Privacy Notice
Created: · Last updated:
1. Data Controller
Data controller: Barış Ağardan
Email: info@butce.app
2. Personal Data We Process
| Category | What |
|---|---|
| Identity and contact | Username, email address, and if you sign in with Google, the unique ID Google assigns to your account. If you use the contact form, your name, phone number and message. |
| Account security | An irreversible hash of your password (the password itself is not stored), email verification and password reset codes, login attempts. |
| Financial records | Accounts and balances, income, expenses, transfers, installments, loans and debts, budgets, categories, tags, tracker entries. |
| Documents | Receipts, statements, policies and similar documents you upload (PDF, JPG, PNG, up to 5 MB), with their names and notes. |
| Membership and payment | Trial and membership dates, plan, order number, amount paid. Your card details never reach us; they stay with the payment provider. |
| Consents and preferences | Marketing email consent, cookie choice, consent to transfer abroad and their dates; currency, language and time zone preferences. |
| Transaction security | IP address, browser and device information (desktop, mobile, Android app), visited page, time of action, error logs. |
| Marketing measurement | Sign-up source: which link or site brought you here (UTM data in campaign links, the referring site address, whether you opened it inside an app such as Instagram); if you allow analytics cookies, site usage data collected by them. |
| Account deletion | If you deleted your account: your email address, deletion date, trial and membership period, and the deletion reason if you chose to give one. |
Financial data is not among the special categories of personal data listed in Article 6 of KVKK. Because it is sensitive, we still protect it with the security measures applied to special category data. We do not ask you to share special category data (such as health, religion or biometric data); we recommend blacking out such information before uploading a document.
3. Purposes and Legal Bases
| Purpose | Legal basis (KVKK art. 5/2) |
|---|---|
| Opening your account, letting you sign in, storing your financial records and documents, producing reports and analysis, managing your membership, sending account and security emails | Formation and performance of a contract (c) |
| Keeping payment records (preventing the same order from being processed twice, settling refunds and disputes) | Performance of a contract (c), establishment and protection of a right (e) |
| Responding to requests from authorities | Legal obligation (ç) |
| Preventing unauthorized access, bot sign-ups and abuse (IP, login attempts, rate limits, error logs); preventing repeated free trials with the same email | Legitimate interest (f) |
| Protecting our rights in a dispute | Establishment, exercise or protection of a right (e) |
| Sending campaign and announcement emails | Explicit consent (only if you opted in) |
| Measuring site usage with analytics cookies | Explicit consent (only if you accepted them in the cookie banner) |
| Sending your document to the AI service abroad for AI Statement and AI Receipt Scan | Explicit consent (only if you consented on first use, KVKK art. 9) |
4. How We Collect Data
Your personal data is collected electronically, partly by automated means, through forms on the website and Android app, documents you upload, cookies and similar technologies, automatic system logs, Google sign-in and order notifications sent to us by the payment provider.
5. Who We Share Data With
Your financial data is never sold or shared for advertising. It is shared with the service providers below only to the extent needed to provide the service:
| Recipient | Data | Purpose | Location |
|---|---|---|---|
| Veridyen | All data | Server hosting | Türkiye |
| Shopier | Name, email, chosen plan, amount | Taking payments | Türkiye |
| Cloudflare | IP address, request data | Protecting and speeding up the site | Abroad |
| Zoho | Email address, email content | Sending account, security and notification emails | European Union |
| Backblaze | Encrypted backup of all data (we keep the key) | Restoring data | Abroad |
| Google LLC: Gemini | Documents you upload to AI Statement and AI Receipt Scan | Reading the document and extracting transactions | Abroad |
| Google LLC: Sign in with Google | Email address, Google account ID | Authentication (only if you use it) | Abroad |
| Google LLC: reCAPTCHA | IP address, browser signals | Bot prevention at sign-up | Abroad |
| Google LLC: Tag Manager and Analytics, Statcounter, Ahrefs | Cookie ID, IP address, page visits | Site usage measurement (only if you allowed cookies) | Abroad |
| Google LLC: Fonts, jsDelivr | IP address | Loading fonts and site files | Abroad |
| Google LLC: Gmail | Admin notifications such as username, email, deletion reason | Notifying the administrator of sign-ups, payments and deletions | Abroad |
| Authorized public bodies and courts | Requested data | Legal obligation | Türkiye |
6. Retention Periods
| Data | Period |
|---|---|
| Account, financial records, documents | As long as your account is open. When you delete your account, access ends immediately and the data is irreversibly destroyed within 30 days. It also leaves the encrypted backups within 31 days at the latest. |
| Accounts whose trial ended without a membership | Deleted 30 days after the trial ends, with an email notice 7 days before; the 30-day destruction period above then applies. |
| Email address, trial and membership period of a deleted account | 3 years (to prevent repeated free trials with the same email) |
| Deletion reason | 1 year |
| Payment records (order number, plan, amount; buyer email for manually reviewed orders) | 10 years (general limitation period under the Turkish Code of Obligations) |
| Contact form messages | 2 years |
| Security and error logs (including IP) | Up to 2 years |
| Consent and preference records | Until withdrawn, and afterwards for as long as needed to prove the consent while the account is open |
| Cookie choice | 12 months in your browser, then asked again |
| Arrival source (if you did not sign up) | Only in your browser for 7 days, then it expires on its own |
7. Security Measures
- Each user's financial data is kept in a separate database file.
- Passwords are stored as irreversible hashes.
- Connections are encrypted with HTTPS; forms are protected against CSRF.
- Backups are encrypted before they leave the server.
- Administrator access is limited; login attempts and errors are logged.
8. Your Rights Under KVKK
Under Article 11 of KVKK you have the right to:
- learn whether your personal data is processed,
- request information if it has been processed,
- learn the purpose of processing and whether it is used accordingly,
- know the third parties in Türkiye or abroad to whom it is transferred,
- request correction if it is incomplete or inaccurate,
- request deletion or destruction under the conditions of Article 7,
- request that corrections and deletions be notified to third parties it was transferred to,
- object to a result against you arising solely from automated analysis,
- claim compensation if you suffer damage from unlawful processing.
In addition, you can export your data and delete your account yourself in Account Management.
How to apply
Send your request to info@butce.app from the email address you previously gave us and that is registered in our system. Include your name, username and a clear description of your request. We may ask for additional information to verify your identity.
Your request will be concluded free of charge within 30 days at the latest. If it involves an additional cost, the fee schedule set by the Board may apply.
If your request is rejected, you find the answer insufficient, or you get no answer within 30 days, you can file a complaint with the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your request (KVKK art. 14).
9. Cookies
Cookies are small files saved to your browser when you visit the site.
| Type | Examples | Consent |
|---|---|---|
| Necessary | Session, CSRF security token, language preference, the cookie choice itself | Not needed, the site cannot work without them |
| Arrival source (first party) | Which link brought you to the site, kept in your browser's local storage for 7 days. It never goes to a third party and only reaches us if you sign up | Not needed (legitimate interest: measuring which channel brings sign-ups) |
| Analytics | Google Tag Manager and Google Analytics, Statcounter, Ahrefs | Loaded only if you click "Accept" |
On your first visit you can choose "Reject" or "Accept" in the banner; if you reject, analytics cookies are never loaded. You can change your choice at any time here or in Account Management. We do not use advertising cookies.
10. Marketing Emails
Campaign and announcement emails are sent only if you opted in at sign-up or in Account Management. You can withdraw in Account Management or via the link in every email. Account and security emails (verification code, password reset, membership expiry) are sent regardless.
11. Age Limit
butce.app is not intended for people under 18. If you are under 18, get your parent's or guardian's approval before opening an account.
12. Changes
When we update this notice we change the date at the top of the page. We announce significant changes with an in-app announcement.
13. Contact
Data controller: Barış Ağardan
Email: info@butce.app