Data Protection Notice

This is an English translation of our Turkish data protection notice, provided for convenience. In the event of any discrepancy, the Turkish version prevails.

This notice is provided under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), which governs the processing of your personal data by us as the data controller. It applies to all users of the application, wherever they are located.

1. Data controller

Data controller	Muhammed Mutlu Güler — mmgcreativity (an individual, tax-exempt; not a commercial enterprise)
Postal address	Alaaddinbey Mah. 244. İsimsiz Sok. No: 6/1, Nilüfer / Bursa, Türkiye
E-mail	info@mmgcreativity.com
Application	mmgcreativity Dijital Finans Asistanı (mmgcreativity.com · Google Play)

2. Personal data we process

• Identity and contact data: name, username, e-mail address, phone number.
• Customer transaction data: subscription status, order and invoice records, support correspondence.
• In-app content: income and expense records, cash flow tables, calculation inputs, payment instructions and company profile details, bank account (IBAN) details, customer/supplier and staff records.
• Security data: IP address, device and browser information, session and sign-in logs.
• Usage and advertising data: usage statistics, notification preferences, push (FCM) device token; in the free version, the advertising identifier and cookie-based data used to serve ads.

Your payment card details are never seen or stored by us at any stage. The premium subscription is sold only through Google Play; collection and invoicing are handled by Google Play Billing. Only your subscription status (active/inactive) and the order identifier are passed on to us.

3. Purposes of processing

• Creating your account, authentication and session management.
• Providing the services, storing and synchronising your data.
• Recognising a premium subscription purchased through Google Play and tracking its status.
• Answering support requests and communicating with you.
• Keeping the service secure, detecting faults and preventing abuse.
• Meeting legal obligations and responding to requests from competent authorities.

4. Legal bases

Your personal data is processed on the following legal bases set out in Article 5 of the KVKK:

• Processing is directly related to the conclusion or performance of a contract (Art. 5/2-c) — account and subscription operations.
• Compliance with a legal obligation of the data controller (Art. 5/2-ç) — disclosure upon a lawful request.
• Legitimate interests of the controller, provided your fundamental rights are not harmed (Art. 5/2-f) — security, fault detection, service improvement.
• Explicit consent (Art. 5/1) — optional processing such as push notifications and non-essential cookies.

5. Transfers

To deliver the service, your personal data is transferred to the following categories of recipient:

• Google / Firebase (authentication, Firestore database, Cloud Functions, FCM push notifications and hosting).
• Google Play Billing (subscription purchase, collection and invoicing).
• Google Analytics (usage statistics; device/browser information, session and interaction data).
• Google AdSense (ads in the free version; advertising identifier and cookie-based data). For premium subscribers the ad script is never loaded and this transfer does not take place.
• Resend (transactional e-mails such as password resets; e-mail address and name).
• Competent public authorities, where required by law.

The income and expense records, bank details, customer/supplier and staff records and payment instructions you enter into the application are never shared with or sold to any third party for advertising or marketing purposes. They are stored on Firebase infrastructure solely to be shown to you (and to the company users you authorise).

Because these service providers may operate infrastructure outside Türkiye, your data may be transferred abroad within the meaning of Article 9 of the KVKK. Such transfers are made only to the extent necessary to perform the service and with appropriate security measures in place.

6. How we collect data

Your data is collected wholly or partly by automated means — through information you enter yourself on the website and in the mobile application, automatic system records (logs, cookies) and transaction notifications received from the payment provider.

7. Retention periods

• Your account and in-app data is kept for as long as your account is active.
• Following a deletion request, data that is not subject to a statutory retention obligation is deleted or anonymised within 30 days.
• Subscription and purchase records are held by Google Play; we keep only the subscription status and order identifier, for one year after the subscription ends, for dispute and refund purposes.
• Security and transaction logs are kept for the periods required by applicable legislation.

8. Your rights under Article 11 of the KVKK

By applying to the data controller you have the right to:

• learn whether your personal data is being processed and, if so, request information about it;
• learn the purpose of processing and whether the data is used in line with that purpose;
• know the third parties in Türkiye or abroad to whom the data is transferred;
• request correction of incomplete or inaccurate data;
• request erasure or destruction of the data under the conditions set out in Article 7 of the KVKK;
• request that any correction, erasure or destruction be notified to the third parties to whom the data was transferred;
• object to a result reached to your detriment through analysis carried out solely by automated systems;
• claim compensation if you suffer loss because of unlawful processing.

9. How to apply

To delete your account and your data, follow the steps on the Account & Data Deletion page. For any other request, write to info@mmgcreativity.com with information verifying your identity, or send a written application to the postal address above. Depending on its nature, your request is answered free of charge within 30 days at the latest. If responding involves an additional cost, the fee set out in the tariff published by the Turkish Personal Data Protection Board may be charged.