PortföyGPT
Privacy Policy
How PortföyGPT collects, uses, and protects your personal data, including the KVKK disclosure notice.
Privacy Policy and KVKK Disclosure Notice
Effective date: 18 June 2026 Last updated: 18 June 2026
This Privacy Policy explains how your personal data is processed when you use the PortföyGPT mobile application (the "Application"). It also fulfills our disclosure obligation under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK").
By using the Application, you acknowledge that you have read and understood this policy.
1. Data Controller
In accordance with the KVKK, your personal data is processed by the following company in its capacity as data controller:
- Legal name: PRISMIND MEDIA TEKNOLOJİ YAZILIM BİLİŞİM DANIŞMANLIK ANONİM ŞİRKETİ (the "Company")
- Address: Adalet Mah. Manas Bulvarı No:47/2, Folkart Towers A Kule, Kat:25 D:2503, Bayraklı/İzmir
- MERSİS No. (Turkish Central Registration System number): [MERSİS NO]
- VERBİS (Data Controllers' Registry): Not subject to registration obligation
- KEP (registered electronic mail): [KEP ADRESİ]
- Email: info@prismindmedia.com
In this text, the terms "we," "the Company," or "the data controller" refer to the legal entity identified above.
2. Personal Data Processed and Purposes
The Application processes only the data necessary to provide the service. The categories of data processed, their purposes, and the legal grounds under Articles 5 and 6 of the KVKK are set out below:
| Data category | Data processed | Purpose of processing | Legal ground (KVKK) |
|---|---|---|---|
| Identity & account | Email, display name, profile photo (from social sign-in) | Account creation and session management | Article 5/2-c (performance of a contract) |
| Financial / portfolio | Portfolio holdings (symbol, quantity, average cost, value, profit/loss), buy-sell transactions, favorites, price alerts | Core function of the Application (portfolio tracking, reporting, notifications) | Article 5/2-c (performance of a contract) |
| AI analysis data | Portfolio content sent for artificial intelligence analysis, generated analysis text, AI consent/approval record | Optional artificial intelligence portfolio analysis feature | Article 5/1 (explicit consent) |
| Transaction security & logs | Device identifier (service security and prevention of abuse), session logs | Security, prevention of fraud and abuse | Article 5/2-f (legitimate interest) |
| Device & usage | Platform (iOS/Android), application language, time zone (timezone), in-app event logs (analytics) | Service improvement, product analytics, country inference | Article 5/2-f (legitimate interest) |
| Technical / diagnostics | Crash logs (stack trace), device/operating system information, performance traces | Error diagnosis and application stability | Article 5/2-f (legitimate interest) |
| Subscription & purchase | Premium status, purchase history (matched with an anonymous user identifier) | Subscription management and billing | Article 5/2-c (performance of a contract) |
| Notifications | Push notification token (FCM token) | Price alerts and informational notifications | Article 5/2-f (legitimate interest) |
| Advertising | Advertising identifier (iOS IDFA / Android advertising ID — only with your permission) | Display of personalized advertising | Article 5/1 (explicit consent — ATT/permission) |
In processing based on legitimate interest, a balance is maintained between our interest and your rights, and the processing is kept limited to that purpose.
Note: Before processing your portfolio data for artificial intelligence analysis, we obtain your separate explicit consent within the Application. You can use all other features of the Application without granting this consent. The artificial intelligence analysis is for general informational purposes only; it does not constitute a solely automated decision that produces legal effects concerning you or similarly significantly affects you.
3. Method of Collecting Personal Data
Your personal data is collected during your use of the Application through automated or partially automated means, via information you enter directly (portfolio, transactions) and information collected automatically from your device (device/usage/technical data), and, if you choose, through social sign-in with Apple or Google.
4. Transfer of Personal Data
To the extent necessary to provide the service, your data is transferred to the following data processors / third parties. Because some of these providers are located abroad, the relevant transfers constitute transfers abroad within the meaning of Article 9 of the KVKK. The legal ground that justifies the processing of the data is distinct from the legal ground that justifies the transfer abroad:
- Legal ground for processing. Items necessary for the operation of the service (Supabase hosting/authentication, Google/Firebase telemetry and notifications, RevenueCat subscriptions, sign-in with Apple/Google) rely on the legal grounds of performance of a contract and legitimate interest under Article 5/2 of the KVKK. Processing relating to optional features (portfolio content sent to a third-party artificial intelligence service provider located abroad; the advertising identifier transferred to Google AdMob for personalized advertising) relies on your explicit consent; you can use the core functions of the Application without granting these consents.
- Legal ground for transfer abroad. All of the above transfers are systematic (recurring) in nature. For this reason the transfer abroad is carried out, independently of explicit consent, under Article 9 of the KVKK on the basis of appropriate safeguards such as the standard contract announced by the Board or an undertaking authorized by the Board; only in incidental (one-off, non-recurring) cases may the exceptions under Article 9/6 be relied upon. Explicit consent is not used as the sole legal basis for a systematic transfer, but rather for the underlying processing.
The transfer mechanism applied to each recipient is kept up to date within the framework of the applicable legislation and the provider agreements.
| Recipient | Data transferred | Purpose | Location |
|---|---|---|---|
| Supabase | All account and portfolio data (hosting) | Authentication, database, server infrastructure | Abroad (Germany/EU) |
| Google / Firebase | Analytics events, crash logs, performance, push token | Product analytics, error diagnosis, notifications | Abroad (USA/EU) |
| Third-party AI service provider | Portfolio content sent for AI analysis | Artificial intelligence portfolio analysis (only with your consent) | Abroad (USA) |
| RevenueCat | Anonymous user identifier, subscription status | Subscription management | Abroad (USA) |
| Google AdMob | Advertising identifier (with your permission) | Display of advertising | Abroad (USA) |
| Apple / Google | Email, name (at the moment of social sign-in) | Authentication | Abroad (USA/EU) |
| Authorized public authorities | Data required by legislation | Legal obligation | Türkiye |
We do not sell your personal data to third parties for marketing purposes. Your portfolio content is shared only with the processors identified above that are necessary for the operation of the service.
As part of the administrative operation of the Application, limited information (email, premium status, platform) may be sent to our internal notification channel for events such as account creation, premium upgrade, or account deletion.
5. Retention Period
Your personal data is retained for as long as required by the purpose of processing and for the statutory limitation/retention periods prescribed by applicable legislation. The main retention criteria are as follows:
- Account and portfolio data: retained for as long as your account is active; when you delete your account, data with no legal retention obligation is deleted, destroyed, or anonymized within 30 days at the latest.
- Security and transaction logs: retained for a maximum of 12 months for the purpose of preventing abuse.
- Subscription and purchase records: retained for 10 years in accordance with applicable tax and commercial legislation (on the side of the payment infrastructure and the store).
* These periods are updated in line with the applicable legislation and the Company's retention-and-disposal policy.
6. Your Rights Under the KVKK (Article 11)
Under Article 11 of the KVKK, by applying to the data controller you have the right to:
- Learn whether your personal data is processed,
- Request information if it has been processed,
- Learn the purpose of processing and whether it is used in accordance with that purpose,
- Know the third parties to whom it is transferred domestically or abroad,
- Request correction if it has been processed incompletely or incorrectly,
- Request its erasure/destruction under the conditions set out in Article 7 of the KVKK,
- Request that correction/erasure operations be notified to the third parties to whom the data has been transferred,
- Object to a result arising against you as a consequence of analysis carried out solely by automated systems, and request compensation for damage you have suffered due to unlawful processing.
Application Method
You may submit your requests regarding these rights, in accordance with the "Communiqué on the Procedures and Principles for Applying to the Data Controller," to:
- KEP (registered electronic mail): [KEP ADRESİ] (via KEP), or
- Email: info@prismindmedia.com (from the email address registered in our system), or
- In writing: Adalet Mah. Manas Bulvarı No:47/2, Folkart Towers A Kule, Kat:25 D:2503, Bayraklı/İzmir
Your requests will be concluded free of charge, depending on their nature, within 30 days at the latest; if the operation additionally entails a cost, a fee from the tariff determined by the Board (the Turkish Personal Data Protection Board) may be charged.
7. Data Security
We take appropriate technical and administrative measures to prevent the unlawful processing of and access to your personal data: encryption in transit (TLS), server-side access controls, storage of sensitive data on the device via secure storage, and an optional biometric (Face ID / fingerprint) lock. Server-side access controls and logging are applied. In the event of a data breach, the required notifications are made in accordance with the KVKK and the regulations of the Board.
8. Advertising and Tracking Transparency (ATT)
The Application may display advertising in its free version. On iOS, before accessing your device's advertising identifier (IDFA) for personalized advertising, we request your App Tracking Transparency (ATT) permission. If you do not grant permission, advertisements are not personalized; this does not affect your use of the Application. You can change the permission later from your device settings. For details, see the Cookie Policy.
9. Children's Privacy
The Application is not designed for persons under the age of 18, and we do not knowingly collect data from persons under 18. During registration, the user declares that they are over the age of 18. We will delete the data of any user we determine to be under the age of 18 without delay.
10. Changes to This Policy
We may update this policy from time to time. For significant changes, we will inform you within the Application or by email. The current version is always available on this page with the "Last updated" date.
11. Contact
For questions regarding privacy and personal data: info@prismindmedia.com · General support: info@prismindmedia.com
This text has been prepared in accordance with the actual data processing flow of the PortföyGPT application. For the disclaimer regarding investment services, see the Disclaimer.