KVKK Privacy Notice

This notice concerns the Kraftera Business Suite application provided at app.kraftera.com. If you are only visiting the kraftera.com marketing site, that site's own Privacy Policy applies.

KRAFTERA YAZILIM SANAYİ VE TİCARET LİMİTED ŞİRKETİ Sasalı Merkez Mah. 172 Sk. No:10, Çiğli / İzmir, Türkiye MERSİS: 0589111065400001 · Trade Registry No: 269240 Tax Office / No: Çiğli T.O. / 5891110654 E-mail: info@kraftera.com

Kraftera comes into contact with two different sets of data, and its position is not the same in each. (A) Account data — Kraftera is the data controller. The data of the person and company registering for the application: account details, billing details, payment records, workspace memberships. This notice is about that set. (B) Content you enter into the application — Kraftera is the data processor. Records belonging to your customers, staff and suppliers that you enter into the application (CRM records, staff information, invoice recipients, appointments, documents). You are the data controller for that data; Kraftera only hosts and processes it on the infrastructure it makes available to you. The practical consequence: informing the people in set (B), obtaining their consent and meeting their requests is your obligation. Kraftera provides you with the technical means, but does not assume your legal responsibility.

All of the following belong to set (A) account data and are collected electronically. You enter most of it directly; some comes from Google if you sign in with Google, and session and login records are created automatically as you use the service. • Identity: Full name; Turkish ID number on individual invoices, tax number, tax office and company title on corporate invoices • Contact: E-mail address, phone number • Address: Billing address, province, district, postal code • Customer transaction: Subscription plan and period, payment amount and status, payment references, contract consent records • Transaction security: Password (stored irreversibly hashed), session IP address and browser/device information, login records • Visual: Profile photo — if you enter an image address in Settings or it comes from your Google account Sign in with Google: If you choose this method, Google sends us your name, e-mail address, whether that e-mail is verified, and your profile photo if any. Your Google account password never reaches us.

Payment is processed through iyzico, a payment institution authorised in Turkey. The card number, expiry date and security code go directly to iyzico; they never enter Kraftera's systems at any stage and are not stored. We only hold the amount, date and status of the payment and the transaction reference issued by iyzico.

• Creating the account, authentication, providing the service — KVKK art. 5/2-c, establishment and performance of a contract • Issuing invoices, keeping and retaining financial records — art. 5/2-ç, legal obligation (Turkish Tax Procedure Law, Turkish Commercial Code) • Running subscription and payment processes — art. 5/2-c, performance of a contract • Recording and proving acceptance of the distance sales agreement — art. 5/2-ç and 5/2-f • Account security, protection against unauthorised access and bots — art. 5/2-f, legitimate interest • Mandatory service notifications — art. 5/2-c, performance of a contract • Detecting and fixing application errors — art. 5/2-f, legitimate interest • Advertising measurement — art. 5/1, explicit consent. This is the only processing based on consent; it does not take place if you decline in the cookie banner. No purpose other than advertising measurement requires your explicit consent. Processing your data to create your account, provide the service and issue invoices relies on the other conditions set out in the law; you do not need to give consent for these, and withdrawing consent does not stop them. Special categories of data: within set (A) account data, Kraftera does not collect special categories of personal data listed in KVKK art. 6 (health, religion, biometric data and so on). The Turkish ID number is not a special category of data; it falls under identity data and is processed solely to issue invoices.

The following service providers are used so the service can operate. Each receives only the data required for its own function. WITHIN TURKEY • iyzico (established in Turkey, authorised payment institution) — Full name, e-mail, phone, billing address; Turkish ID number on individual invoices, company title on corporate invoices. Purpose: taking and verifying payment. OUTSIDE TURKEY — SERVER SIDE Data reaches these parties for the service to work, even if you do nothing. • Supabase (Ireland) — All account data and the files you upload. Purpose: database, authentication, file storage. • Vercel — Serving the application interface; IP address in request logs. Purpose: hosting. • Resend — Recipient e-mail address and message content. Purpose: sending service e-mails. • Google — Authentication details if you sign in with Google. OUTSIDE TURKEY — CONNECTIONS MADE BY YOUR BROWSER Your browser makes the following connections; your IP address and browser/device information reach the relevant party in the process. • Sentry (Germany) — On every page load. Error records and the identifier of the user who saw the error. The payment reference, amount and workspace name are stripped from the address before sending. • Google (advertising tag) — On every page load; the tag is embedded statically in the page. IP address and the address of the page you open. If you decline in the cookie banner, Google does not write cookies and does not personalise advertising; however this does not prevent the tag from loading or this request from being sent. • Vercel (Analytics / Speed Insights) — Only if you accepted in the cookie banner. IP address, page address, browser and device information. • Cloudflare (Turnstile) — Only when you open the sign-in or sign-up screen. IP address and browser information, to tell automated attempts apart. • OpenStreetMap Foundation and CARTO — When you open a screen containing a map. IP address; the address text you type when searching. • TradingView — When you open a screen containing a chart in the finance module. IP address, browser and device information. The connections in the last three rows are not made unless you open the relevant screen; the first three run everywhere in the application. Data may also be transferred to legally authorised public institutions where they request it and legislation requires it.

• Account and profile data — For as long as your account exists • Payment records (amount, date, plan, iyzico transaction reference) — For the periods required by the Turkish Tax Procedure Law and the Turkish Commercial Code; these records are not deleted even if your account is closed • Your billing identity details (full name, Turkish ID/tax number, address, phone) — For as long as your account exists. When your account is fully closed these details are deleted from our systems; official invoices previously issued in your name continue to be retained separately as required by financial legislation • Contract consent records — Until the rights and obligations arising from the relevant contract are time-barred • In-app activity logs — 90 days (Starter), 1 year (Professional), 3 years (Enterprise) depending on your plan; deleted automatically each night once the period expires • In-app notifications — 90 days if read, 365 days if unread • Technical error records — 30 days • Invitation sending records (abuse prevention) — 48 hours • Orphaned files — Fully removed from storage 24 hours after deletion • Session and login records — Kept for account security; no automatic deletion period is defined today, you may request deletion by application Retaining financial records is a legal obligation; your deletion request does not cover those records. The periods above apply to our own systems. Records sent to the error monitoring provider are subject to that provider's own retention period.

Under KVKK art. 11 you have the right to: learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether the data is used in line with that purpose; know the third parties to whom it is transferred inside or outside Turkey; request correction if it is incomplete or inaccurate; request erasure or destruction within the conditions set out in the law; request that these actions be notified to the third parties to whom the data was transferred; object to a result against you arising from analysis solely by automated systems; and claim compensation if you suffer damage due to unlawful processing. Application: You can send your requests to info@kraftera.com or apply in writing to our company address above. Your application is concluded within the period set out in the Communiqué on the Procedures and Principles of Application to the Data Controller. WHAT YOU CAN DO YOURSELF • Name and profile image: you can update these from the Settings screen in the application. • Billing details (phone, address, identity/tax information): you can update these at the billing details step in the payment flow. • Deleting your workspace and the business records inside it: you can do this yourself from Settings → Danger Zone. WHAT IS DONE ON APPLICATION • Fully closing your account: there is no account deletion button inside the application. When you send your request to the address above, your account and billing identity details are deleted. If your account is linked to records shared with other users (for example projects run jointly), those links must be resolved first; the operation is therefore carried out manually and concluded upon review of your application. • Providing a copy of your data: there is no self-service export screen in the application; you can request this by application. • Deleting session and login records: no automatic period is defined for these records, you may request deletion by application. Payment records that must be retained under financial legislation fall outside the scope of your deletion request.

Your data is transmitted over an encrypted connection. Passwords are stored irreversibly. Access to the records you enter into the application is limited by workspace-level authorisation; the records of one workspace cannot be seen from another workspace. There is one deliberate exception: images you upload as a logo to your workspace are served from publicly accessible addresses so they can appear on the invoices and quotes you send to your customers. We recommend that you do not upload images containing personal data to that area.

This notice may be updated. The current version is always published on this page and the last updated date above changes.