Data controller
Under the Turkish Personal Data Protection Law No. 6698 (“KVKK”), your personal data is processed by BorteStudios (Istanbul, Türkiye) as data controller, within the scope described below. Contact: support@supbor.com
This is an English translation provided for convenience. In case of conflict, the Turkish version prevails.
Personal data processed
| Category | Data |
|---|---|
| Identity | Name (with Google sign-in, as shared by Google) |
| Contact | Email address |
| Customer transaction | User ID, email verification status; subscription, bill and spending records entered by the user (name, amount, currency, category, date, note) |
| Transaction security | Sign-in data, technical connection data (IP address) |
| Request/complaint management | Contents of support correspondence |
App lock uses Android’s device authentication; we do not process biometric data. App preferences, the widget summary and encrypted backup files are kept only on the user’s device and are not transferred to us.
Purposes
- Managing accounts and providing secure sign-in,
- Storing the user’s records and syncing them between devices,
- Providing and improving the App’s services,
- Running information security processes and preventing abuse,
- Responding to requests and complaints,
- Fulfilling legal obligations and informing competent authorities.
Legal grounds
Your personal data is processed on the following grounds in Article 5 of the KVKK:
- Necessary for the establishment or performance of a contract (Art. 5/2-c): account creation, storing and syncing records,
- Necessary to comply with a legal obligation (Art. 5/2-ç),
- Necessary to establish, exercise or protect a right (Art. 5/2-e),
- Legitimate interest of the data controller, provided it does not harm your fundamental rights and freedoms (Art. 5/2-f): service security and abuse prevention.
Collection method
Your personal data is collected electronically and by automated means through the SupBor mobile app, sign-in via Firebase Authentication (email/password or Google sign-in), the supbor.com website and email.
Transfers, including abroad
Your personal data is transferred, limited to the purposes above, to the following service providers:
- Google LLC / Google Ireland Limited (Firebase Authentication, Cloud Firestore): storing accounts and records. Records are kept in Firestore’s Europe (eur3) region.
- Vercel Inc.: hosting supbor.com.
Because these providers’ servers are located abroad, your personal data is transferred abroad in accordance with the conditions of Article 9 of the KVKK. Otherwise, your data may be transferred only to legally authorised public authorities, upon request and to the extent required by law. Your data is never sold or shared for advertising.
Retention
Your personal data is kept while your account is open. When you delete your account in the App or via the Account and Data Deletion page, your cloud records and account are permanently deleted. Support correspondence is kept for up to 1 year after the request is resolved. Where a statutory retention obligation applies, data is kept for that period.
Your rights under Article 11 of the KVKK
By applying to the data controller, you have the right to:
- learn whether your personal data is processed,
- request information if it has been processed,
- learn the purpose of processing and whether data is used in line with that purpose,
- know the third parties in Türkiye or abroad to whom data is transferred,
- request correction if data is incomplete or inaccurate,
- request deletion or destruction under the conditions of Article 7 of the KVKK,
- request that correction and deletion be notified to third parties to whom data was transferred,
- object to a result against you arising exclusively from automated analysis,
- claim compensation if you suffer damage from unlawful processing.
How to apply
Send your request from the email address registered to your account to support@supbor.com, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller. Include your name, surname, the email address of your account and the subject of your request. Requests are resolved free of charge within 30 days at the latest. We may ask for additional information to verify your identity.
If your request is rejected, you find the answer insufficient or no answer is given in time, you may lodge a complaint with the Turkish Personal Data Protection Board.
See the Privacy Policy for more detail.