Privacy policy
Who is responsible
The data controller is Ömer Uyar, trading as Ozecca, a sole proprietorship registered in Istanbul, Türkiye. For anything about your data, write to privacy@ozecca.com.
What we collect
Account
When you create an account or sign in with Google we receive your name, e-mail address, profile picture and a Google account identifier. We use them to create your account, show you who is signed in and send you service messages. We do not request access to your Google contacts, files or mail for sign-in.
What you put into an application
The content you enter is processed to provide the feature you are using and for nothing else: in Portfolio, your holdings and transactions; in My Company, your invoices, expenses and documents; in Quests, the names or nicknames of family members, the quests set and the points earned.
Technical data
Our hosting and database providers keep access logs (IP address, browser type, time and the page or request) for security and to keep the service running. The website sets no cookies. The applications use only the cookies or local storage needed to keep you signed in.
Google user data
Where an application offers a connection to your Google account beyond sign-in, for example to read mail related to your company's invoices, it asks for that permission separately, uses the data only for the feature you enabled and never for advertising, and lets you disconnect at any time from the application or from your Google account settings. Ozecca's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
AI features
Some features send the content you choose, for example a portfolio summary, to an AI model provider (currently Anthropic) to produce an opinion or a summary. The content is sent under the provider's business terms, which do not allow it to be used to train models, and is not stored by Ozecca beyond the result shown to you. AI output is information, not financial, legal or tax advice.
Children
Quests is used by children under the supervision of a parent or guardian. A parent creates and controls the child's profile, decides what is recorded, and can change or delete it at any time. Child profiles hold the minimum needed to run the application and are never used for advertising or profiling. If you believe we hold information about a child without a parent's consent, write to us and we will delete it.
Who processes data for us
Supabase (database and sign-in, hosted in the European Union), Vercel (hosting), Resend (transactional e-mail, European Union), Google (sign-in) and the AI provider named above. Each acts on our instructions under a data processing agreement. Data may be stored or processed outside Türkiye under the safeguards required by the Personal Data Protection Law (KVKK article 9). We do not sell data and do not share it with anyone else unless the law requires it.
How long we keep it
Account and application data are kept while your account is active. When you delete your account, or ask us to, data is deleted within thirty days and disappears from backups within a further thirty days, except for records we must keep under Turkish commercial and tax law.
Your rights
Under KVKK article 11, and the GDPR where it applies, you can ask whether we process your data and request access, correction, deletion or a copy in a portable format, and you can object to processing. Write to privacy@ozecca.com; we answer within thirty days. You can also complain to the Turkish Personal Data Protection Authority (KVKK).
Changes
When this policy changes in a way that matters, we tell signed-in users inside the application and update the date at the top of this page.