KVKK Privacy Notice

Last updated: September 12, 2026 · Under Personal Data Protection Law No. 6698 (Türkiye)

Data Controller

Data Controller
InvenTally
Address
Istanbul, Türkiye
Email
privacy@inventally.app
Web
inventally.app

This notice has been prepared under Article 10 of the Personal Data Protection Law No. 6698 ("KVKK") of the Republic of Türkiye. The Turkish version is the legally binding text; this translation is provided for convenience.

1. Personal Data Processed

Identity Data

  • Name, surname
  • Email address
  • Username
  • Profile photo

Contact Data

  • Email address

Customer Transaction Data

  • Inventory records
  • Product information
  • Stock movements
  • Category and location information

Transaction Security Data

  • IP address
  • Device information (model, operating system)
  • Session information
  • Activity logs

Visual and Audio Records

  • Product photos
  • Profile photo

2. Purposes of Processing

  • Providing the mobile app services
  • Creating and managing the user account
  • Providing inventory management services
  • User authentication and security
  • Carrying out communication activities
  • Ensuring information security
  • Improving service quality
  • Fulfilling legal obligations
  • Increasing customer satisfaction
  • Statistical analysis and reporting (anonymous)

4. Transfer of Personal Data

Domestic Transfers

For the purposes stated above, your personal data may be transferred to:

  • Our business partners
  • Our suppliers
  • Our service providers
  • Authorized public institutions and organizations within the scope of legal obligations

in accordance with the conditions set out in Articles 8 and 9 of the KVKK.

International Transfers

Through our cloud service providers, your personal data may be transferred abroad to:

  • Firebase (Google Cloud) — US and EU servers
  • Apple Sign-In services
  • Google Sign-In services

These transfers are carried out under Article 9 of the KVKK with adequate protection in place.

5. Method of Collection

Your personal data is collected through the following methods:

  • Registration forms in the mobile app
  • Automatically during use of the app
  • Email communication
  • Sign-in with social accounts (Apple, Google)
  • Customer support requests
  • Cookies and similar technologies

6. Your Rights under the KVKK

Under Article 11 of the KVKK, you may exercise the following rights by applying to the data controller:

  • To learn whether your personal data is being processed
  • To request information if it has been processed
  • To learn the purpose of processing and whether the data is used in line with that purpose
  • To know the third parties, in Türkiye or abroad, to whom your personal data has been transferred
  • To request rectification if your personal data is incomplete or inaccurate
  • To request erasure or destruction of your personal data under the conditions set out in Article 7 of the KVKK
  • To request that rectification, erasure, or destruction be notified to the third parties to whom the data has been transferred
  • To object to a result against you arising from analysis of the processed data exclusively by automated systems
  • To claim compensation for damages arising from unlawful processing of your personal data

7. How to Apply

To exercise your rights under the KVKK, you may apply through the following methods:

By Email

To privacy@inventally.app, signed with a secure electronic signature or mobile signature, or sent from the email address you previously notified to the data controller and which is registered in our system.

Information Required in the Application

  • Name, surname
  • Turkish ID number (if applicable)
  • Residential or business address for notifications
  • Email address
  • Phone number
  • Subject of the request

Response Time

Your application will be concluded free of charge as soon as possible and within 30 (thirty) days at the latest, depending on the nature of the request. If the process incurs an additional cost, the fee set by the Personal Data Protection Board may be charged.

8. Data Security

The following technical and administrative measures have been taken to ensure the security of your personal data:

Technical Measures

  • SSL/TLS encryption in transit, AES-256 encryption at rest (Google Cloud)
  • Network and physical security of the Google Cloud infrastructure
  • Two-factor authentication (2FA)
  • Per-account access control with Firebase Security Rules
  • Passwords hashed by Firebase Authentication (scrypt)

Administrative Measures

  • Authorization and restriction of administrative access
  • Data processing agreements with service providers (Google Cloud data processing terms)
  • Regular review of this notice and the privacy policy

9. Retention Period

Your personal data is retained for as long as required by the purpose of processing and for the periods stipulated by applicable legislation:

  • For as long as the account is active
  • When the account is deleted, the sign-in record is deleted immediately and inventory data and photos within 30 days at the latest
  • When the purpose of processing ceases or the retention periods under applicable legislation expire, your personal data is deleted, destroyed, or anonymized

10. Contact

KVKK Applications

General Information

Turkish Data Protection Authority (KVKK Board)

Important Note

This notice has been prepared under the Personal Data Protection Law No. 6698 and related legislation. It may be updated in line with changes in legal regulations.

The current version is always available at inventally.app/kvkk.

Last updated: September 12, 2026