KVKK Privacy Notice

This notice is given under Article 10 of Türkiye's Law No. 6698 on the Protection of Personal Data ("KVKK") by WEBYAP YAZILIM LİMİTED ŞİRKETİ ("we", "us"), as data controller, to inform you about the personal data processed through the Cardper app ("the App"). The details of how that data is handled are in the Privacy Policy.

This text is a translation provided for convenience. The original is in Turkish, and in case of any difference the Turkish version prevails.

1. Data Controller

The data controller for your personal data is WEBYAP YAZILIM LİMİTED ŞİRKETİ:

WEBYAP YAZILIM LİMİTED ŞİRKETİ
Adalet Mah. Anadolu Cad. Megapol Tower NO:41 K:8 D:81, Bayraklı, İzmir, Republic of Türkiye
MERSİS No: 0800124092500001
contact@cardper.com

2. Personal Data We Process

Cardper is a local first app. By default, the card information you enter into the App stays only on your device and never reaches us. We do not ask for full card numbers, CVV codes, PINs or online banking credentials, and the App never connects to your bank. The personal data that does reach us is:

• Identity and contact: when you sign in with Apple or Google to create an account, the email address we receive from that provider (Apple lets you share a private relay address instead) and, if you choose to share it, your name; when you write to us, your email address and the content of your message.
• Customer transactions: your Cardper account identifier, the sign in provider's user identifier and information about Cardper Pro purchases (purchase identifier, product, status and renewal date).
• Financial: only if you turn on Cloud Sync, your synced Cardper records (wallets; card nicknames, bank names and the last four digits of cards; statement and due dates, limits, interest rates, balances, payments and notes; reminder settings) and your App preferences.
• Transaction security: the server logs kept when the App connects to our servers (time, requested address, response status, your IP address and request headers such as your user agent; for some events, an account or purchase identifier).

Usage analytics are collected anonymously, in a way that cannot be linked to your identity, and can be turned off in the App at any time. Google AdMob and its partners, which show ads in the free version, process device identifiers, approximate location derived from the IP address and ad interactions independently, under their own privacy policies. We do not process special categories of personal data.

3. Purposes and Legal Grounds

We process your personal data for the following purposes and on the following legal grounds:

• Creating and managing your account, running Cloud Sync, verifying and restoring Cardper Pro purchases, and answering your support requests: processing is directly related to the formation or performance of a contract (KVKK Art. 5/2-c).
• Keeping the service secure, preventing abuse and fixing problems: our legitimate interests (KVKK Art. 5/2-f).
• Serving and measuring the ads that fund the free version: our legitimate interests (KVKK Art. 5/2-f); for personalized ads where the law requires consent, such as the European Economic Area, the United Kingdom and Switzerland, your explicit consent (KVKK Art. 5/1).
• Keeping records we must retain for tax or other legal reasons: processing is necessary to comply with our legal obligations (KVKK Art. 5/2-ç).

You may object to processing based on legitimate interests, and withdraw your explicit consent at any time in the App settings or your device settings.

4. Transfers of Personal Data

We do not transfer your personal data to third parties within Türkiye; we may share it only with competent public authorities, on request, where the law requires it.

To provide the App, we transfer personal data, limited to the purposes in section 3, to the following recipients abroad:

• DigitalOcean and Neon (Germany, Frankfurt): hosting our servers and database, which hold account data and synced records.
• Better Stack (Germany): keeping server logs and uptime monitoring.
• PostHog (Germany): anonymous usage analytics.
• Google Workspace (United States and other countries where Google operates): email, including the messages you send to our contact address.
• Apple and Google (United States and other countries where they operate): sign in and subscription billing.
• Google AdMob and its partners (United States and other countries where they operate): serving and measuring ads in the free version.

DigitalOcean, Neon, Better Stack, PostHog and Google Workspace process data on our behalf and under our instructions. Apple, Google and Google's advertising partners are independent companies that process data under their own privacy policies. Data sent to these recipients is encrypted in transit.

5. Method of Collection

We collect your personal data electronically, partly by automated means, on the legal grounds in section 3, from the following sources:

• Your records, which the App uploads to our servers while Cloud Sync is on.
• The information Apple or Google sends us when you sign in with them.
• The information the App Store and Google Play send us about subscription purchases and updates.
• The server logs created automatically when the App connects to our servers.
• The emails you send us.

6. Retention Period

Synced records and account data are kept for as long as your account is active. When you delete your account in the App, your account and synced content are deleted from our active systems immediately and from routine backups within 90 days. Server logs are deleted after 3 days. Records we must keep for tax or legal reasons are retained for the period the law requires. Data that exists only on your device stays there until you delete a record or uninstall the App.

7. Your Rights Under Article 11 of KVKK

Under Article 11 of KVKK, you may apply to the data controller to:

• Learn whether your personal data is processed.
• Request information about it, if it has been processed.
• Learn the purpose of the processing and whether the data is used in line with that purpose.
• Know the third parties, in Türkiye or abroad, to whom your personal data has been transferred.
• Request the correction of your personal data if it is incomplete or inaccurate.
• Request the erasure or destruction of your personal data under the conditions in Article 7 of KVKK.
• Request that the correction, erasure or destruction be notified to the third parties to whom your personal data has been transferred.
• Object to a result to your detriment arising from the analysis of the processed data exclusively through automated systems.
• Claim compensation for damage you suffer because your personal data was processed unlawfully.

You can delete your account and all synced data yourself at any time in the App under Settings, Account.

8. How to Apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your requests in writing to the address in section 1, or by email to contact@cardper.com from the email address you previously gave us and that is registered in our systems.

Your application must include your first name, last name and, if the application is in writing, your signature; your Turkish identity number if you are a citizen of the Republic of Türkiye, or otherwise your nationality and your passport number or identity number, if any; your residential or business address for notifications; your email address, telephone and fax number for notifications, if any; and the subject of your request.

We resolve your request free of charge as soon as possible according to its nature, and within 30 days at the latest. If the request involves an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. If your application is rejected, you find our answer insufficient, or we do not answer in time, you may file a complaint with the Personal Data Protection Board within 30 days of learning our answer, and in any case within 60 days of the date of your application.