Market Limited) — payment, billing and sales-tax processing for purchases made on the web (Merchant of Record).
• Apple — for purchases made in the iOS app, processing of the In-App Purchase transaction and of your subscription status.
• RevenueCat — management and verification of in-app subscription status (purchase records and your user ID).
• OpenAI and Google — only when you use AI features, the analysis of the relevant financial summary or document content.
• Resend (EU region) — delivery of reminder and account e-mails to your e-mail address.
• PostHog (EU) — anonymized usage analytics.

Except for legal obligations, your data is not shared with or sold to third parties for marketing purposes.

6. Artificial Intelligence Features and Third-Party AI Services

FinPusula’s AI features (statement, receipt and screenshot reading; the AI coach, bookkeeper reports and chat) run on third-party AI services. Data is sent only when you start one of these features yourself, and the app asks for your explicit permission in advance the first time. You can withdraw that permission at any time under Settings → AI and data sharing; if you do, the AI features stop sending any data until you grant it again.

What is sent. Only the content required for the request you made:

• Statement reading: the statement file you choose (PDF, photo or text) and, to verify the reading, your existing spending, installment and subscription records for the selected card.
• Receipt reading: the receipt or invoice image or PDF you choose, and your category names.
• Screenshot import: the bank screenshots you choose and your existing income/expense records, used for matching.
• AI coach, bookkeeper and chat: a summary of your finances (income, card balances and limits, fixed expenses, installments, loans and spending items with their amount, category and date) and, for chat, the message you write.

What is not sent. Your name, email address, password and bank login details are never sent to AI services.

Who it is sent to.OpenAI, L.L.C. (USA) and Google LLC — Gemini (USA). Which provider handles a given feature may change over time, so both are disclosed.

How it is used and safeguards. The content is processed only to produce the result you asked for and is returned to your device; it is not used to train AI models, is not shared for advertising, and is not stored by us for that purpose. These providers are engaged under their enterprise/API terms, which contractually commit them to confidentiality, to processing the data solely on our instructions, and to security measures providing protection equivalent to the standards described in this policy. Requests are transmitted over encrypted connections (TLS) and are not retained by us beyond producing your result.

7. Retention Period

Your personal data is retained for as long as your account is active and for the periods required by applicable legislation. When you delete your account, your data is deleted or anonymized, subject to any legal retention obligations.

8. Your Rights Under the KVKK

Under Article 11 of the KVKK you have the right to learn whether your personal data is processed, to request information, to learn the purpose of processing, to request correction if processed incompletely/incorrectly, to request deletion or destruction, to object to processing, and to claim compensation if you suffer damage.

9. Cookies

Cookies required for the operation of the service and for anonymous usage measurement may be used on the website. Your browser's "Do Not Track" preference is respected.

10. Applications

You can send requests regarding your rights to info@finpusula.com. Your requests will be concluded as soon as possible and within 30 days at the latest.