Information notice on the processing of personal data
Last updated: September 29, 2026
This notice informs you under article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK). It is for information only; it is not a consent or explicit consent text. Your explicit consents are asked in the app with separate texts and in separate steps.
1. Data controller
The data controller is Sayfa. Contact: [email protected].
2. Personal data processed
- Customer transaction data: receipt and invoice images, PDFs, product lines extracted from receipts, quantities, prices, discounts, VAT, totals, payment type, last 4 digits of the card, seller name and tax number, receipt number, date and time of purchase.
- Transaction security data: anonymous account id, session data, passkey public key.
- Special categories of personal data: the content of receipts may indirectly reveal information about your health (for example pharmacy purchases). This data is processed only with your separate explicit consent; no health, religion or similar inference is ever made.
3. Purposes of processing
- Reading, checking and storing receipts.
- Matching products across receipts; providing you with price history, unit prices, spending and your personal basket index.
- Keeping accounts and data secure and preventing abuse.
- Answering your applications and requests, and meeting legal obligations.
4. Method of collection and legal bases
Your personal data is collected electronically and partly by automated means when you scan a receipt, pick a photo from your gallery or share a PDF in the app.
- Being directly related to entering into or performing a contract (KVKK art. 5(2)(c)): providing the core service.
- The controller's legitimate interest (KVKK art. 5(2)(f)): account security and abuse prevention.
- Legal obligation (KVKK art. 5(2)(ç)): lawful requests from competent authorities.
- Explicit consent (KVKK art. 6(2) and art. 9): receipt content that may reveal health information, and sending receipt images to the AI provider.
5. Recipients and purpose of transfer
Your personal data is transferred only to the following service providers, which act on our instructions and solely to provide the service. As these providers are abroad, the transfer falls under KVKK art. 9. It may also be transferred to competent public authorities where the law requires.
Hetzner Online
- What for
- Servers and database
- Where
- European Union (Germany, Finland)
Cloudflare
- What for
- Domain, secure connections and encrypted receipt image storage (R2)
- Where
- Image storage in the EU region; network service global
OpenAI
- What for
- Reading the lines from receipt images
- Where
- United States
6. Your rights under KVKK art. 11
- To learn whether your personal data is processed,
- To request information if it has been processed,
- To learn the purpose of processing and whether it is used accordingly,
- To know the third parties in Türkiye or abroad to whom it is transferred,
- To request correction if it is incomplete or wrong,
- To request deletion or destruction under the conditions of KVKK art. 7,
- To request that correction, deletion or destruction be notified to the third parties it was transferred to,
- To object to a result against you arising solely from analysis by automated systems,
- To claim compensation for damage arising from unlawful processing.
7. Application
To use your rights, send your request to [email protected]. We may ask for additional information to confirm that the account is yours. Applications are answered free of charge within 30 days at the latest.