Privacy Policy
Created: · Last Updated:
1. Data Controller
Data Controller: butce.app
Contact: info@butce.app
2. Personal Data We Collect
To provide our services we process the following personal data:
2.1. Identity and Contact Information
- Username: To identify your account
- Email Address: For authentication, communication and notifications
- Password: For secure access (stored in encrypted form)
- Google Account Identifier: When you sign in with Google, the unique identifier Google issues for your account is stored together with your email address. Your Google password is never sent to us, it stays with Google.
2.2. Financial Data (Sensitive Data)
- Income and expense records
- Account balances (bank accounts, cash, credit cards)
- Budget plans and categories
- Transfer and instalment information
- Investment analysis data
2.3. Transaction and Usage Data
- Account creation date
- Subscription details
- Marketing consent preference (campaign and announcement emails)
- Currency and time zone preferences
- Registration source (UTM parameters in campaign links, to measure which channel you came from)
- Device and session information (desktop, mobile, Android)
- System logs (for debugging)
2.4. Document and File Uploads
- Documents you upload (receipts, payment slips, policies, etc.) in PDF, JPG, JPEG or PNG format, up to 5 MB each
- Document title, category and notes
2.5. Tracker and Credit Data
- Tracker entries (appointments, insurance, document due dates, mileage, etc.)
- Loan and debt information (loan name, amount, instalments, bank name)
2.6. Data Processed by AI Features
- Bank Statements: The PDF or image you upload to the AI Statement feature is sent to Gemini so the transaction lines inside it can be read.
- Receipt and Invoice Images: The photo you upload to the AI Receipt Scan feature is sent to the same service so the amount, date and merchant can be read.
- These features are optional. Unless you use them, none of your documents are transferred abroad. The document itself stays on our server and is only relayed to Gemini to be read.
3. Purposes of Processing
- 🎯 Service Delivery: To provide you with the budget management platform
- 🔐 Security: To protect your account and prevent unauthorized access
- 📊 Analysis: To generate your personal financial reports
- 📧 Communication: Account notifications, password reset, system updates
- ⚖️ Legal Obligation: To comply with legal requirements
- 💼 Subscription Management: Trial period and payment tracking
- 🤖 AI Features: Extracting transaction details from the statements and receipts you upload (only when you use these features)
- 📣 Marketing: Campaign and announcement emails (only when you have given explicit consent in Account Management)
4. Sharing of Personal Data
Your financial data is not shared with third parties. Data may be shared only in the following cases:
- 📧 Email Service: Gmail SMTP (for account notifications, encrypted transmission)
- 🌐 Hosting Provider: Veridyen (for data storage)
- 💳 Payment Infrastructure: Shopier (subscription payments; your payment details are processed by Shopier)
- 📊 Analytics: Google Tag Manager (for site usage analysis)
- 🤖 Artificial Intelligence: Google Gemini (only when you use the AI Statement and AI Receipt Scan features; the document you upload is sent to be read, on servers outside Turkey)
- 🔑 Sign in with Google: Google LLC (only when you sign in this way; authentication happens on Google's side)
- ⚖️ Legal Requirement: When required by competent authorities
5. Data Security Measures
🔐 Technical Measures
- Password hashing (bcrypt)
- CSRF protection
- SQL injection protection
- HTTPS encryption
- Database isolation (per user)
📋 Administrative Measures
- Limited administrator access
- Regular security updates
- System log monitoring
- Data backup procedures
6. Retention of Personal Data
- 📅 Active Accounts: For as long as your account is active
- 🗑️ Account Deletion: When you delete your account, all your data is permanently removed from our systems within 30 days
- 📜 Legal Obligation: Some records may be retained for up to 5 years where required by tax or other law
7. Your Rights Under Data Protection Law
Under applicable data protection law (including KVKK Article 11) you have the following rights:
✅ Right to Be Informed
To know whether your personal data is being processed
📋 Right to Request Information
To request information about your processed data
📥 Right to Download
To receive your data in a structured format
✏️ Right to Rectification
To request correction of inaccurate or incomplete data
🗑️ Right to Erasure
To request deletion of your data
🚫 Right to Object
To object to processing of your data
To Exercise Your Rights:
Email: info@butce.app
Response Time: We will respond to your requests within 30 days at the latest (as required by KVKK Article 13)
8. Cookies
butce.app uses cookies and similar technologies to provide and improve the service. The cookies we use are treated as required under this policy, including session and security, language preference, and site and campaign measurement (e.g. Statcounter, Google Tag Manager, Ahrefs).
A short notice is shown on first visit; you can dismiss it with OK. That does not turn cookies off. You can manage cookies in your browser; some features may be limited.
9. Changes
This policy may be updated. Significant changes will be communicated by email. We recommend that you check this page regularly.
10. Contact
Data Controller: butce.app
Email: info@butce.app