Data processing agreement

This Data Processing Agreement forms part of the Terms of Service and is drafted in line with KVKK Art. 12 and, for customers in the EEA, GDPR Art. 28. For the personal data you enter for your own business (your customers, contact persons, employees) you are the controller and İbrahim Özgül is the processor. Account, subscription and security data are covered by the Privacy notice, not by this agreement.

We process the data only to provide the service and as instructed by your actions in the application and your written instructions; we do not use it for our own purposes, sell it or combine it with other data. If we believe an instruction is unlawful, we tell you.

• Data subjects: your customers and their representatives, supplier contacts, your team members.
• Data types: name, company, phone, email, address and city, quote, project, expense and payment records, information in documents you upload.
• Duration: during your subscription and until the deletion periods below have passed.

Processing of special categories of data is not intended; you should not enter such data.

Only authorised people who need access to provide, support and secure the service can access the data, and they are bound by confidentiality. If support requires access to your data, we do so only at your request or where security requires it.

• TLS encryption in transit; encryption of stored database and file data (at the hosting provider).
• Separation of each company's data by database row-level security; roles without permission cannot see cost data.
• Private file storage; revocable, unguessable share links.
• Secret keys kept on the server only; least-privilege access.
• Important actions recorded in the activity log.
• Regular database backups (kept at most 7 days).

We use these sub-processors: Supabase Inc. (database, sign-in, files; Frankfurt, Germany), Hostinger International Ltd. (application server; Vilnius, Lithuania), Resend, Inc. (email delivery; EU region), Paddle.com Market Ltd. (subscription and payment data only; United Kingdom) and, only if you turn it on, Anthropic PBC (AI document reading; USA). We inform you at least 15 days before adding a new sub-processor; if you object on reasonable grounds you may end the subscription with a refund. Sub-processors are bound by obligations equivalent to the protections in this agreement.

Because sub-processors are outside Türkiye, data is transferred abroad. These transfers rely on standard contracts under KVKK Art. 9 and, for EEA customers, on the EU Standard Contractual Clauses. Standard contracts are notified to the Personal Data Protection Authority within 5 business days.

We provide the tools you need to answer requests from your customers or other data subjects: finding, correcting, deleting and exporting records. A request sent directly to us is forwarded to you without answering it.

When we become aware of a security breach affecting your data, we inform you without undue delay and within 48 hours at the latest, describing as far as known the nature of the breach, the data and people affected and the measures taken, so that you can make any notifications to the Board and data subjects required by law.

When the subscription ends you can export your data. When you delete your company, data is permanently deleted at the end of the 14-day undo period; copies in backups disappear within at most 7 days. Records that must be kept by law are retained only for that purpose and period.

On reasonable request we provide information showing compliance with this agreement. Audits are announced in writing in advance, held at a reasonable frequency and carried out without endangering the service or other customers' data.

AI is used only when you turn it on in your company settings, and only to read the pages of a PDF or image price list you upload for import. Your customer records are not sent. Nothing is saved until you review and confirm each extracted row. The feature is off by default and can be turned off at any time.