This information notice is prepared in accordance with Article 10 of Turkish Personal Data Protection Law No. 6698 (KVKK) to inform you about the processing of your personal data.
1. Identity of the Data Controller
Acting as data controller in an individual capacity is Ozan Can Sisman.
- Name: Ozan Can Sisman
- Email: privacy@unclefrank.app
2. Categories of Personal Data Processed
- Identity information (name, surname)
- Contact information (email address)
- Account and household information (household membership, profile preferences)
- Customer transaction information (in-app actions, subscription status)
- Financial information (user-entered bank accounts, income/expense, asset and debt records; uploaded statements are not retained after processing)
- Mehmet Amca chat content (processed only to produce the answer, not stored)
- Consent records (sign-up consent, marketing email consent, AI features consent and its withdrawal)
- Transaction security information (IP address, session information, device identifier)
Apart from anonymous, cookieless usage statistics not linked to your account (Vercel Web Analytics: page views and a few product events), Frank does not collect in-app interaction analytics and does not build marketing profiles.
3. Purposes of Processing Personal Data
Your personal data is processed for the following purposes:
- Account creation and management
- Provision of Frank application's core services (statement analysis, expense tracking, AI advice)
- Execution of subscription processes
- Conducting customer satisfaction-oriented activities
- Conducting information security processes
- Conducting activities in compliance with legislation
- Conducting storage and archival activities
4. Recipients of Personal Data and Purposes of Transfer
Your personal data may be transferred to the following parties to the extent required by service provision:
- Domestic: Authorized public institutions and organizations (within the scope of legal obligations)
| Provider | Why | Data it receives |
|---|---|---|
| Supabase Inc. (data in the EU, Frankfurt, Germany) | Database and authentication | The account, financial, household, consent and purchase data in Section 2; your email address |
| Cloudflare, Inc. (USA) | Sending account emails (verification, password reset, email address change and sign-in link); forwarding the emails you send to support@, privacy@, legal@, ozan@ and social@unclefrank.app to our inbox | For account emails, your email address and the content of the email; for emails you send us, your email address and the content of your message |
| Vercel Inc. (USA) | Hosting the app and its server functions | Server requests, IP address, request and error logs |
| Vercel Inc. Web Analytics (USA) | Cookieless aggregate usage statistics not linked to your account | Page addresses with identifiers removed, five product events (sign-up completed, setup completed, first expense, first statement, Frank Pro started) and platform / plan |
| Anthropic PBC (USA) | AI features; only if you consent (see the note below) | Statement reading: the statement PDF you upload. Mehmet Amca chat: the messages you write and a summary of this month and last month (totals, cep names, top merchants, income sources). Mehmet Amca monthly analysis: monthly totals, cep names and merchant names. Cep suggestions: your cep names, the last 60 days’ merchant → cep matches and the transactions to suggest for (merchant, amount, category, date). Financial Health Report: the month’s totals, cep names, subscription and instalment totals, net worth totals |
| Adapty Tech Inc. (USA) | Showing Frank Pro products and verifying purchases in the mobile app | Frank user ID, purchase and subscription status, device identifier (IDFV). IP address and advertising identifier (IDFA) are not sent |
| Apple Inc. | App Store payment; optional Sign in with Apple | Payment happens at Apple; your card details never reach us. With Sign in with Apple, Apple gives us your email (or a private relay address) and name |
| Google LLC | Optional Sign in with Google | At sign-in Google gives us your email address and name |
| Google LLC (Gmail) | Reading and answering the emails you send to support@, privacy@, legal@, ozan@ and social@unclefrank.app | The emails you send us: your email address, the name in the email and the content of your message |
| Truncgil Finans (Turkey) | Exchange and gold rates | No personal data is sent; our server fetches the rates independently of you |
AI and Anthropic. Statement reading, Mehmet Amca (chat and monthly analysis), cep suggestions and the Financial Health Report run on Anthropic’s Claude AI. These features run only after you explicitly allow them in the app; if you do not allow them, or withdraw your consent, no data is sent to Anthropic. Frank does not add your name, email address, user ID or household ID to these requests. For statement reading, the PDF you upload is sent as it is, so whatever your bank printed on it (such as the cardholder’s name) is part of that file. Under Anthropic’s commercial terms, content sent through its API is not used to train its models. Mehmet Amca’s answers are not stored by Frank; the Financial Health Report’s letter is stored in your account so you can see the report again.
Equal protection. These providers process your data only to provide their service to us and are bound to protect it at least as well as this notice and the Privacy Policy describe.
International transfers (KVKK Article 9): Transfers to Vercel, Cloudflare, Anthropic and Adapty, as well as Apple and Google (Gmail included), all located in the USA, are carried out based on the explicit consent you give at registration; AI features additionally ask for consent in the app, which you can withdraw under Settings → Preferences → AI features. Supabase keeps your data in the EU (Frankfurt, Germany); transfers to EU member states are based on the recognition that these countries provide an adequate level of protection.
5. Method of Personal Data Collection and Legal Basis
Your personal data is collected through automated means in electronic form when you begin using the Frank application. Your data is processed under KVKK Article 5 on the following legal grounds:
- Existence of your explicit consent
- Direct relevance to the establishment or performance of a contract
- Necessity for the data controller to fulfill its legal obligations
- Necessity for the legitimate interests of the data controller, provided that fundamental rights and freedoms of the data subject are not harmed
6. Your Rights Under KVKK Article 11
As a data subject, you have the following rights:
- To learn whether your personal data is being processed
- To request information if your personal data has been processed
- To learn the purpose of processing and whether the data is used appropriately
- To know the third parties domestically or internationally to whom your data is transferred
- To request correction if your personal data has been processed incompletely or incorrectly
- To request deletion or destruction of your personal data within the scope of conditions set forth in KVKK Article 7
- To request that operations carried out be communicated to third parties to whom personal data has been transferred
- To object to a result that arises against the person through analysis of processed data solely by automated systems
- To request compensation for damages incurred due to unlawful processing of personal data
7. How to Apply
To exercise your rights above, you may apply by email, from the email address registered in your Frank account, to privacy@unclefrank.app in accordance with the Communiqué on Procedures and Principles for Application to the Data Controller.
Your application must clearly state your identity information and the subject of your request. Applications are concluded free of charge within 30 days.