Paratiq
KVKK Notice
Last updated 17 August 2026
In short
- Paratiq processes the data needed to create your account and provide personal income and expense tracking.
- Receipt and invoice reading is optional; a document is sent to Groq only when you start that process.
- Your data is not sold. You can submit KVKK requests from the email address registered to your account.
1. Data controller and scope
The data controller under Turkish Personal Data Protection Law No. 6698 (the "KVKK") is Metin Bolat, the individual who operates Paratiq. This notice explains how personal data is processed when you visit the Paratiq website, create an account, use the application, or contact support.
You can contact us about this notice and our processing activities at support@paratiq.app. This is an informative English translation of the Turkish KVKK Notice. It is not a request for consent or a term of service. If the two versions differ, the Turkish version prevails.
2. Categories of personal data we process
Depending on the features you use, we may process the following categories:
| Category | Examples |
|---|---|
| Identity and contact | Name, email address, and email-verification status. |
| Account and preferences | Password hash, optional profile image, plan information, language, currency, time zone, country, notification preferences, and security settings. |
| Financial records | Income and expense amounts, dates, categories, descriptions, payment parties, and recurring-transaction details. |
| Documents and extracted data | Receipts or invoices you choose to upload, extracted fields, your masking choice, and processing status. |
| Security and technical records | IP address, browser or device information, sessions, and authentication-security events. |
| Communications and notifications | Support correspondence, notification preferences, email-delivery status, and web-push subscriptions. |
| Account requests and action records | Data-export and account-deletion requests, request status, and the version, language, and presentation time of the KVKK notice shown to you. |
| KVKK application data | Your request, contact details, and information that may be required to verify your identity. |
Paratiq does not intend to collect special-category personal data. Please do not upload identity documents, bank statements, health records, or documents containing sensitive information that is unnecessary for the service.
3. Purposes and legal grounds
We process personal data for the specific purposes below, relying on the processing conditions in Article 5 of the KVKK:
| Purpose | Main data involved | Legal ground |
|---|---|---|
| Creating an account, authenticating you, and providing the service | Identity, contact, account, and preference data | Necessary to enter into or perform the service agreement (KVKK Art. 5/2-c) |
| Producing transaction records, recurring entries, summaries, and reports | Financial records and preferences | Performance of the service agreement (KVKK Art. 5/2-c) |
| Reading a receipt or invoice when you request it | The uploaded document, masking choice, and extracted fields | Performance of the service you expressly initiate (KVKK Art. 5/2-c) |
| Protecting accounts and systems and preventing abuse | Session, device, IP, verification, and security records | Legal obligations and legitimate interests that do not override fundamental rights (KVKK Art. 5/2-ç, f) |
| Handling support requests and service notices | Contact, support, and notification data | Contract performance, legal obligations, and legitimate interests (KVKK Art. 5/2-c, ç, f) |
| Fulfilling data-export and account-deletion requests | Account, request, export, and deletion records | Contract performance, legal obligations, and the exercise of a right (KVKK Art. 5/2-c, ç, e) |
| Responding to legal requests and protecting rights | Relevant account, transaction, communication, and application records | Legal obligations and the establishment, exercise, or protection of a right (KVKK Art. 5/2-ç, e) |
4. How personal data is collected
We collect personal data by wholly or partly automated means through:
- Information you enter in registration, profile, transaction, and support forms;
- Financial records you create and preferences you select in the application;
- Receipts and invoices you optionally upload for automatic reading;
- Technical data generated through login, sessions, security controls, and error logging;
- Results returned by email-delivery and document-reading providers.
We aim to process only the data needed to operate the relevant feature, protect the service, or meet applicable legal obligations.
5. Recipient groups and overseas transfers
Paratiq relies on several overseas infrastructure and service providers. These transfers are limited to what is necessary for the stated purpose and are made using the appropriate safeguards and contractual measures required by Article 9 of the KVKK.
| Recipient | Purpose and data that may be transferred | Location |
|---|---|---|
| OVHcloud | Hosting the application, database, and user files; account and content data used by the service. | Frankfurt, Germany |
| Groq | Only for automatic document reading that you initiate; the document image and technical request data needed to extract fields. | United States |
| Mailgun | Delivering account and service emails; recipient address, message headers/content, and delivery records. | European Union region |
| Browser push services | Only when you enable web notifications; the subscription endpoint created by your browser and the notification content delivered to you. | Depends on your browser or device provider |
| Authorised public bodies and legal advisers | Records required to meet a legal obligation or protect a right. | As required by the request or legal process |
If a provider or data flow changes, this notice will be updated before the new transfer begins. Paratiq does not sell personal data to advertisers or data brokers.
6. Optional document reading and masking
Receipt and invoice reading is optional. If you do not use it, your document is not sent to Groq, and you can always enter a transaction manually. When you start the feature, the file is uploaded to the Paratiq server and checked for malware first.
Masking is enabled by default for new accounts, but you can turn it off for each upload or in your profile. When enabled, the system attempts to black out fields it can detect, such as national identifiers, IBANs, and card numbers, before sending the image. Masking is best-effort: faded, blurred, angled, or unusually formatted information may not be detected. If masking is selected but cannot finish, the document is not sent unmasked; automatic reading stops.
Zero Data Retention (ZDR) is enabled for Paratiq's Groq account. This does not mean the document is never processed; it prevents the provider from retaining submitted content and results for system reliability or abuse monitoring. Groq states that inputs and outputs are not used for model training and that usage metadata which does not contain those inputs or outputs is still retained. The original document and extracted fields may remain associated with your Paratiq account so that you can review the result.
For the technical flow and available controls, read Document Reading and Privacy.
7. Retention, deletion, and security
Personal data is kept for as long as needed for the relevant purpose, while your account remains active, and to the extent required by applicable legal obligations. We do not claim fixed retention periods that have not been verified or implemented in practice.
A data archive requested from your profile contains your account and preferences, financial records, document-reading records, and transaction attachments. A completed archive is kept in private storage for 7 days and then automatically deleted. Its signed download link is shorter-lived; the record that an export was generated remains with your account.
After you request account deletion, you have 10 days to change your mind. If you do not cancel during that period, your Paratiq user record, financial records, sessions, push subscriptions, uploaded files, and completed data archives are submitted for permanent deletion. To demonstrate that destruction took place, a limited record is kept containing a keyed digest instead of your email address, together with the reason, time, and result counts. Records may otherwise be retained only where a legal obligation or the protection of a right requires it, and only within that scope and period.
Measures include password hashing, encryption in transit, access restrictions, optional two-factor authentication, session controls, rate limiting, and malware checks on uploaded files. No internet service can provide an absolute security guarantee.
8. Your rights and how to apply
Under Article 11 of the KVKK, you may ask the data controller to:
- Confirm whether your personal data is processed;
- Provide information about processing;
- Explain the purpose of processing and whether data is used consistently with that purpose;
- Identify third parties in Türkiye or abroad to whom data has been transferred;
- Correct incomplete or inaccurate data;
- Delete or destroy data where the KVKK conditions are met;
- Notify recipients of corrections, deletion, or destruction;
- Object to an adverse result produced exclusively through automated analysis; and
- Seek compensation for damage caused by unlawful processing.
Send your application from the email address registered to your Paratiq account to support@paratiq.app. Include your name, contact details for the response, the subject of your request, and any relevant information or documents. We may request additional verification to protect your account and data.
You can also request a copy of the information associated with your Paratiq account by using the data-export tool in your profile, and start account deletion from the same area. These tools do not limit your right to submit a KVKK application by email.
Applications are answered as soon as possible and no later than 30 days, depending on their nature. If responding creates an additional cost, fees may be charged only in line with the tariff set by the Turkish Personal Data Protection Board.
9. Changes and effective date
This notice took effect on 17 August 2026. If there is a material change to a processing purpose, provider, or legal ground, the notice will be updated before the relevant new processing begins. The current version is always published on this page.