Privacy Policy

In short: The core calculators work without an account. If you create an account we process your email address; if you use the profile, social feed, notification and Premium features we process the data those services need. Calculation summaries are sent to our server on a pseudonymous basis to improve the product. If you are signed in, your calculations, the days you open the app and the count of what else you do in it are kept with your account for analytics. On our websites, Microsoft Clarity records how the site is used only if you allow it. We never sell your data.

1. Data controller and scope

Under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), the data controller is Burak Altıntaş (Antalya, Türkiye), reachable at burak.altintas@yahoo.com.tr and info@bankaci.app.

This policy covers:

the Bankacı mobile application (iOS and Android), and
bankaci.app and other Bankacı web properties serving the same content.

Bankacı is an independent professional helper tool; it is not a bank or a financial institution, it does not extend loans and it does not guarantee financial advice.

Request link: a Premium banker may collect membership-free loan requests from their customers through a link they share. For the personal data of the customer who fills in that form, the banker who establishes and uses the customer relationship is the independent data controller; Bankacı acts as a service provider/intermediary only for technically serving the form and delivering the request to the correct banker. If the banker asks, Bankacı also processes the documents sent through the form for Document check (see section 2). The request form links to this Privacy Policy, so the customer who submits it is deemed informed by this text. The app, bankaci.app and KrediBul show banks' featured campaigns. These are the banks' offers; the terms and the application are on the bank's own site. For campaign notifications and how campaigns are counted, see sections 2 and 10. Any other new feature will be reflected in this policy and in in-app notices in advance.

2. Data we process, purposes and legal bases

Data	Purpose	Legal basis
Membership and security: email address, one-time-code records, IP address of a code request, a one-way digest of the session, device name, session and last-seen times	Account creation, email-code authentication, session security, prevention of abuse and fraud	Establishment/performance of a contract and legitimate interests (KVKK Art. 5/2-c, 5/2-f)
Profile and social feed: display name; optional bio, bank/job title and profile photo; post, photo, like, comment, report and block records	Providing the profile and the social feed among bankers, moderation, security and handling complaints	Performance of a contract, your own sharing and legitimate interests (KVKK Art. 5/2-c, 5/2-d, 5/2-f)
Loan AI Assistant: the financing scenario entered by a Premium user (a banker or a loan seeker) — loan type, amount, term, down payment, target instalment, priority and a free-text note of at most a few hundred characters — and the recommendation record produced	Recommending the calculator and payment plan that fit the scenario, reopening the recommendation from the history, preventing abuse and quota overuse	Establishment/performance of a contract and legitimate interests (KVKK Art. 5/2-c, 5/2-f)
Investment AI Assistant: the messages of a Premium user (a banker or a loan seeker), of at most a few hundred characters each, the amount and the term (in days) chosen in answer to the assistant's question, and the record of the comparison shown	Reading the amount and the term; showing the figures for a term deposit, a daily-earning account, a Treasury bill, a fund and a eurobond side by side; reopening the conversation from the history, preventing abuse and quota overuse	Establishment/performance of a contract and legitimate interests (KVKK Art. 5/2-c, 5/2-f)
Premium: RevenueCat pseudonymous user id, verified account email, entitlement, product, purchase/renewal/cancellation events, platform and app version	Verifying the Premium entitlement, carrying it across devices, restoring purchases, disabling ads and locating the account during support	Establishment/performance of a contract and legal obligation (KVKK Art. 5/2-c, 5/2-ç)
Premium advantage redemptions: the code record of the advantage you used (which advantage, your account id and when the code was revealed)	Offering premium-only partner perks, disclosing a discount code solely to a signed-in Premium member, and reporting how many and which members used each perk	Performance of a contract and legitimate interests (KVKK Art. 5/2-c, 5/2-f)
Invite campaign: your invite code; the account ids of the people who opened an account with your code and when they joined; the invite code you entered and its owner's account id; when an earned reward ends and whether it was granted in RevenueCat	Running the invite campaign: counting who joined, granting the 3 months of Premium earned in RevenueCat, and telling the person who invited each join, the reward and a reminder before it ends, by notification and email. The person who invited sees only how many joined, never who	Establishment/performance of a contract (KVKK Art. 5/2-c): you share or enter the code yourself
Notifications: Expo push token, platform, device name, notification ticket/receipt and delivery status	Sending the notifications you allow and troubleshooting delivery	Performance of a contract and legitimate interests (KVKK Art. 5/2-c, 5/2-f); the operating-system permission is obtained separately
Campaign notifications: push token, your campaign notification setting (on or off), whether you are a banker or a borrower, the device's or the account's language, platform and app version; if you have an account, the campaign notification placed in the app's notification inbox	Sending the campaign notifications you turned on. A campaign is notified at most once, at most one campaign notification goes out per week, only between 09:00 and 21:00, and in your language	Explicit consent (KVKK Art. 5/1): it starts when you tap "Yes, notify me" in the app or turn on the "Campaign notifications" switch in Profile, Settings. You can turn it off with the same switch at any time; while it is off, no campaign notification is sent
Weekly rates email: your email address (in the app, your account’s address) and language	Sending the weekly rates email you asked for (the week's average rates and the banks' current rates). You can leave at any time with the link in every email or with the setting in the app	Explicit consent (KVKK Art. 5/1): on the website you tick the box yourself and confirm with the link in the email; in the app you turn the subscription on yourself
My cards and funds: while signed in, the number in our card list of each credit card you add and, as a Premium member, the TEFAS code of each fund you add, with the time each was added. Only which card it is goes in, not the card itself: no card number, expiry date, security code, limit, balance or spending is asked for or stored	Showing you the campaigns that fit your cards, and your funds; keeping the list the same on every device you sign in on	Performance of a contract (KVKK Art. 5/2-c): you add the list yourself and can remove from it at any time
Card campaign alerts: the cards in My cards; the campaign kinds and sectors you chose; whether the notification and the email are on or off, and up to what moment each has told you of campaigns; for the notification, the push token, the account's or the device's language, platform and app version, and the card campaign notification placed in the app's notification inbox; for the email, your account's email address and language, whether you subscribe to the weekly rates email, and the random key of the email's unsubscribe link; a record of each send (the day or week, the campaigns told, notification or email, delivery status)	Telling you of campaigns that came out for your cards and fit the kinds and sectors you chose: at most one notification a day, after the morning card reading, only between 09:00 and 21:00; at most one email a week, usually on Monday, inside the weekly rates email for those who subscribe to it. Besides the new campaigns, the email lists the matching campaigns that end within the next seven days. All of it is in your language. A new campaign is told once on each channel and may appear once more in an email as it nears its end; campaigns that came out before you turned it on are not sent later as new. It is free for every signed-in member	For the notification, performance of a contract (KVKK Art. 5/2-c): it is on once you add a card to My cards, and you can turn it off in My cards in the app at any time. For the email, explicit consent (KVKK Art. 5/1): it starts off and you turn it on yourself in My cards; you can leave it there or with the link in every email. While off, neither is sent
Monthly fund email: the TEFAS codes of the funds in My investment funds; your account's email address and language; whether your Premium membership is current; whether you turned the email off, and the random key of the email's unsubscribe link; a record of each send (the month and delivery status)	Sending Premium members who added funds, once a month in the first week of the month, their funds' latest TEFAS price and its change against the price a month earlier by email	Performance of a contract (KVKK Art. 5/2-c): it is part of Premium and starts on for a Premium member who holds funds. You can stop it at any time with the switch in My investment funds or in one click with the link in every email; it is not sent once Premium ends
Calculation usage data: HMAC digest of a random install id, event id, calculation type, loan/plan type, amount, term, rate, tax rates, result summary, platform and app version; your account, if you are signed in	Improving the calculators, measuring usage trends in a pseudonymous and aggregate way, detecting errors and abuse	Legitimate interests, provided fundamental rights are not harmed (KVKK Art. 5/2-f)
Share and PDF use: that Share or PDF was pressed on a calculation result; which button, in which calculator, the platform, the app version, the time and whether the account was on Premium or free, or that nobody was signed in; your account, if you are signed in. The calculation's figures, anything you typed and your IP address are not part of it. When PDF is pressed without Premium, how that press ended (an ad offered, watched or not opened, Premium chosen, the day's free PDF already used) is also recorded as one value from a fixed list	Seeing how much these features are used, and how that splits between Premium, free and signed-out use, and improving the product accordingly	Legitimate interests, provided fundamental rights are not harmed (KVKK Art. 5/2-f)
App use: if you are signed in, the days you open the app (how many times that day, the first and last open, platform and app version); a daily count of your opening featured campaigns and pressing "Details", viewing KrediBul and card campaigns, your questions the Loan AI Assistant and the Investment AI Assistant answered, and the document checks you run; the calculations you make and your Share or PDF presses while signed in (the two rows above). Which campaign it was, your IP address and your device id are not part of the daily counts	For analytics: seeing how much and how members use the app, and improving the product accordingly. These records, with the counts of other records already kept in your account (for example assistant conversations, KrediBul requests, likes, invites, the cards and funds in My cards), are seen only on our admin screen; they are not used for advertising, not shown anywhere public and not given to third parties	Legitimate interests, provided fundamental rights are not harmed (KVKK Art. 5/2-f)
Website usage recording (Microsoft Clarity): the pages you visit on bankaci.app and kredibul.bankaci.app and the page you came from; clicks, scrolling, mouse and touch movement; device and browser data (device type, operating system, browser, screen size); your IP address (from which Microsoft derives an approximate location), and the pseudonymous id Clarity gives your browser. What you type into forms and areas that show personal details are masked in your browser and not sent to Clarity	Seeing how the site is used through session recordings and heatmaps; finding the places that are unclear, broken or unused and fixing the site accordingly	Explicit consent (KVKK Art. 5/1): it starts when you press "Accept" on the site's bar; if you press "Decline" or make no choice it never starts. You can withdraw it at any time with "Cookie preferences" at the bottom of every page (see section 11)
Loan requests (request link): the full name, phone, optional email, request/loan details, customer note and any documents submitted by the customer who fills the form at a link shared by a banker; the recipient banker, creation time and status records	Delivering the request to the banker who shared the link and letting it be tracked in the app; preventing abuse and fraud. The banker uses this data as an independent controller for their own customer relationship	Performance of the request (the customer's own application) and legitimate interests (KVKK Art. 5/2-c, 5/2-f)
KrediBul request pool: the full name, phone, email, city and request details of the person who leaves a request; their correspondence with bankers (messages, calculations and the banker's "papers to prepare" list) and the documents (PDF, JPG, PNG) they send to a banker they shared their contact details with; the bankers who took the request, the share/not-interested decision and read times. The statement of a banker entering the pool: when it was made, the version of the text accepted and, if given, their bank; each statement is a separate record	Showing the request to the bankers in the pool and corresponding with them; opening the phone, email and documents only to the banker the person shares them with (only the person and that banker can download the documents); recording the banker's statement and checking inconsistencies; preventing abuse and fraud	Performance of the request (the person's own application and sharing decision), legitimate interests and the establishment/protection of a right (KVKK Art. 5/2-c, 5/2-e, 5/2-f)
Document check (Premium bankers): the document a banker checks (a PDF or image sent in a KrediBul conversation, received through the banker's request link or uploaded by the banker from their own device), the details read from it (the document's type and title, name, company name, masked national ID and tax numbers, masked IBAN, employer, document number, plate, chassis and land registry details, credit score, barcode and QR code contents, the e-signature signer's name, dates, amounts), the file name, hashes of the file and its pages and keyed hashes of the ID, tax, IBAN, barcode and document numbers on it, for comparison with earlier checks, the check's result and the banker's mark about the official verification page	Preventing abuse, forgery and fraud; decision support for the banker's credit assessment. On our servers in Google Cloud, Belgium, the document is first recognised by its type (a file that holds several documents is checked one document at a time) and goes through automatic checks (the file's structure, invisible text on its pages, how legible its pages are, the e-signature and whether its certificate comes from a recognised e-signature provider, barcodes and QR codes, the check digits of ID numbers and IBANs, the sums of amounts, a comparison with documents the same banker checked before); the details on it are read by AI and visual inconsistencies on its pages are noted (see section 5). Of a document that carries special categories of personal data, such as a criminal record certificate or a health report, its type, the file name and, if it has one, the official verification code and address are kept; other details read from it (such as a name, numbers, its title or the text of a barcode), quotes from its pages and the AI's notes are not kept, while inconsistencies the checks find are shown in the result. A document whose heading shows such a document while its content is another one is handled the same way, and its content is still checked as that document (for example, whether its amounts add up). The result is shown only to the banker who ran the check; it is not shown to the loan seeker or to other bankers, and no automated decision is made. The result's accuracy is not guaranteed. The banker processes a document they upload themselves as an independent controller for their own customer relationship	Performance of a contract and legitimate interests (KVKK Art. 5/2-c, 5/2-f)
Bringing things in from WhatsApp (Premium): the messages and documents a user selects in WhatsApp and brings into the app with Share › Bankacı or copies and pastes, the note the user adds to them, and the request understood from the message	Turning the request into a calculation and checking the documents. Everything brought in is kept only on the user's phone and is not sent to our servers; names, times and WhatsApp's own lines are removed from the message on the phone, and national ID numbers, tax numbers, phone numbers, IBANs, card numbers and email addresses are masked. This cleaned text goes once to the Loan AI Assistant or the Investment AI Assistant as a note, so that the request can be understood, and that assistant's rules apply; what was understood is kept on the phone as the calculation "Calculate" opens. A message the user copies from WhatsApp and pastes with "New" goes the same way. If they tap "Check the documents", the documents go through Document check. The banker who brings it in is an independent controller of their customer's data	Performance of a contract and legitimate interests (KVKK Art. 5/2-c, 5/2-f)
Advertising: advertising id/IDFA (where permitted), IP, approximate location, device/app info and ad interactions	Serving ads only in non-Premium use, measurement and fraud prevention	Explicit consent for personalisation/cross-app tracking; other applicable legal bases for processing outside non-essential tracking
Communication: the email, request content and reply records you send us	Support, KVKK applications and managing disputes	Performance of the request, legal obligation and establishment/exercise/defence of a right (KVKK Art. 5/2-c, 5/2-ç, 5/2-e)

The OTP code itself is not stored in plaintext; a salt and an HMAC digest are kept. Only a one-way digest of the session token is stored. Calculation events carry no name, email, phone, profile or RevenueCat id. A calculation made while signed out is linked to no account; one made while signed in is kept with your account for analytics. Because pseudonymous data could in theory be matched with additional information, it is not treated as fully anonymous data. Opening a featured campaign and pressing "Details" are kept as one count per campaign, day, surface (app, bankaci.app, KrediBul) and action; who pressed, the account, the device, the IP address and cookies are not part of that count. If you are signed in, it is also added to your own daily count for analytics (see App use).

3. Data that stays on your device

A local copy of your calculation inputs and history inside the app, your preferences and the PDFs generated on the device are kept on your device. You decide with whom to share the customer details you add to a PDF; Bankacı does not upload them to a server for PDF generation. Deleting the app removes the local data on the device; on its own it does not delete your membership account or the data on the server.

The home-screen widget is fed by a summary kept on your device alone; it sends nothing to a server. A home screen is a surface other people can see, so what crosses into it is the names of the shortcuts you chose and your last calculation's amount, term and kind of loan. The monthly instalment, a customer's name, a phone number and the rate never cross, and you can hide the amount too.

Calculating with Siri (iOS 17 and later, Premium): Apple's Siri handles your voice; the app asks for no microphone access and receives no audio, only the amount, term and interest rate Siri understood. The calculation runs on your device; these figures are not sent to our server and are not added to calculation usage data. So that Siri can know about your Premium membership, the app writes to a shared area on your device your Premium status, its end date and when it was last confirmed, whether the feature is switched on, and the server address; this record does not leave the device. Siri fetches the average rate it may offer from our server with a public request that carries no account or personal information.

We do not ask for card numbers, bank account details, national ID number, precise location, contacts, microphone or message content; only which card it is goes into My cards. Sending a document a banker asks for in a KrediBul conversation (for example an ID card) is your decision: it opens only to the banker you shared your contact details with and is deleted 60 days after it is uploaded. Photo access is used only to upload the profile/feed image or the document you choose; the location in a photo is removed when it is uploaded.

4. How we collect data

Data is obtained electronically through the mobile app and web forms, your own upload/share actions, device and operating-system APIs, Apple/Google store records, RevenueCat webhooks, the Expo notification infrastructure, Microsoft Clarity on the website only if you allow it, and automatic technical logs kept for service security. This notice is separate from the processes that require explicit consent; reading the policy does not mean you have given explicit consent for every processing activity.

5. Service providers and recipient groups

The following service providers process data solely for the purposes above:

Google LLC and group companies — Google Cloud Run, PostgreSQL/GCS infrastructure, Google Play, Firebase/FCM and Google AdMob for distribution, hosting, media, notifications, payment and advertising. How Google uses data · Privacy policy
Anthropic, PBC (USA) — only when the Loan AI Assistant or the Investment AI Assistant is used, and in Document check: in the Loan AI Assistant, to turn the financing scenario entered into a recommendation; in the Investment AI Assistant, to read the amount and the term from the message written and to write a short reply. In Document check, the page images and the visible text of the document being checked are sent only so that its type can be recognised, the details on it can be read and visual inconsistencies on its pages (such as misaligned digits or a stamp that looks pasted on) can be noted; special categories of personal data are not read. If the check digits of a national ID number, tax number or IBAN the AI read do not hold, the document's page images are sent once more, asking only for that number. What the assistants send is limited to the product's own scenario schema; a name, national ID number, phone, account or card details are not asked for. In the Investment AI Assistant, your message goes with only the amount and term you chose in answer to the assistant's question, the day's date, the language of the reply, whether you are a banker or asking for yourself, and what the assistant asked or which options it showed in its previous answer; before the reply is shown, its text alone is read once more by Anthropic's model. Neither assistant adds anything that identifies your account (an e-mail address, an account id) to the request. If typed into the note, national ID numbers, tax numbers, phone numbers, IBANs, card numbers and e-mail addresses are masked before sending; a name is not, so do not type anyone's name in the note. A message written to the Investment AI Assistant is masked the same way, and a name in it is not masked. When a message brought in or pasted from WhatsApp is read, the assistant gets the text with names and times already removed on the phone and the numbers masked. Earlier messages of the same conversation are sent with each new one; other past conversations, payment schedule rows and customer records are not sent. Anthropic's model also reads the banks' rates every week; only the text of the banks' public pages goes to that reading, and no personal data. Anthropic stores the data in the USA; the model may process it on Anthropic's infrastructure in other regions of the world. Privacy policy
RevenueCat, Inc. (USA) — verifying and managing subscription status; matching the verified account email with the subscription record during support. Privacy policy
Apple Inc. and group companies — App Store distribution, payment, subscription, APNs notification infrastructure and Siri. Privacy policy
Microsoft Corporation (USA) — only if you pressed "Accept" on the website, session recordings and heatmaps with Microsoft Clarity (see section 11). Under Clarity's terms of use Microsoft is not a service provider processing this data on our behalf but a controller independent of us: it may use the data under the Microsoft Privacy Statement to provide the service and also for its own purposes, including improving its products and advertising. It is the one recipient on this list whose purposes are not limited to the ones above. What you type into forms and masked areas are not sent to Microsoft. Microsoft Privacy Statement
Expo / 650 Industries, Inc. — push token, notification delivery and delivery result.
Email service provider — delivery of OTP, new-account welcome, weekly rates, card campaign and monthly fund emails.
Competent public authorities and legal advisers — only in case of a legal obligation, establishment of a right or a lawful request.

We do not sell or rent your data. Only the data categories required for the relevant service are transferred to service providers.

6. Payments, Premium and ads

Subscription payments are handled entirely through the Apple App Store or Google Play. We do not see, process or store your card details. RevenueCat processes the store receipt, entitlement status, pseudonymous user id and the verified account email so the account can be found during support. The email is not used as the primary entitlement id in RevenueCat or for ad tracking. Cancellation and refunds are subject to the rules of the relevant store. Deleting your account does not automatically cancel the store subscription; you must also cancel it from your App Store or Google Play subscription settings.

Premium earned through the invite campaign is not bought from a store: it is granted in RevenueCat for a set period, nothing is charged, and it does not renew when it ends.

No ads are shown to Premium users and no ad-removal control is offered to them. In non-Premium use AdMob may process data. iOS cross-app tracking and legally required ad-personalisation choices are managed through separate permission mechanisms.

7. International transfers

The infrastructure of Google, Apple, RevenueCat, Expo, Anthropic, Microsoft and the email provider may operate outside Türkiye or globally. The relevant data categories may therefore be transferred abroad.

Microsoft Clarity: the website usage recording goes to Microsoft Corporation (USA) and is stored on Microsoft's cloud infrastructure. This transfer starts only with the explicit consent you give by pressing "Accept" on the site's bar; without it, nothing is sent to Microsoft for Clarity. With a recipient outside Türkiye, the level of protection for personal data and the ways to seek redress may not be the same as in Türkiye. Not consenting, or withdrawing consent, does not change how you can use the site.

Transfers rely on whichever of the mechanisms in KVKK Art. 9 is applicable — an adequacy decision, an appropriate safeguard (such as a standard contract announced by the Board) or one of the incidental situations in the law. Where a transfer requires explicit consent, that consent is requested separately from this notice. For users in the European Economic Area, Chapter V mechanisms of the GDPR are used to the extent applicable.

8. Retention periods

OTP: the code is valid for 30 minutes and single-use; security/rate-limit records are kept until the appropriate technical clean-up.
Session: expires after 90 days or is revoked on logout; security records may be kept with limited access until periodic clean-up.
Account/profile/feed: until the account or the relevant content is deleted; report/moderation and legal-dispute records may be kept with limited access for the required period.
Loan AI Assistant and Investment AI Assistant: the scenario or the messages you wrote, and the answer produced, are kept against your account so you can reopen them from the history, and are deleted after 180 days at the latest; deleting your account deletes them at the same time. Each assistant's history shows only its own conversations. The history shows the 20 most recent conversations; older ones are also kept for up to 180 days. A conversation you continue from the history is saved as a new conversation, and its period starts then. The two assistants share one daily allowance. The daily usage counter is kept for that day only and deleted the next day. Anthropic deletes what is sent to it and the answer it produces within 30 days, under the rule it documents for API data; content flagged as violating its Usage Policy may be kept for up to 2 years, and for as long as the law requires where it does (Anthropic's retention rule).
Brought in from WhatsApp: kept only on the phone of the user who brought it in; it is not sent to our servers or backed up, and it is deleted from the phone after 60 days, when the user deletes it or when they sign out.
Loan requests: the name, phone, optional email, customer note and documents submitted in the form are tracked by the banker who owns the request link; not kept longer than needed for the service, security and legal obligations. Documents sent with the form are deleted 60 days after they are uploaded. Communication data is not included in product analytics.
KrediBul: requests are deleted with their correspondence 180 days after they close (expire, are withdrawn or are closed). Documents sent in the correspondence are deleted 60 days after they are uploaded; the sender can delete them sooner, and deleting their account deletes their documents too. A banker's statements are kept until the banker's account is deleted.
Document check: a file the banker uploads from their device is not kept; it is processed only during the check. Check results are deleted after 60 days at the latest; if the source document is deleted sooner, its result is deleted with it. The daily check counter is kept for that day only and deleted the next day. For the pages sent to Anthropic, the retention rule given for the AI assistants applies (Anthropic's retention rule).
Premium advantage redemptions: kept while the advantage is live and your account remains open; after the advantage is removed or your account is deleted, only aggregated/limited records needed for reporting may be retained.
Invite campaign: the invite and reward records are kept while your account remains open; deleting your account deletes your code, the record of the code you entered and your reward record together.
Calculation analytics: raw pseudonymous events for at most 180 days; external reports are produced only from aggregated groups meeting a threshold of at least 20 distinct installs.
Share and PDF use: at most 180 days.
App use: the days you open the app and the daily counts are deleted after 13 months; calculations and Share or PDF presses are kept for at most 180 days, as above. If you delete your account, the days and daily counts are deleted at the same time; the link between your calculations and presses and your account is removed, and they stay, as if made while signed out, until their period ends.
Push token: until logout, disabling the device registration, the provider reporting it invalid, or account deletion.
My cards and funds: until you remove them from the list or delete your account; deleting the account deletes them at the same time. The app keeps a copy of the list on the device so it opens quickly; signing out deletes that copy.
My cards on the web: in your browser only, until you remove the cards or clear the site's data in your browser; not kept on our server.
Card campaign alerts and monthly fund email: your settings (on or off, the kinds and sectors you chose) until you change them or delete your account; deleting the account deletes them at the same time. Send records are deleted after 90 days.
Campaign notification setting: together with the push token, until the device registration is deleted. Per-campaign counts are tied to no one and are kept with the campaign record.
Purchase and ad records: for the retention periods of Apple, Google, RevenueCat and the ad provider and for the duration of legal obligations.
Support/KVKK applications: for the period needed to resolve the request and for any dispute limitation period.
Weekly rates email: the email address and language, for as long as you are subscribed; deleted as soon as you unsubscribe. Unconfirmed sign-ups are deleted within 9 days at the latest.
Backups: daily backups of the database are kept encrypted with restricted access and deleted after 30 days at the latest; when you delete your account or any data, it leaves the backups within that period too.
Website usage recording (Microsoft Clarity): recordings are kept at Microsoft for Microsoft's Clarity retention periods. Your answer on the bar stays in your browser only, until you change it or clear the site's data in your browser.

9. Data security

HTTPS/TLS, one-way token digests, OTP HMAC, access controls, Google Cloud IAM, file type/size validation, rate limiting and structured security logs are used. No system can guarantee absolute security.

10. Social feed, notifications and visibility

Reading the feed may be public. The display name, photo, bio, profession/bank information and content you share on your profile and in the feed may be seen by other users. Do not upload special categories of personal data, customer secrets, banking secrets, third-party financial/contact information or content you are not authorised to share.

Notification permission is requested by the operating system and can be turned off in device settings. Comment text, email or the name of the commenter is not placed in the notification payload. Campaign notifications also depend on your consent and are off to begin with. You are asked once, the first time you open the new version; you can change your answer at any time with the "Campaign notifications" switch in Profile, Settings. A campaign notification carries the bank's name and the campaign's title, and none of your personal details.

The card campaign notification, by contrast, is on once you add a card to My cards; if you would rather not have it, turn it off in My cards. It shows your card's programme or bank (for example "New campaign for your Bonus card") and the campaigns' titles or their count; it can show on the lock screen, so anyone who sees your phone can read which card you use. It carries none of your other personal details. If you would rather not, turn the notification off in My cards or hide lock-screen previews in your device settings.

11. Cookies on the website and Microsoft Clarity

Alongside its promotional and legal-information pages, bankaci.app may offer a membership-free loan-request form via a link shared by a banker. The form links to this Privacy Policy, form data is sent to the relevant banker with explicit approval, and no payment is taken through the web. bankaci.app also uses a cookie, NEXT_LOCALE, valid for a year, to remember the language you read it in; it carries only the language (tr or en).

Microsoft Clarity: bankaci.app and kredibul.bankaci.app use Microsoft Clarity to understand how the site is used, and only if you allow it. Clarity records the pages you visit and your clicks, scrolling, mouse and touch movement as session recordings and heatmaps; it also receives device and browser data and your IP address (from which Microsoft derives an approximate location). What you type into forms and areas that show personal details (request forms, the rates email sign-up, the calculator boxes) are masked in your browser and not sent to Clarity. The controller of these recordings is the controller named in section 1; Microsoft is a controller of the same data independent of us (see sections 5 and 7).

The bar at the bottom of the page offers two equal choices: "Accept" and "Decline". Until you choose, Clarity is not loaded, sets no cookie and nothing goes to Microsoft; making no choice counts as declining. If you press "Decline", Clarity is never loaded and your answer is remembered. You can change your decision at any time with the "Cookie preferences" link at the bottom of every page. When you withdraw consent, Clarity is stopped on that page at once (the page reloads, as do the site's other open tabs where Clarity is running) and the site's _clck/_clsk cookies are deleted; you can delete Microsoft's cookies on its own domains in your browser's settings. The portal (/premium), which needs signing in, the admin pages and the request-link forms (/r/) do not load Clarity, even though they open on bankaci.app; on kredibul.bankaci.app, the request reply and conversation pages opened from a link in an email do not load it either.

What is kept in your browser: your answer is kept in your browser's local storage (localStorage) under bankaci-analytics-consent, as "granted" or "denied" with the date of the answer. It is not a cookie, it is not sent to our server, and it is read only so the bar is not shown again. Each site keeps its own answer: bankaci.app and kredibul.bankaci.app ask separately, and a choice on one does not apply to the other. If you accept, Clarity's cookies are set too: _clck (the id Clarity gives you and its preferences) and _clsk (joins the pages of one visit into one recording). Clarity sets these two not on each site's own address but on the parent domain, .bankaci.app, so if you accept on both sites, both use the same cookies and so the same pseudonymous id in Clarity, and withdrawing consent on one deletes these shared cookies (Clarity on the other site then gives you a new id). Microsoft's own cookies are set on Microsoft's domains. The full list is on Clarity's cookies page. If another analytics or advertising tool is ever added, this section is updated first and your permission is asked with the same bar.

My cards on the web: the cards you add to My cards on bankaci.app's card and campaign pages, without an account, are kept in your browser's local storage (localStorage) too, under bankaci.kartlarim: for up to 20 cards, the card's number in our card list and its page address, its name, its bank, and the keys that match it to campaigns (bank, card programme and card scheme). Nothing of the card itself (card number, expiry date, limit) is asked for. The list is read in this browser only, so that "My cards" on the campaign lists can show the campaigns valid for your cards. It is not a cookie, it is not sent to our server, and it is not linked to My cards in the app or to your account. You can remove a card with the "In my cards" button on its page or in a list, or all of them with "Remove all" in "Edit my cards", or delete them by clearing the site's data in your browser.

12. Children's privacy

Bankacı is aimed at professionals and is not directed at persons under 18. If we notice that a child's data has been processed without authorisation, we apply deletion and the necessary protective steps after verification.

13. Account deletion and KVKK rights

Under KVKK Art. 11 you have the right to learn whether your data is processed, to request information, to learn whether it is used for its purpose, to know the third parties to whom it is transferred, to request correction of incomplete/incorrect data, to request erasure/destruction where the conditions are met and notification of these to recipients, to object where an automated analysis produces a result against you, and to claim compensation for damage arising from unlawful processing.

You can delete your account directly from the "Delete account" option at the bottom of the Profile page in the mobile app, after a two-step confirmation. You can send other requests to the email address below with the subject "Bankacı KVKK Application". For security we may need to verify that the account belongs to you. Requests are concluded as soon as possible and within 30 days at the latest; where a cost arises, the conditions in the Board's tariff are reserved.

Account deletion starts the process of deleting active sessions, the profile and related data or anonymising/restricting records that must be kept by law. Public feed content is also deleted unless it must be kept by law. Deleting the app does not delete the account; deleting the account does not cancel your Apple or Google subscription. Applications: info@bankaci.app.

If your application is refused, the reply is inadequate or no reply is given in time, you may complain to the Personal Data Protection Board within 30 days of learning of the reply and in any case within 60 days of the application. Applicable GDPR rights of EEA users and the right to apply to the local supervisory authority are separately reserved.

14. Changes to this policy

This policy may be updated from time to time. Every update changes the effective date and version number on this page. Where a change materially affects your rights, we notify you inside the app before it takes effect and, where required, ask for your consent again.

15. Contact

Data controller: Burak Altıntaş — Antalya, Türkiye
Email: burak.altintas@yahoo.com.tr · info@bankaci.app
Web: burak-altintas.com