KVKK Clarification Text

Last updated: July 23, 2026

In accordance with Article 10 of the Law No. 6698 on the Protection of Personal Data ("KVKK"), this Clarification Text has been prepared to inform you about your personal data processed while using the RhemeSignal mobile application ("Application").

1. Identity of the Data Controller

RhemeSignal is not a corporate company, but is developed and operated by Murat YENER as a natural person; this is the person acting as the data controller under KVKK.

• Contact: contact@rhemelabs.com

2. Categories of Processed Personal Data

• Identity: Full name (if applicable)
• Contact: Email address
• Customer transaction: Portfolio, debt, watchlist records; entered financial transactions
• Financial data: Uploaded bank statements and spending/transaction data extracted from them
• Transaction security: Authentication token (auth token), session/device ID, IP address (in server access logs)
• Marketing/advertising related technical data: Advertising ID — solely for device identification by the SDKs we use
• Other (transaction security): Crash diagnostic data, push notification token (FCM token)

The Application does not collect special categories of personal data (health, religious beliefs, ethnic origin, etc.).

3. Purposes of Processing Personal Data

• Account creation, authentication, and ensuring session security,
• Provision of portfolio, debt, watchlist, dashboard, and AI stock recommendation services,
• Processing uploaded bank statements to produce spending categories/summaries,
• Sending push notifications,
• Verification and management of subscription/purchase transactions,
• Detection and resolution of Application errors,
• Fulfillment of legal obligations and prevention of misuse.

4. Method and Legal Reason for Personal Data Collection

Your personal data is collected through automatic means either by direct entry by you while using the Application (in electronic environment) or through third-party SDKs (Firebase, RevenueCat) used by the Application. Legal reasons:

• KVKK Art. 5/2-c — directly related to the establishment or performance of a contract (data processing necessary for providing the service, e.g., account/portfolio data),
• KVKK Art. 5/2-ç — fulfillment of legal obligations by the data controller,
• KVKK Art. 5/2-f — legitimate interest of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (e.g., error/crash tracking, fraud prevention),
• For operations requiring explicit consent (if any), your explicit consent is obtained separately.

5. Parties to Whom Personal Data is Transferred and Transfer Purpose

To provide the service, data is shared to a limited extent with the following service providers; some of these providers (Google/Firebase, RevenueCat, Sentry) may use servers located abroad (e.g., USA):

• Google Firebase (Authentication, Crashlytics, Cloud Messaging, Firestore): Authentication, error tracking, push notification
• RevenueCat: Subscription/purchase management
• Sentry: Server-side error tracking
• Cloud storage infrastructure: Storage of uploaded bank statements

These transfers are limited to the minimum data necessary for the performance of the service under KVKK Art. 9. AI-powered features (spending categorization, news impact analysis, AI stock recommendation) run on our own servers without sending data to third-party cloud AI services.

6. Data Subject Rights (KVKK Art. 11)

Under KVKK Art. 11, you have the following rights:

1. To learn whether your personal data is processed,
2. To request information if it has been processed,
3. To learn the purpose of processing and whether it is used in accordance with its purpose,
4. To know third parties to whom it is transferred domestically/abroad,
5. To request correction if processed incompletely or incorrectly,
6. To request deletion/destruction within the framework of conditions provided in KVKK Art. 7,
7. To request notification of operations under (5) and (6) to third parties to whom data is transferred,
8. To object to an adverse result arising from the analysis of processed data exclusively through automated systems,
9. To demand compensation for damages in case of suffering damage due to unlawful processing.

7. Application Method

To exercise your above rights, you can submit your request in writing to contact@rhemelabs.com along with information verifying your identity (via your registered email address). Your request will be concluded free of charge within the timeframes specified in KVKK.