Data Protection (KVKK) Notice
This notice explains how we process your personal data as data controller under Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”).
Last updated: 12 June 2026
1. Identity of the Data Controller
Your personal data is processed by ParaXtre (the “Data Controller”, “we”) in accordance with KVKK and related legislation.
- Data Controller
- ParaXtre
- kvkk@paraxtre.com
2. Personal Data We Process
Depending on how you use the App, the following categories may be processed:
| Data Category | Examples |
|---|---|
| Identity & Contact | Name (optional), email address (may be Apple’s private relay email when you use Sign in with Apple). |
| Account & Membership | User ID, hashed password, language and theme preference, account creation/access logs. |
| Financial Tracking Content | Income/expense amounts, categories, payment-method labels, subscriptions, installments, notes, currency and dates that you enter. This is for tracking only; it does not include bank balances or account connections. |
| Family / Shared Workspace | Shared workspace members, invitation emails and roles (owner/member/viewer). |
| Text Extracted from Documents | Text fields (amount, date, merchant, etc.) extracted on your device from receipts, invoices or statements and saved with your confirmation. The document images themselves are never sent to us. |
| Security / Technical | IP address, device and app version, session and error logs, anonymised diagnostics. |
| Notification | Device push token, used to deliver reminders. |
| Marketing / Analytics | Only with your explicit consent; website measurement and usage statistics. |
3. Purposes of Processing
- Creating your account, authenticating you and providing the service,
- Tracking income/expense, subscriptions and installments and delivering reminders,
- Managing shared (family) workspaces,
- Easing data entry via text extracted on-device from receipts/invoices/statements,
- Ensuring security and preventing misuse and fraud,
- Fixing errors, improving the service and maintaining technical continuity,
- Fulfilling legal obligations and responding to authorities,
- Where you have given explicit consent, performing measurement and product-improvement analytics.
4. Legal Grounds (KVKK Art. 5)
- Necessity for the conclusion or performance of a contract (Art. 5/2-c) — providing the account and service,
- Compliance with a legal obligation (Art. 5/2-ç) — statutory retention and reporting,
- Our legitimate interests, provided your fundamental rights are not harmed (Art. 5/2-f) — security, abuse prevention and service improvement,
- Your explicit consent (Art. 5/1) — for marketing/analytics cookies and, where needed, cross-border transfers.
5. Method of Collection
Your personal data is collected electronically, through automated and partly automated means, when you use the App and website, create an account, enter data, authenticate via Sign in with Apple or email/password, and contact us.
6. On-Device Processing — Document Images
Receipt, invoice and statement scanning runs on your device. Image processing (OCR) happens locally; only the extracted text fields you confirm are sent to our servers. Document photos or image files never leave your device and are never stored by us.
7. Transfers and Cross-Border Transfers
Limited to the purposes above and in line with KVKK Art. 8 and Art. 9, your data may be shared with the recipient groups below. As some providers are located abroad, such transfers rely on your explicit consent and/or appropriate safeguards under KVKK Art. 9 (e.g. standard contracts):
- Apple (USA) — Sign in with Apple authentication, push notifications (APNs) and App Store purchases,
- Our cloud infrastructure and hosting providers — secure storage and service delivery,
- Our error-monitoring provider (Sentry) — technical error logs, excluding fields such as amounts, merchant, notes, email or auth tokens from diagnostics,
- Payment providers — subscription/payment via the App Store (Apple) and, in Türkiye, iyzico; we never see your card details,
- With your explicit consent, analytics providers — Google Analytics (USA) and privacy-focused, cookieless Plausible,
- Authorised public authorities — solely within the scope of legal obligations.
8. Retention
We keep your data for as long as the purpose requires and for the retention periods set by applicable law. When you delete your account, your personal data is deleted, destroyed or anonymised within a reasonable time; records subject to a legal retention obligation are kept only for the relevant period.
9. Your Rights (KVKK Art. 11)
- To learn whether your data is processed,
- To request information if it has been processed,
- To learn the purpose and whether it is used accordingly,
- To know the third parties to whom it is transferred at home or abroad,
- To request correction if incomplete or inaccurate,
- To request erasure or destruction under the conditions in KVKK Art. 7,
- To request that correction/erasure be notified to third parties to whom data was transferred,
- To object to a result against you arising solely from automated analysis,
- To claim compensation for damages due to unlawful processing.
10. How to Apply
You can submit requests under the “Communiqué on the Procedures and Principles of Application to the Data Controller”, together with information verifying your identity, by email to kvkk@paraxtre.com. Your request is concluded free of charge within thirty (30) days at the latest; a fee from the Board’s tariff may apply where the process entails additional cost.
11. Children’s Data
The App is not directed to persons under 18, and we do not knowingly collect their personal data.
12. Changes
We may update this notice from time to time. The current version is always published on this page; the “last updated” date above indicates its effective date.