Ceres
KVKK Privacy Notice
Under Türkiye’s Personal Data Protection Law No. 6698 (“KVKK”), this notice explains which personal data the Ceres app and appceres.com process, why, on what legal basis and with whom it is shared.
This notice takes effect once the company details are completed and it has passed legal review.
Last updated: 2 October 2026
01Data controller
Your personal data is processed by Ceres Finansal Teknolojiler A.Ş. (“Ceres”) as data controller. Address: [Company address] · MERSIS: [MERSIS no.] · E-mail: info@appceres.com
02Personal data we process
- Identity and contact: name, e-mail address and, optionally, phone number.
- Account and preferences: language, time zone, payday, monthly income and savings goal, notification preferences, the profile picture you choose.
- Financial records: the spending and income you enter (amount, date, merchant, category, note), recurring payments, installments, budgets, debts, goals and investment assets; for cards and accounts the bank name, the card’s last 4 digits, limit and balance.
- Receipts and statements: receipt photos and what is read from them (store, address, line items, VAT, the card’s last 4 digits); the content of card statements you upload (the file is deleted once it’s read).
- AI features: the questions you ask in Ask Ceres and the answers.
- Family: household name, members and their roles, the e-mail address of people you invite; the budget and spending shared within the family.
- Subscription: your plan, the store you bought it in and its status. Your payment card details are processed by Apple or Google and never reach Ceres.
- Security: user id, sign-in and two-step verification records, device name and platform, push token, the refresh token Apple issues for Sign in with Apple, app error logs (with e-mails, amounts, IBANs and phone numbers masked).
- Requests and feedback: feedback and support requests you send us.
- Website: the e-mail address you enter in the “Tell me when it’s out” form, your language, device type and the date of your consent.
Ceres does not connect to your bank; your bank password, full card number, location and contacts are not processed. No special categories of personal data are processed. There are no ads or ad tracking in the app.
03Purposes
- Creating your account, signing you in and keeping it secure
- Providing the service: period budget, analysis, forecasts, notifications and the period close
- Reading receipts and importing statements
- Providing AI-assisted features such as Ask Ceres and Ceres notes
- Running the shared budget in the family feature
- Handling subscriptions, the trial and purchases
- Information security, detecting and fixing errors
- Answering your requests and complaints, meeting legal obligations
- With your consent, e-mailing you when Ceres launches
04Legal grounds
- Necessary to set up or perform a contract (KVKK Art. 5/2-c): the account, app services, family feature and subscription
- Compliance with a legal obligation (Art. 5/2-ç)
- Establishing, exercising or protecting a right (Art. 5/2-e)
- Legitimate interest, provided it doesn’t harm your fundamental rights (Art. 5/2-f): information security and error tracking
- Your explicit consent (Art. 5/1): the waitlist e-mail and, where required, transfers abroad
05Who we share it with
- Hosting, database, file storage and authentication: Supabase (servers in the European Union, Ireland)
- Receipt and statement reading, Ask Ceres: Anthropic (USA) — the receipt image, statement content, or the summary financial data needed to answer your question
- Subscription management: RevenueCat (USA); purchases: Apple App Store and Google Play
- Notifications: Expo, Apple Push Notification Service and Firebase Cloud Messaging
- Error tracking: Sentry — masked error logs with no personal data other than the user id
- Sign-in: Apple and Google, if you choose them
- Account e-mails: [e-mail delivery provider]
- If you use the family feature, members of the same household; competent public authorities when legally required
Transfers to providers abroad rely on the appropriate safeguards of KVKK Art. 9 (standard contracts) or, where that isn’t possible, on your explicit consent. Your personal data is never shared with third parties for advertising or marketing, and never sold.
06How it is collected
Electronically, through the app and the website: what you enter yourself, the photos you take or pick and the files you upload, and automatically, such as device and error logs.
07Retention
- Account data is kept while your account is open.
- When you delete your account, your account, records and files are permanently erased after a 30-day grace period; until then you can cancel the request.
- Uploaded statement files are deleted right after they are read.
- Feedback may be kept with its link to your account removed.
- The waitlist e-mail is kept until the launch announcement or until you withdraw consent.
- Retention duties under the law remain reserved.
08Your rights (KVKK Art. 11)
- Learn whether your personal data is processed and request information about it
- Learn the purpose of processing and whether it is used for that purpose
- Know the third parties it is transferred to, in Türkiye or abroad
- Ask for it to be corrected if incomplete or wrong
- Ask for it to be erased or destroyed under the conditions of KVKK Art. 7
- Ask that corrections, erasure and destruction be notified to the third parties it was transferred to
- Object to a result against you arising solely from automated analysis
- Claim compensation for damage caused by unlawful processing
09How to apply
Send your requests from your registered e-mail address to info@appceres.com, or in writing to [Company address]. Requests are answered free of charge within 30 days at the latest, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller. You can also delete your account and data in the app under Profile › Security & privacy › Delete account permanently.