COPIA
Privacy Policy and KVKK Privacy Notice
This is an English translation provided for convenience. The Turkish version is the legally binding text.
1. Data Controller
This Privacy Notice has been prepared under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") to inform people who use the Copia mobile application (the "App") (the "User") about how their personal data is processed. Data controller: Ahsen Altun, Başak Mah. Yunus Emre Cad. No:6b, Başakşehir/İstanbul, email: [email protected].
2. Personal Data We Process
Identity data: Name and surname (optional). Contact data: Email address, phone number (optional). Financial data: The assets, debts, goals, salary, extra income and expense records you enter in the App, their transaction history, your daily net worth history and the price alerts you set up (the asset you choose and the threshold price). Data about third parties: Names and notes you choose to write in your debt records. Security data: An irreversibly encrypted form of your password, session data, device type and operating system version, App version, and how many times a day you use the Investment Assistant. Notification data: If you allow notifications, the notification address (push token) needed to send notifications to your phone, your notification preferences, the last time you opened the App, and the history of notifications sent to you (title, text, time sent, read status). If you sign in with Google, the email address, your name (if any) and the link to your Google profile photo that Google shares with us (this photo is not used in the App). Support correspondence: Your email address and the content of your message when you write to us through the Contact Us section or by email. Legal records: Approval records of the User Agreement and of this Privacy Notice (date and time of approval, approved version, email address). Advertising data (free use only): your device’s advertising ID, IP address, device and operating system information, the ads shown and your interactions with them. Subscription data: Sign-up date, trial period and Premium subscription status. Monthly summary data: Which month the summary sent to your email each month covers, its delivery status and time, and, so that it can be compared with the next month, that month’s Financial Health Score and spending category totals. Your profile photo, your app-lock PIN and your first-user right record (the date the App was first installed on this phone and the ID of the first account that signed in on this installation) are stored only on your phone and are never sent to our servers.
3. Purposes of Processing
Your personal data is processed to create and manage your account; to provide the App’s features (tracking assets, debts and goals, calculations, reminders, price alerts, Investment Assistant notes); to store your data so that it can be accessed from different devices; to send a monthly financial summary (with a PDF attachment) to your registered email address each month if you turned on the Monthly Summary; to manage subscriptions and trial periods; to respond to support requests; to keep the App secure and prevent misuse; to record your approval of the User Agreement; and to comply with legal obligations and protect rights in possible disputes. A limited number of ads are shown in the App during free use; advertising data is processed only to show ads, limit how often they appear and prevent ad fraud. Premium users do not see ads. The financial details you enter in the App (assets, debts, goals, salary, income and expenses) are never used for advertising. Your personal data is not used for marketing or profile selling and is not sold to third parties.
4. Collection Method and Legal Grounds
Your personal data is collected electronically through the App, from the information you enter and from records created automatically while you use the App. This data is processed on the following legal grounds set out in Article 5(2) of the KVKK: it is necessary for the conclusion and performance of the User Agreement (subparagraph c), for the data controller to fulfil its legal obligations (subparagraph ç), it is mandatory for establishing, exercising or protecting a right (subparagraph e), and the legitimate interest of the data controller, provided that it does not harm your fundamental rights and freedoms (subparagraph f). Non-personalised ads during free use are based on the data controller’s legitimate interest in offering the service for free (subparagraph f). Interest-based (personalised) ads and the use of the advertising ID for cross-app tracking happen only with your explicit consent (KVKK Article 5(1)). On Android, this consent is given through the ad preference window the App shows before the first ad; if you don’t consent, you only see non-personalised ads. On iPhone, this consent is given through Apple’s tracking permission window; if you don’t consent, your advertising ID is not shared with the ad provider and you are not shown ads that track you across other apps and websites. The App does not collect special categories of personal data listed in Article 6 of the KVKK (health, biometric data, etc.). Face ID / fingerprint verification happens entirely on your phone; your biometric data is never accessed.
5. Transfer of Personal Data
Your personal data is transferred only as far as necessary to provide the Service, and only for that purpose, to the following service providers: Supabase (database, authentication and server infrastructure), Resend (email delivery; your email address, sign-in and verification emails, and the content and PDF attachment of the monthly summary email), Expo (delivering notifications to your phone; your notification address and the notification text. Notifications reach your phone through Apple (iPhone) or Google (Android) notification services; the notification text may include names you wrote in your debt records), Cloudflare and Google (support emails: emails you send to [email protected] are routed through Cloudflare and stored in Google’s email service, Gmail), Google for authentication if you sign in with Google, Google AdMob for showing ads during free use, and the app stores (Apple App Store, Google Play) for subscription payments. When Investment Assistant notes are generated, only anonymous figures and fixed category names are sent to the AI service provider Groq in the USA; your name, email address, phone number, goal names or anything that identifies you are never sent. As this information does not identify you, it is not personal data. International transfers: Because no servers in Türkiye are used, your personal data is transferred abroad. This is where each type of data goes: All the data you enter in the App and your account and approval records are stored on Supabase servers in Ireland (European Union). The email, notification, support, Google sign-in and advertising data listed above is processed by Resend, Expo, Cloudflare, Google and Apple on these companies’ servers abroad, mainly in the United States. These transfers are made regularly and so that the Service can be provided. They are carried out by signing the standard contracts announced by the Turkish Personal Data Protection Board with the relevant service providers and notifying the Board, under Article 9(4) of the KVKK. Transferred data is not used for any purpose other than those listed in this Privacy Notice. Your personal data may also be shared with authorised public bodies and courts when requested and to the extent permitted by law. During free use, your advertising data is transferred to the ad provider (e.g. Google AdMob) so that ads can be shown; your financial details, name, email address and phone number are not shared with this provider. No personal data is sent to the sources we get price information from.
6. Retention and Deletion
Your personal data is kept for as long as your account is open. When you delete your account from the Profile page, your account, all the data you entered in the App, your notification history, price alerts, monthly summary records and your User Agreement approval record are permanently deleted from our servers; the App data and scheduled notifications on your phone are also cleared. When you sign out, the App data on your phone is deleted, while your data on the server is kept so that you can sign in again. Technical logs kept by service providers (e.g. server and email delivery logs) are kept for a short time for security and troubleshooting and are then deleted automatically. Support correspondence is kept for as long as needed to answer your request and is deleted if you ask us to. Subscription payment records are kept by the Apple App Store or Google Play under their own terms.
7. Your Rights under the KVKK
Under Article 11 of the KVKK, you have the right to: learn whether your personal data is processed and, if so, request information about it; learn the purpose of processing and whether it is used in line with that purpose; know the third parties in Türkiye or abroad to whom it is transferred; ask for it to be corrected if it is incomplete or inaccurate; ask for it to be deleted or destroyed under the conditions of Article 7 of the KVKK; ask for corrections, deletions and destructions to be notified to the third parties it was transferred to; object to a result against you arising from analysis of the data exclusively by automated systems; and claim compensation if you suffer damage because of unlawful processing. You can withdraw your consent to personalised ads at any time (Android: in the App, Profil > Bildirimler > Kişiselleştirilmiş Reklam; iPhone: Settings > Privacy & Security > Tracking).
8. How to Apply
You can send requests about these rights, together with information that lets us verify your identity, from the email address registered in the App to [email protected]. Your request will be concluded within 30 days at the latest, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Applications are free of charge as a rule; if the process requires an additional cost, the fee in the tariff set by the Board may be charged. If your application is rejected, you find the answer insufficient, or no answer is given in time, you can file a complaint with the Personal Data Protection Board within 30 days of learning of the answer and in any case within 60 days of the application date.