Privacy Notice on the Processing of Personal Data

AIsier Investment Assistant · iOS, Android and web app · aisierinvest.com

This notice explains, under Article 10 of Turkey's Personal Data Protection Law No. 6698 ("KVKK"), who processes your personal data when you use our app and the aisierinvest.com site, for which purposes and on which legal grounds, to whom it is transferred and which rights you have. It is information only: we do not ask you to approve or accept it.

1. Data controller

The data controller for your personal data is AIsier Inc.

• Company: AIsier Inc. (incorporated in Delaware, USA)
• Address: 131 Continental Dr, Suite 305, Newark, DE 19713, United States
• E-mail: privacy@aisierinvest.com

2. Which data we process, why, on which legal ground and for how long

We collect your data electronically, fully or partly by automated means. You enter some of it yourself (sign-up, profile, portfolio, chat), the app and our servers record some of it automatically (time zone, logs, crash reports), and some of it comes from services you use (Apple, Google, payment stores, the exchange you connect).

The legal grounds we use below are these conditions of KVKK Art. 5(2): c) it is directly related to and necessary for concluding or performing a contract (the contract is the User Agreement you accept when you open your account); ç) it is mandatory for us to fulfil a legal obligation; e) it is mandatory to establish, exercise or protect a right; f) it is mandatory for our legitimate interests, provided it does not harm your fundamental rights and freedoms.

Today none of our processing relies on explicit consent (KVKK Art. 5(1)), so we do not ask you for separate explicit consent. We explain what the AI permission in the app is at the end of this section.

1. Account and identity

• Example data: Your e-mail address; an automatically generated username (not shown to other users); an irreversible hash of your password (we cannot see the password itself); if you signed in with Apple or Google, that account's identifier, Apple's relay address if Apple hides your e-mail, or an alias address we generate; if you signed in with Apple, the refresh key Apple gives us so we can later revoke the link (encrypted); the dates you opened the account, verified your e-mail and accepted the User Agreement, and the version of the agreement you accepted; verification, password reset and account deletion codes; a record of your open sessions. We do not ask for your first and last name, and we do not store it even if Apple or Google shares it.
• Purpose: To open your account, let you sign in and protect your account; to conclude the User Agreement and be able to prove your acceptance; to send account e-mails such as the verification code, password reset, account deletion code, welcome and subscription-ended messages.
• Legal ground: Art. 5(2)(c); for the record of your acceptance also Art. 5(2)(e)
• Collection method: What you enter on the sign-up and sign-in screens; with Apple or Google sign-in, the identity information those companies send us (automatic)
• Retention: Until you delete your account. Codes are deleted after 2 days and expired session records in the daily clean-up.

2. Preferences and approximate location

• Example data: Language, currency, the markets you follow, your notification preferences and quiet hours (with their change history), settings such as detailed tracking, the status and date of the AI permission; your device's time zone (e.g. Europe/Istanbul); the country you live in, if you choose it in your profile. If you do not choose a country we estimate it from the time zone and do not store the estimate. We do not ask for location permission, we do not take your precise (GPS) location and we do not derive a location for your account from your IP address.
• Purpose: To show the app in your language and currency; to send notifications by your local time and the hours you chose; to run daily features such as the free Tuesday analysis by your local day; to suggest markets you can follow; to keep a record of when you changed your preferences.
• Legal ground: Art. 5(2)(c)
• Collection method: Profile and settings screens; language and time zone from the information the app sends automatically with each request
• Retention: Until you delete your account (the time zone is updated with each request).

3. Portfolio and in-app records

• Example data: The assets you add and their quantities; with detailed tracking, your purchase prices and transactions; the daily history of your portfolio value; your price and portfolio value alerts; your favourites and watchlist; your comparison history; your game predictions, league points and rewards; your Learn progress; the share links you create (these cards contain no name, e-mail or portfolio value).
• Purpose: To show and track your portfolio; to calculate values, profit/loss and charts; to run your alerts; to operate the games and the league; to publish a card you want to share.
• Legal ground: Art. 5(2)(c)
• Collection method: Forms in the app; import from a screenshot, voice or a spreadsheet file (only what you confirm is saved); the exchange connection (category 5)
• Retention: Until you delete it or delete your account.

4. Analyses

• Example data: The portfolio analyses you request, their texts and the portfolio summary at the time of the analysis; the list of analyses delivered to you ("My analyses"); intermediate AI texts not shown to you; technical copies of scenario calculations.
• Purpose: To produce and show your analyses and their history; to check analysis quality with the intermediate texts; to troubleshoot scenario calculations.
• Legal ground: Art. 5(2)(c); for intermediate texts and technical copies Art. 5(2)(f)
• Collection method: Produced by the system when you request an analysis (automatic)
• Retention: Portfolio analyses 1 year; intermediate AI texts 90 days; technical scenario copies 30 days; other records in "My analyses" until you delete them or delete your account.

5. Exchange and broker connections

• Example data: The name of the institution you connect; your API key and secret (stored encrypted, never put in your data download); your balances there; sync times; the key's permission status (if the institution reports it, we refuse a new key that can trade or withdraw); a technical record of connection attempts.
• Purpose: To read your balances automatically and reflect them in your portfolio; to check that your key is read-only.
• Legal ground: Art. 5(2)(c)
• Collection method: The key you enter on the connection screen; balances automatically from the institution's programming interface (API)
• Retention: Until you remove the connection or delete your account; attempt records 90 days.

6. Chat with AIsier

• Example data: The questions you type or ask by voice and AIsier's answers; the ratings you give answers; the chat context (such as the asset, period and currency discussed); a technical trace of how an answer was produced (source types, duration, cost; not a copy of the text).
• Purpose: To answer your questions; to let the chat continue where you left off; to count your message allowance; to measure answer quality.
• Legal ground: Art. 5(2)(c); for ratings and the technical trace Art. 5(2)(f)
• Collection method: The chat screen
• Retention: Until you delete your account. Messages you clear with "New chat" leave the screen and the history sent to the AI, but stay in our records for counting your message allowance and for your right to a data download.

7. Content sent to AI

• Example data: Your portfolio composition (assets, quantities, weights) and related market data; your questions; the screenshots, images and documents you upload; transcripts of your voice recordings; your analysis texts for translation and quality review. If the chat needs current information, a version of your question stripped of e-mail addresses, phone or account numbers, IBANs, links and your name is sent for a live web search. We never add your account e-mail, password, payment details or exchange keys.
• Purpose: To produce the analyses, chat answers, screenshot and voice readings and translations you ask for; to check overnight, in bulk, that analysis texts contain no investment advice and to review their quality.
• Legal ground: Art. 5(2)(c) (the service you asked for itself); for the quality and advice review Art. 5(2)(f)
• Collection method: Automatically, when you use the related feature
• Retention: Sent to providers only to carry out the task; the results stay with us for the period stated in the related category. We do not use your data to train AI models.

8. Screenshots, documents and voice recordings

• Example data: Screenshots you upload for import; images and documents you attach in the chat; the voice you record when adding an asset or asking a question.
• Purpose: To read the file and extract your assets or your question; to transcribe the voice.
• Legal ground: Art. 5(2)(c)
• Collection method: Only when you upload or you start the microphone
• Retention: Files and voice are not stored: they are read and discarded. If the voice is transcribed with Amazon Transcribe, it waits encrypted in a temporary area until transcribed and is then deleted at once (the temporary area empties within 1 day at most). The list of assets read stays in a cache for at most 24 hours so you can confirm it. We do not use your voice recording to recognise you (voiceprint).

9. Device, notifications and e-mail

• Example data: If you allowed notifications, your device's notification token, Apple's notification token on iPhone, the platform and an installation number the app generates; a record of the notifications we send you (type, time, whether opened), your in-app notification list and pending notifications; the e-mails we send you (account e-mails and, if you turned them on, weekly summary and alert e-mails).
• Purpose: To deliver notifications and e-mails to you; to deliver product announcements the team sends by hand (you can turn them off in Profile); to apply daily notification limits and avoid sending the same thing twice; to measure whether notifications are useful.
• Legal ground: Art. 5(2)(c); for product announcements and measurement Art. 5(2)(f)
• Collection method: The app records it automatically when you allow notifications; delivery records are created automatically in the system
• Retention: The token is deleted when you sign out on that device, when it becomes invalid or when you delete your account; in-app notifications 180 days; pending notification records 30 days after they are settled; delivery records until you delete your account; for e-mail copies see category 15.

10. Usage measurement

• Example data: Which screen you open and for how long; a session number the app generates at each launch; platform and app version; a few interaction counts on that screen (how far you scroll, taps that got no response, opening or closing a tip or tour, your answer to the notification permission question); on the web, page speed measurements on a share of visits. The screen's content, your portfolio values, the assets you look at, your chat messages and searches are not part of this; your IP address and device identifier are not written to this record.
• Purpose: To see which parts of the app work and which ones are hard; to measure and improve performance.
• Legal ground: Art. 5(2)(f)
• Collection method: The app and the web app send it automatically
• Retention: Detailed records 90 days; afterwards only daily totals per screen that are not linked to anyone.

11. Crash and error reports

• Example data: The error's name and message, technical trace, screen name, app and operating system version, device model, freeze measurements; your account if you are signed in. Secrets such as passwords and session keys are removed before recording. If the app's native code on the phone crashes, the same kind of technical information also goes to Google Firebase Crashlytics; your account, e-mail, portfolio and chat do not.
• Purpose: To find and fix errors; to keep the app stable and secure.
• Legal ground: Art. 5(2)(f)
• Collection method: The app and our servers record it automatically
• Retention: 90 days in our own records; in Crashlytics for the period Google sets for that service.

12. Sign-in records

• Example data: The time, method (e-mail and password, Apple, Google), platform (iOS, Android, web) and app version of each successful sign-in. Your IP address and browser identifier are not written to this record.
• Purpose: Account security and support: being able to see when and from which platform your account was accessed.
• Legal ground: Art. 5(2)(f)
• Collection method: Automatically at sign-in
• Retention: Until you delete your account.

13. Security and server records

• Example data: Server and access logs (IP address, browser or app information, requested address, time, result); application and service logs (which operation, for which account, duration, error; type and cost of AI calls); security events (e.g. an account deletion code request, re-authentication, a refused exchange key with trading rights, an unauthorised attempt to reach the admin panel and the IP address of that attempt); short-lived request counters per IP address or account to limit abuse.
• Purpose: To keep our systems and your account secure; to prevent attacks and abuse; to fix faults; to monitor cost.
• Legal ground: Art. 5(2)(ç) (the data security obligation in KVKK Art. 12) and Art. 5(2)(f)
• Collection method: Recorded automatically by our servers and hosting infrastructure
• Retention: Access logs at most 90 days (load balancer 90 days, firewall and application server 30 days); application logs 30 days at info level, 90 days at warning and error level; service call records 90 days (then daily totals without the account); security events 1 year; request counters at most 24 hours.

14. Purchases, subscriptions and credits

• Example data: Your plan and membership level; your trial and subscription end dates; the identifier of the product you bought; store transaction numbers (Apple, Google Play); for web purchases your Stripe customer and subscription numbers; your credit packs, balances, spending counters and use of the free Tuesday analysis; refund records; the cancellation reason code the store reports (we do not keep the free text you write when cancelling). Your card details never reach us.
• Purpose: To verify purchases; to unlock paid features and credits; to handle renewals, cancellations and refunds; to prevent the same purchase being counted twice and abuse.
• Legal ground: Art. 5(2)(c); for refunds and disputes Art. 5(2)(e); for keeping web sale records Art. 5(2)(ç)
• Collection method: In the app or on the web when you buy; notifications Apple, Google and Stripe send us (automatic)
• Retention: Until you delete your account. For web (Stripe) purchases, your confirmation of the pre-contract information and the contract and the sale record are kept for 3 years from the sale even if you delete your account (Art. 5(2)(ç); Distance Contracts Regulation Art. 20). Google Play refund verification records are deleted 90 days after they are settled.

15. Support, feedback and requests

• Example data: Your in-app feedback and survey answers (your message, category, the screen you sent it from, app version, platform, error number if any); your content reports; if you send feedback about the chat, your last 6 chat turns at that moment; what you write to us by e-mail; your KVKK requests and our answers; copies of e-mails we send that may remain in our mailbox and bounce reports for undeliverable e-mails.
• Purpose: To solve your problem and answer you; to improve the app; to settle KVKK requests; to see whether e-mails reach you.
• Legal ground: Art. 5(2)(c) (support and e-mail delivery); Art. 5(2)(f) (improvement); for KVKK requests Art. 5(2)(ç) (KVKK Art. 13)
• Collection method: In-app forms; e-mail
• Retention: In-app feedback until you delete your account (it is deleted with the account). E-mail correspondence, requests and e-mail copies are kept in our Google Workspace mailbox; no period has been set for them yet.

16. Website and web app

• Example data: Access logs (IP address, browser, the page that referred you, the page you opened, time); visit counts (the country is derived from the IP address and only totals are kept); a single cookie that keeps you signed in on the web app; your language and appearance preferences in your browser and the draft of an unfinished sign-up (without the password). The sign-in and sign-up pages may load Google's and, if enabled, Apple's script to show the sign-in buttons; your browser then connects to these companies and your IP address and browser information reach them, even if you do not sign in.
• Purpose: To serve the site securely; to count visits; to keep you signed in; to offer sign-in with Apple and Google.
• Legal ground: Art. 5(2)(f) and, for security logs, Art. 5(2)(ç); for the session cookie Art. 5(2)(c)
• Collection method: Sent automatically by your browser
• Retention: Access logs 90 days; the session cookie at most 7 days; browser preferences in your own browser until you delete them, the sign-up draft until the tab is closed. We use no advertising or tracking cookies.

17. Quality measurement

• Example data: A technical summary of the analyses and chat answers shown to you (which data they relied on, whether they passed review, an internal classification of whether the text implies a direction) and the later price move of the related asset.
• Purpose: To measure the accuracy of our analyses and that we give no investment advice.
• Legal ground: Art. 5(2)(f)
• Collection method: Produced automatically by the system
• Retention: Linked to your account while it is open; when you delete your account the link to you is removed and it remains as a statistic not linked to anyone.

What is the AI permission for?

The "AI data sharing" permission in the app is an app setting that lets you choose whether your own data (your portfolio, your questions, the files and voice recordings you upload) is sent to AI providers. If you do not give it, or you turn off the "AI data sharing" switch in Profile, this data is not sent: personal AI features (portfolio analysis, chat, adding by screenshot and voice) turn off; your portfolio, prices and charts keep working. General content that is the same for everyone (e.g. the general analysis of an asset) contains no personal data and is still produced with AI.

Because the AI analysis is the very service you ask for, the legal ground for this processing is concluding and performing the contract (Art. 5(2)(c)). This permission is not a separate explicit consent under KVKK.

When you delete your account

You can delete your account at any time with Profile › Account › "Delete my account permanently". Your account closes at once and the data linked to it (portfolio, transactions, chat, analyses, exchange connections, device tokens, sign-in records, purchase records, feedback) is deleted from our live systems (except the 3-year record of web purchases in category 14); caches specific to you are cleared; your web subscription is cancelled at Stripe and your customer record at Stripe is deleted; if you signed in with Apple, your Apple link is revoked. You must cancel an App Store or Google Play subscription separately in the store; deleting the account does not cancel it.

Copies in database backups are deleted within 30 days at most, when the backups expire. The logs in categories 13 and 16 are deleted with the account link removed when their own periods end; the quality measurement in category 17 remains as a statistic not linked to anyone. Data already sent to service providers is deleted according to their retention periods. To show that the deletion was completed, a trace record without your name or e-mail (internal account number, the status and dates of the deletion steps) is kept; this record is deleted after 3 years.

What we do not collect and what you should keep in mind

• We do not take your precise location, contacts, advertising identifier or card details. We access your photos only for the image you choose and the microphone only when you start the recording.
• We do not ask for special categories of personal data (such as health, religion or biometric data). Please do not write such information in the chat or its attachments: the text you write goes to the AI provider as it is.
• The app is not directed at children under 13. If we learn of an account belonging to someone under 13, we close it and delete its data.
• We do not sell your data, do not use it for advertising and do not share it for others' marketing.
• We do not send you commercial messages for marketing. If we want to in the future, we will ask for your separate approval before sending.

3. To whom we transfer your data and why

We transfer your data only for the purposes in section 2 and only as far as needed, to these recipient groups:

• Service providers processing data on our behalf: hosting, AI, speech recognition, notification, crash reporting and e-mail services (Art. 5(2)(c); for security and measurement services Art. 5(2)(f)).
• The sign-in, store and payment services you use: Apple, Google and Stripe. These companies also process data for their own services under their own privacy rules (Art. 5(2)(c); for refunds and disputes Art. 5(2)(e)).
• Exchanges and brokers you connect at your request: only to read your balance (Art. 5(2)(c)).
• Public institutions and courts authorised by law: only when a legal obligation requires it (Art. 5(2)(ç)) or to protect a right (Art. 5(2)(e)).

Amazon Web Services

• Country: Germany (Frankfurt). Edge servers worldwide for delivering the website; for AI calls, EU regions, and during outages and on some fallback paths the USA and other AWS regions
• Purpose: Our servers, database, file storage, backups and logs; delivery of the website and web app; running the Claude and Grok models (Amazon Bedrock); speech to text (Amazon Transcribe)
• Data sent: All categories in section 2 (hosting); the AI content in category 7; voice recordings

Anthropic

• Country: USA
• Purpose: Claude models: analysis texts, chat, reading screenshots and documents, translation, quality review
• Data sent: The AI content in category 7

xAI

• Country: USA
• Purpose: Grok models: analysis texts; live web and X search
• Data sent: The AI content in category 7; for search, the question stripped of personal details

Groq

• Country: USA
• Purpose: Speech to text
• Data sent: Voice recordings

Google (Firebase)

• Country: USA and Google's other data centres
• Purpose: Delivering notifications to your device; app crash reports (Crashlytics)
• Data sent: Notification token and notification content; crash reports

Google (Workspace)

• Country: USA and Google's other data centres
• Purpose: Sending e-mail and receiving the e-mails you write to us
• Data sent: Your e-mail address and the content of e-mails

Apple

• Country: USA
• Purpose: Sign in with Apple; delivering notifications to iPhone; verifying App Store purchases
• Data sent: The one-time sign-in code Apple gives and, when you delete your account, the request to revoke the link; notification token and content; the store transaction number and your internal account number that links the purchase to your account (not your e-mail)

Google (Sign-in and Google Play)

• Country: USA
• Purpose: Sign in with Google; verifying Google Play purchases
• Data sent: The purchase token and your internal account number (not your e-mail); on the web, when the sign-in script loads, your browser's IP address and browser information (category 16)

Stripe

• Country: USA
• Purpose: Payments on the web
• Data sent: Your e-mail address, your internal account number, the plan or pack you chose

The exchange or broker you connect (e.g. Binance, BtcTurk, Paribu, Trading 212)

• Country: The country where the institution is located
• Purpose: Reading your balance
• Data sent: Your API key (the institution already holds your account)

Market data providers (Yahoo Finance, CoinGecko, Twelve Data, EODHD, the European Central Bank) receive only asset symbols, and Yahoo Finance and CoinGecko also the word you search; your identity and your account are not sent.

Transfers abroad

We provide the service with infrastructure outside Turkey. From the moment you open your account your data is stored on our servers in Germany (Frankfurt) and, depending on the feature you use, transferred to the providers whose countries are listed above, mostly to the United States. These transfers are a continuous and ordinary part of the service; they are made for the purposes stated above and on the legal grounds in section 2, and are subject to Article 9 of KVKK.

4. Your rights

Under Article 11 of KVKK you have the right, by applying to us, to:

• a) learn whether your personal data is processed,
• b) request information about it if it has been processed,
• c) learn the purpose of the processing and whether the data is used in line with that purpose,
• ç) know the third parties in Turkey or abroad to whom your personal data is transferred,
• d) request correction if your personal data is incomplete or incorrectly processed,
• e) request deletion or destruction of your personal data under the conditions in Article 7,
• f) request that the actions taken under (d) and (e) be notified to third parties to whom your data was transferred,
• g) object to a result against you that arises from the analysis of the processed data exclusively by automated systems,
• ğ) claim compensation if you suffer damage because your personal data was processed unlawfully.

These are your rights under the law.

You can use some of them yourself right away in the app: with Profile › Account › "Download my data" you get a copy of your data (for security, your password hash, exchange keys and intermediate AI texts not shown to you are not included); you can correct your portfolio and profile in the app, change "AI data sharing" and your notification and e-mail preferences, and delete your account with "Delete my account permanently". AI analyses do not decide anything about you, they only give you information; if you still want to use your right under (g), you can apply as described below.

5. How to apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your requests in Turkish by one of these means:

• In writing: by sending your request with a wet signature to "AIsier Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States".
• From the e-mail address registered in our system: by writing from the e-mail address registered on your account to privacy@aisierinvest.com.
• With a secure electronic signature or mobile signature: by sending the request signed this way to privacy@aisierinvest.com.

Your request must include: your name, surname and, for a written request, your signature; your Turkish ID number if you are a citizen of the Republic of Turkey, otherwise your nationality and passport number or ID number if any; your residential or business address for notifications; if any, your e-mail address, phone and fax number for notifications; and the subject of your request. You can attach related information and documents. For a request about your account we may send a verification message to the e-mail address on your account to confirm your identity; we add no other condition.

For written requests, the date the document is served on us is the application date; for other means, the date the request reaches us. We settle your request free of charge as soon as possible according to its nature and within 30 days at the latest; we accept it or refuse it with our reasons and notify you in writing or electronically. If your request is refused, you find our answer insufficient or we do not answer in time, you can complain to the Personal Data Protection Board within 30 days of learning our answer and in any case within 60 days of the application date.

6. Version, language and changes

• Version: 1.0 · Last updated: October 31, 2026
• The Turkish version of this notice is authoritative. Versions in other languages are translations; for users in Turkey the Turkish text applies.
• We may update this notice. If we need to process your personal data for a new purpose, we will inform you in the app and by e-mail before we start processing for that purpose. The current version is always on this page.
• More details are in our Privacy Policy: https://aisierinvest.com/privacy.html. If this notice and the Privacy Policy differ, this notice applies for users in Turkey.