KVKK Privacy Notice
Data Controller: Fonigeo (the provider offering the Service under the Fonigeo brand)
Contact: destek@fonigeo.com
This notice is provided under Art. 10 of Law No. 6698 on the Protection of Personal Data (“KVKK”) and the Communiqué on Procedures and Principles to be Followed in Fulfilling the Obligation to Inform. The notice is not a separate “consent to processing”. Processing necessary to set up the account and perform the Service rests on the legal ground of establishing and performing a contract (KVKK Art. 5/2-c). Viewing this notice to the end on the registration screen is the record that the notice was given.
1. Collection method
Data are collected from registration and sign-in forms, email verification and password operations, information Google shares to the extent you permit when you sign in with Google, technical transmission by the browser/device, use of the Service (watchlist, saved analyses, consent records), security and audit logs, and (if explicit consent is given) your commercial-message preference.
2. Categories of personal data processed
• Identity/contact: email; name and profile display preferences if provided.
• Account and security: password hash (plain text is not stored), session information, email verification codes, IP address, user agent, sign-in attempt records (success/failure and approximate country/city derived from the IP address).
• Service use: language and theme, watchlist, saved analyses, consent and notice-view records (code, version, time).
• Limited profile Google shares when you register or sign in with Google (e.g. email, display name, Google subject ID).
The Platform does not request or store national ID numbers, tax IDs, bank accounts, card numbers, brokerage customer numbers, wallets or custody accounts.
3. Purposes and legal grounds (KVKK Art. 5)
• Membership, authentication, account set-up and performing the Service — contract (Art. 5/2-c).
• Security, abuse prevention, session and audit records, service continuity — legitimate interest (Art. 5/2-f), and legal obligation where required.
• Handling support requests — contract and legitimate interest.
• Retention, dispute and statutory notification duties — legal obligation (Art. 5/2-ç).
• Commercial electronic messages (announcements, campaigns, product promotion) — explicit consent only (Art. 5/1) and Law No. 6563; declining does not affect the Service.
Automated ranking or calculation outputs are not used as an “automated decision” producing legal effects; the final decision is yours.
4. Transfers and recipient groups
For performing the Service, transfers may be made, only as necessary, to processors such as the email-delivery infrastructure and Google authentication (if you use it). These providers may be located abroad, in which case KVKK’s provisions on cross-border transfer are observed. Approximate country/city is derived from the IP address with a local database on the server; the IP address is not sent to any third party for this. When you sign in with Google, Google may process data under its own notice and terms; this is the natural result of the identity method you chose. Transfers may be made to competent public bodies (courts, prosecutors, CMB, the Personal Data Protection Authority, etc.) where mandatory. Fund data come from public sources; your personal data are not transferred to those sources.
5. Retention periods
Your account data, watchlist and saved analyses are kept while the account is active and deleted when you delete the account. Session (refresh-token) records are deleted automatically at most 30 days after they expire or are revoked; sign-in attempt records (including IP address and approximate location) at most 90 days; security and audit records at most 180 days. Consent and notice records may be kept as proof for the limitation period of disputes. When commercial-message consent is withdrawn, processing for that purpose stops; the consent record may be kept as proof. Verification codes are short-lived.
6. Your rights (KVKK Art. 11)
To learn whether data are processed, request information, learn whether they are used for their purpose, know third parties to whom data are transferred in Türkiye or abroad, request correction, request deletion/destruction, request notification of these actions to third parties to whom data were transferred, object to analysis by automated systems, claim compensation for damage, and withdraw explicit consent. Apply at destek@fonigeo.com (with identification in line with the Communiqué on Application Procedures to the Data Controller). Requests are generally concluded within 30 days. Your right to complain to the Personal Data Protection Board is reserved.
7. Cookies and similar technologies
Strictly necessary/technical cookies or local storage may be used to keep your session, for security and to remember preferences (language/theme). These are necessary to provide the Service. No advertising profiling is intended. Your browser settings may affect cookies; disabling necessary cookies may break sign-in.
8. Security
Passwords are not stored in plain text; access control, encryption in transit and session management are used. Absolute security of internet transmission cannot be promised. Your account-security duties are in the Terms of Use.
9. Children
The Service is not directed at persons under 18. Children’s data are not knowingly processed and are deleted if noticed.
10. Updates
This notice may be updated as processing activities change. The version at registration matches your consent record.
Version: 2026-10-06