KVKK Information Notice

1. Data Controller

For the purposes of the KVKK, the data controller is:

MUKHAMMAD AZIMOV

Email: muhammed.azimov@hotmail.com

This Information Notice covers personal data processing activities that may occur in connection with the CRASGO iOS application, CRASGO website, user support, and beta/feedback processes.

2. Purposes of Processing Personal Data

Depending on the nature of the relevant processing activity, personal data may be processed for purposes including:

• providing CRASGO's financial record, budgeting, payment, collection, and reporting features;
• operating technical application functionality;
• providing user support;
• administering beta and TestFlight processes;
• evaluating user feedback;
• maintaining application security;
• complying with applicable legal obligations; and
• protecting rights and responding to legal requests.

3. Categories of Personal Data That May Be Processed

3.1 Identity and Contact Information

Where voluntarily provided through the website, beta/TestFlight, or support processes:

• name;
• email address.

3.2 Financial Management Information

Where entered by the User into CRASGO, information processed on the device may include:

• income and expense records;
• transaction amounts;
• currencies;
• dates;
• categories;
• payment and collection status;
• budget information;
• installment information;
• recurring payment information;
• credit card name or nickname;
• statement date;
• payment due date;
• card limit.

CRASGO is not designed to collect online banking passwords, banking login credentials, card PINs, CVV/CVC codes, or full payment card numbers.

3.3 Receipt and OCR Data

Where the receipt or document scanning feature is used, the following may be processed:

• receipt or document images;
• text extracted through OCR;
• financial records created from OCR results.

Under CRASGO's current architecture, OCR processing is performed on-device.

3.4 Technical Information

Particularly in connection with support or beta processes, the following may be processed where submitted by the User or included in a support email:

• device model;
• iOS version;
• application version and build number;
• language or locale information.

3.5 Feedback Information

Where submitted by the User, feedback text, beta/testing information, and information voluntarily included in a message may be processed.

4. Methods of Collecting Personal Data

Personal data may be obtained electronically through:

• information entered by the User into the CRASGO application;
• application operations performed on-device;
• use of receipt/document scanning and OCR features;
• support emails;
• website contact, beta, or feedback forms; and
• use of Apple platform services such as iCloud/CloudKit.

5. Legal Grounds for Processing

Depending on the particular processing activity, personal data is processed on the basis of the applicable personal data processing conditions set out under Article 5 of the KVKK. Depending on the circumstances, these may include:

• processing expressly provided for by law;
• processing directly related to the establishment or performance of a contract;
• processing necessary for the data controller to comply with a legal obligation;
• processing necessary for the establishment, exercise, or protection of a right;
• processing necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed; and
• explicit consent where required.

Where a specific processing activity requires explicit consent, such consent will be obtained separately.

Providing or acknowledging this Information Notice does not, by itself, constitute explicit consent.

6. Local Data Processing

CRASGO is designed around a local-first architecture.

Financial records created by the User may primarily be stored on the User's device.

Under CRASGO's current architecture, CRASGO does not operate a centralized financial user database for the purpose of collecting these financial records.

Accordingly, the Developer may not have actual access to certain information that remains exclusively on the User's device and is not transmitted to the Developer.

7. iCloud / CloudKit

CRASGO may support synchronization of application data through Apple's iCloud/CloudKit infrastructure.

Where iCloud is available, application data may be synchronized within the Private CloudKit Database associated with the User's Apple account.

This synchronization is performed through infrastructure provided by Apple.

CRASGO does not operate its own centralized financial user database for this purpose.

Processing performed by Apple is subject to Apple's own privacy practices and service terms.

8. Biometric Authentication

CRASGO may use Apple's LocalAuthentication infrastructure for Face ID or Touch ID functionality.

Biometric authentication is performed by Apple's operating system.

CRASGO does not read or store the User's Face ID or Touch ID biometric templates in a CRASGO-controlled database.

9. Parties to Whom Personal Data May Be Transferred

To the extent required by the relevant processing activity and permitted under applicable law, personal data may be processed or transferred in connection with the following parties or services:

• Apple and Apple Platform Services: Infrastructure provided by Apple in connection with iOS, iCloud/CloudKit, and related Apple platform functionality.
• Web and Communication Services: Service providers used to operate website, email, hosting, or communication functionality.
• Third Parties Selected by the User: Where CSV, PDF, or other exported files are shared through the iOS Share Sheet, the application or service selected by the User.
• Authorized Public Authorities: Legally authorized public authorities, courts, or other competent authorities where disclosure is required by law.

Requests made to exchange-rate services used by CRASGO are intended to retrieve exchange-rate information. CRASGO is not designed to send users' financial records to such services.

10. International Transfers of Personal Data

Infrastructure used by Apple iCloud/CloudKit, email services, website services, or other technical providers may be located outside Türkiye or may process data in other countries.

Where a transfer of personal data abroad occurs, the relevant transfer must rely on an appropriate legal mechanism under the applicable international transfer provisions of the KVKK.

This Information Notice may be updated if service providers or applicable transfer mechanisms change.

11. Retention Period

Personal data is retained for the period required by the relevant processing purpose and applicable legal obligations.

The retention of CRASGO records stored locally on the device depends on the User's use of the Application and device.

The lifecycle of data synchronized through iCloud/CloudKit may also depend on Apple's relevant services and the User's Apple account or device actions.

Information submitted to the Developer for support, beta, or communication purposes may be retained for as long as necessary to manage the relevant request or process and comply with applicable legal obligations.

12. Data Security

CRASGO aims to apply appropriate technical and organizational safeguards for the protection of personal data. Under the current technical architecture:

• local data storage is used;
• iOS Data Protection mechanisms are utilized;
• sensitive screen content may be obscured when the Application enters the background;
• biometric authentication may be performed through Apple LocalAuthentication;
• OCR processing may be performed on-device;
• CRASGO does not operate a centralized financial user database; and
• third-party advertising or behavioral analytics SDKs are not currently used.

No digital system can provide an absolute guarantee of security.

13. Your Rights Under the KVKK

Subject to the applicable conditions, Article 11 of the KVKK may provide you with the right to:

• learn whether your personal data is being processed;
• request information if your personal data has been processed;
• learn the purpose of processing and whether your data is used in accordance with that purpose;
• know the third parties to whom your personal data has been transferred domestically or abroad;
• request correction of incomplete or inaccurate personal data;
• request deletion or destruction of personal data under the conditions provided by law;
• request notification of correction, deletion, or destruction to third parties to whom the data has been transferred;
• object to a result arising against you through the analysis of processed data exclusively by automated systems; and
• request compensation for damages suffered as a result of unlawful processing of personal data.

14. Applications and Requests

For requests concerning your rights under the KVKK, you may contact:

Data Controller: MUKHAMMAD AZIMOV

Email: muhammed.azimov@hotmail.com

You may be required to provide sufficient information for your request to be evaluated and, where necessary, for your identity to be reasonably verified.

Requests will be evaluated in accordance with the procedures and time periods prescribed by the KVKK and applicable secondary legislation.

15. Information Notice and Explicit Consent

This Information Notice is intended to provide information about personal data processing activities.

The obligation to provide information and the process of obtaining explicit consent are separate legal processes.

Reading or acknowledging this Information Notice does not mean that you have provided explicit consent for all processing activities that may require such consent.

Where explicit consent is legally required for a particular processing activity, it will be obtained separately.

16. Website, Beta and TestFlight

Where a beta/TestFlight application, feedback, or contact form is submitted through the CRASGO website, information such as name, email address, device information, and content submitted by the User may be processed.

Such information is separate from the financial record system stored locally within the CRASGO mobile application.

17. Changes

This Information Notice may be updated if CRASGO's features, service providers, or personal data processing activities change.

Material changes may be communicated through the website or Application where appropriate or legally required.