Privacy Policy

This English version is provided for convenience. The Turkish version is the authoritative text; if the two differ, the Turkish version prevails.

1. Data Controller

Under Turkish Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed within the scope described below by Turgut Akın Kaya (a natural person operating under the "DoTa Medya" brand) as the data controller, resident in Çeşme, İzmir, Türkiye (full notification address is provided on request).

• Email: info@vademde.com
• Phone: +90 543 203 53 09

2. Categories of Personal Data We Collect

• Account data: name, email address; and, if you use Sign in with Apple, the identity information shared by Apple.
• Financial document data: images of the cheques, promissory notes, invoices, loan payment plans, credit card statements and similar documents you scan, and fields read from them such as amount, date, counterparty, IBAN and document number.
• Financial records you enter manually: income, expenses, debts, receivables, accounts, categories and person/company details.
• Subscription and purchase data: your plan choice and subscription status. Payment details such as card numbers are not stored by us; payments are processed directly by the Apple App Store in the mobile app and by our payment service provider Shopier on the website.
• Device and usage data: app version, operating system, error logs and notification permission status.
• Usage analytics (only with your explicit consent): if you turn on Settings > Privacy > Usage analytics in the mobile app: which screens and subscription steps (viewing the subscription screen, choosing a plan, starting payment) are used, the time of the event, app version and iOS/Android information. These events are linked to your account; amounts, document contents, or person or company details are never added to them.

3. Purposes of Processing

• Creating your account, verifying your identity and managing your session.
• Classifying the documents you scan, extracting fields such as amount/date/counterparty with AI-assisted optical character recognition (OCR), and presenting them for your approval.
• Creating debt, receivable, income, expense and due-date records from the data you approve; managing the due-date calendar and reminder notifications.
• Managing your subscription plan and OCR quota, and verifying purchase transactions.
• Keeping the service secure, detecting errors and providing technical support.
• Fulfilling our legal obligations.

The AI working on your documents never creates a final financial record on its own; every OCR result is presented for your review and approval before it becomes a record. If you turn on usage analytics, it is used to understand which features are used and where you struggle in subscription steps in order to improve the product; it is not used for advertising or profiling and is not shared with third parties.

4. Legal Basis

Your personal data is processed on the legal bases of "being directly related to the establishment or performance of a contract" and "the legitimate interests of the data controller" under KVKK Art. 5/2; the transfer of document images to an AI service based abroad (see Section 5) is based on your explicit consent obtained separately within the app, pursuant to KVKK Art. 9. Usage analytics rely solely on the consent you explicitly give in Settings under KVKK Art. 5/1; you can withdraw your consent at any time with the same switch, after which no new events are collected.

5. Who We Share Your Data With

We do not sell your data to third parties for marketing purposes. To provide the service, limited data sharing appropriate to the purpose takes place with the following service providers:

• Supabase Inc. (database, authentication and file storage): your account and financial record data is stored in isolation with access policies specific to your workspace (row-level security).
• Google Gemini API: your document images are sent to this service by the server only for the purpose of field extraction and only after your approval; the access key is never embedded in the mobile app.
• RevenueCat and the Apple App Store: used to verify and manage your subscription status.
• Shopier (Şeref Efe Bilgi Teknolojileri Tic. A.Ş.): when you purchase a subscription on the website, your email address and payment status are shared with Shopier to carry out the payment and match the subscription to your account; your card details never reach Vademde.
• Apple (Sign in with Apple, notifications): enables signing in and sending you notifications.

These service providers may host servers outside Türkiye; in that case the transfer is based on your explicit consent under KVKK Art. 9. Unless legally required, your data is not shared with third parties outside this list.

6. Data Security

• Each workspace's data is completely isolated from other workspaces through row-level security (RLS) policies.
• Your documents are kept in a private, non-public storage area; access is provided only through short-lived, signed links.
• Your session information is stored on your device in an encrypted secure store (Keychain/Keystore).
• Service keys and model API keys are never embedded in the client app; document analysis is carried out only on the server side.
• Data is encrypted in transit (TLS).

7. Data Retention

Your financial records (structured data such as amount, date and counterparty details) are kept until you delete the relevant record or your workspace. The raw image of a scanned document is kept according to your preference under Settings > Privacy in the app: if "Keep scanned documents" is on, until you delete it; if off (the default), it is deleted automatically as soon as the AI analysis is complete. When you delete your account, all data (including documents) is permanently deleted, except for records that must be retained by law. Usage analytics events are retained until your account is deleted and are deleted along with your account.

8. Your Rights (KVKK Art. 11)

By contacting us about your personal data, you may exercise the following rights:

• Learn whether your data is processed and request information if it has been,
• Learn the purpose of processing and whether it is used in line with that purpose,
• Know the third parties to whom it is transferred, at home or abroad,
• Request correction if it is incomplete or inaccurate,
• Request deletion or destruction when the conditions of KVKK Art. 7 are met,
• Request that these actions be notified to the third parties to whom the data was transferred,
• Object to an outcome against you that arises from the analysis of the processed data exclusively by automated systems,
• Claim compensation for damages if you suffer harm due to unlawful processing.

To exercise these rights, you can apply in writing to info@vademde.com with information verifying your identity; your application is concluded within 30 days at the latest. You can also delete your account and all your data directly from within the app at any time (Settings > Delete My Account and Data).

9. Cookies

Apart from managing your session, our website (www.vademde.com) does not currently use any tracking, analytics or marketing cookies. When you are redirected to Shopier's payment page to buy a subscription, Shopier may use its own cookies subject to its own cookie policy; these cookies are not under our control. If we start using tracking cookies on the site, we will update this policy and present you with a consent step in the app or on the site.

10. Children's Privacy

The service is not directed at people under 18 and we do not knowingly collect personal data from children. If we become aware that we have collected data from a user under 18, we delete it.

11. Policy Changes

We may update this policy from time to time. We announce important changes through in-app notification or email. The current version is always published on this page and in the app.

12. Contact

For privacy questions: info@vademde.com or +90 543 203 53 09.