KVKK Information Notice (Aydınlatma Metni)

1. What this notice does and does not do

This notice exists to satisfy the disclosure duty in Article 10 of Law No. 6698 on the Protection of Personal Data (“KVKK”). It has one purpose: to tell you which of your personal data is processed, for what purpose, on what legal basis, and to whom it is transferred.

• This is information. It is not a contract you accept and it is not a consent box.
• There is no “I accept the KVKK Notice” box on the site, and there will not be one. Disclosure and explicit consent are separate acts. Article 5/1-f of the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Disclosure Obligation expressly requires them to be carried out separately. The previous version of this notice fused the two; that sentence has been removed.
• There are two places where explicit consent is genuinely taken, and both sit outside this notice: the cookie consent banner, and the newsletter tick during sign-up. Both are described in section 5.
• New account creation is currently closed: sign-up requests are refused at the authentication provider level, so no new account can be created today. When sign-up opens, this notice applies exactly as written.

2. The personal data processed

The list below is what the system actually holds.

• Identity and contact. Your email address. No password is used to sign in — there is no password field anywhere on the site, so we neither process nor store one. You sign in with a one-time link sent to your email, or with “Continue with Google”. If you choose Google, the account identifier, email address and general profile information (your name, the address of your profile picture) that Google passes during authentication are stored in our authentication infrastructure.
• Account and preference data. Your display name, your plan (Ücretsiz, Mergen, Mergen Pro), your credit balance, your language and theme preference, your newsletter preference.
• Portfolio tracker records. The transaction records and notes you type into the portfolio section yourself. They are your own statement; we do not verify whether they correspond to real holdings, and we connect to no bank, exchange or wallet account of yours.
• Credit system records. The in-account records of how your credit balance was earned and how it was spent.
• Technical records. Our server access logs record your IP address, your browser information and the address of the page you requested. They are kept for the security of the service and to prevent abuse.
• Cookies and browser storage. The full list lives in one place: the Cookie Policy (/cerez-politikasi). This notice does not repeat that table. The reason is simple: the cookie list is derived from the code itself and changes when the code changes, and a list kept in two places eventually becomes two different lists.
• What we do not process. We do not take or store payment or card details — there is no payment step on the site yet (see section 4). We do not ask you for special categories of personal data (such as health, belief or biometric data); no such field exists. We use no ad network, no pixel, no tag manager and no separate analytics provider. We do not sell your personal data and we do not share it with third parties for marketing.

3. Who processes this data — the data controller

The data controller under the KVKK is the person who operates the mergen.finance website: [to be completed at launch].

• Address: [to be completed at launch]
• Tax identification number: [to be completed at launch]
• Email: info@mergen.finance

In that capacity, your personal data is processed for the purposes listed below, each on the legal basis shown separately for it. You can send questions about this notice and applications under Article 11 of the KVKK to the addresses above (see section 9).

4. Purposes of processing and the legal basis for each

Each line is one purpose and the legal basis it rests on. No purpose is given more than one basis; every processing operation sits on a single ground.

• Creating your membership, signing you in and managing your account — performance of a contract (KVKK art. 5/2-c). Sending the sign-in link is included here.
• Delivering the service you asked for — performance of a contract (art. 5/2-c). That service is: market data screens, news summaries written in our own words with a link to the source, the reading of KAP disclosures, AI-generated analyst commentary identities, the portfolio tracker you type your own records into, and the credit system.
• Operating your plan and your credit balance — performance of a contract (art. 5/2-c).
• Payment and invoicing — performance of a contract (art. 5/2-c). Not applicable today: there is no payment step on the site and no payment provider is connected. When payments open, this section will be updated with the real list of data collected.
• Securing the service, preventing abuse, rate limiting and keeping server access logs — the controller’s legitimate interest (art. 5/2-f).
• Meeting statutory retention and disclosure obligations and responding to the requests of competent authorities — legal obligation (art. 5/2-ç).
• Analytics: running the embedded TradingView panels — explicit consent (art. 5/1). The measurement cookies that panel sets (Snowplow) are our only source of analytics, and the panel does not load at all until you allow it. The consent mechanism is the cookie banner; it is described in section 5.
• Sending the newsletter and informational messages — explicit consent (art. 5/1). It is optional and unticked by default.

5. The two places explicit consent is genuinely taken — and withdrawing it

Explicit consent is the narrowest ground in the KVKK. We use it in the only two places where it is genuinely required. Both are separate acts; there is no single box that combines them.

(a) Analytics — the cookie consent banner. When you arrive, a banner offers three classes: strictly necessary (always on), analytics, and preferences. “Accept”, “Reject” and the granular “Preferences” panel are equally reachable; refusing is no harder than accepting. Unless you allow the analytics class, the TradingView panel does not load at all: your browser sends not a single request to TradingView and no third-party cookie is set. If you allow it, the panel loads and TradingView sets its own measurement cookies. This permission is the explicit consent within the meaning of art. 5/1 of the KVKK — there is no other consent mechanism for analytics processing on this site.

Your choice is kept for 6 months and is then asked again. You can change your mind at any time: the “Cookie preferences” link in the footer reopens the same panel. Withdrawing consent is as easy as giving it — the same panel, the same link, the same number of clicks; no email to write, no form to fill in, no reason to give. Once withdrawn, the panel does not load again. Withdrawal takes effect going forward; processing carried out before withdrawal does not become unlawful, but it stops from that moment on.

(b) The newsletter. The newsletter box during sign-up is optional and unticked by default. If you leave it unticked nothing changes; your membership is unaffected. If you tick it, that preference is written to your record and the sending of commercial electronic messages rests on your explicit consent (art. 5/1). To change your mind, one line to info@mergen.finance is enough.

Beyond these, no processing rests on explicit consent. In particular: reading this notice, accepting the Terms of Membership, or creating an account is not explicit consent and is not presented as such. Creating an account is an act you take and it forms the contract; the choice in the cookie banner is a second, independent act. We do not condition processing that is necessary for the service to work on consent — because consent made a condition of the service is not freely given and would not be valid.

6. How personal data is collected

Your personal data is collected entirely by electronic means, through mergen.finance:

• during sign-up and sign-in, directly from you (the email link) or, if you choose it, from Google,
• from the records you type into the portfolio and preference screens,
• from the technical information your browser sends with every request,
• from cookies and browser storage.

We have no oral, written or physical collection channel. The legal grounds for collection are set out purpose by purpose in section 4.

7. Transfer abroad (KVKK art. 9)

All of our servers and infrastructure providers are outside Türkiye. We do not present this as “not a transfer”: hosting data in Germany or in the European Union is itself a transfer abroad within the meaning of art. 9 of the KVKK.

• Hetzner Online GmbH — Nuremberg, Germany. The servers the site and the API run on. Every request relating to your account passes through them. Legal basis: performance of a contract (art. 5/2-c); for the access logs, legitimate interest (art. 5/2-f).
• Supabase — on Amazon Web Services, European Union ([to be completed at launch]). Membership, authentication and database. Your account, portfolio and credit records live here. Legal basis: performance of a contract (art. 5/2-c).
• Cloudflare — global edge network. It sits in front of the Supabase API endpoint; your requests pass through it. Legal basis: performance of a contract and security (art. 5/2-c, art. 5/2-f).
• Resend, over Amazon SES — Ireland. Sends the sign-in link emails; your email address is passed to the provider in the process. Legal basis: performance of a contract (art. 5/2-c).
• Google LLC — global, including the United States. Only if you choose “Continue with Google”. You can sign in with the email link without ever using this step; the choice is yours and it is plainly visible on the sign-in screen. Legal basis: operating the sign-in method you chose, that is, performance of a contract (art. 5/2-c).
• TradingView — third-party embedded panel. Only if you allow the analytics class. Once you do, your browser connects directly to TradingView; TradingView sees your IP address, your browser information and the symbol you are looking at, and its own privacy policy applies: https://www.tradingview.com/privacy-policy/. Legal basis: your explicit consent (art. 5/1 and art. 9). If you do not allow it, that connection is never made.

The legal framework for the transfer. As of today the Personal Data Protection Board has issued no adequacy decision for these countries. The necessary infrastructure transfers above will therefore rest on the appropriate-safeguards route set out in art. 9; in our case that will take the form of a standard contract to be signed with the providers and notified to the Authority. Let us be plain: signing those instruments and notifying them is one of the steps to be completed before launch, and this text does not speak of it as done before it is done. When that step is complete, this paragraph will be updated to say which instrument was notified for which provider, and when.

To say it plainly: we do not claim to have taken your explicit consent for these transfers. Making a transfer that the service cannot run without depend on consent offers you no real choice, and such consent is not freely given. The only consent-based transfer is TradingView, and you can withdraw it at any time.

8. Retention periods

• Account, profile, plan and credit records: for as long as your membership lasts. They are deleted when your membership ends or when you ask for deletion; records under a statutory retention obligation are kept until that period expires.
• Portfolio tracker records: until you delete them or your membership ends.
• Server access logs (IP address, browser information, requested address): 14 days. That period was measured on the server itself rather than read off a configuration file: the nginx logs are rotated daily and 14 copies are kept, and as of 30 August 2026 the oldest surviving file is dated 16 August 2026. Application logs are additionally written to journald; those are bounded by size rather than by time (1 GB at most). That bound is currently full and its oldest entry is also 16 August 2026 — so, today, the same 14-day window. If the volume of logging rises that window shortens; if it falls, it lengthens.
• Cookies and browser storage: the duration of every item is written out one by one in the Cookie Policy. The two that matter most legally: your cookie consent choice is kept for 6 months, and the session cookie for 30 days.
• Payment and invoice records: once payments open, they will be kept for the period required by tax and commercial legislation. No such record is created today.

The principle is this: data is deleted when the purpose of processing has fallen away and any statutory retention obligation has ended. When your account is deleted, the records attached to it (portfolio, credit ledger, preferences) are deleted with it.

Let us be plain: there is not yet an automated job that deletes data when its period expires, and there is no self-service account-deletion button on the site; a deletion request is made by writing to info@mergen.finance and is carried out by hand. This section will be updated when automated deletion is in place. The Privacy Policy says the same thing; the two texts must not diverge on this.

9. Your rights as a data subject (KVKK art. 11) and how to apply

Under Article 11 of the KVKK, by applying to the data controller you have the right to:

• a) learn whether your personal data is being processed;
• b) request information about it if it has been processed;
• c) learn the purpose of processing and whether the data is used in accordance with that purpose;
• ç) know the third parties, in Türkiye or abroad, to whom your data is transferred;
• d) request correction where the data has been processed incompletely or incorrectly;
• e) request erasure or destruction within the conditions of art. 7 of the KVKK;
• f) request that operations carried out under (d) and (e) be notified to the third parties to whom the data was transferred;
• g) object to a result adverse to you arising from analysis of the processed data exclusively by automated systems;
• ğ) claim compensation for damage suffered because your personal data was processed unlawfully.

How to apply. You may send your requests by email to info@mergen.finance, or in writing to [to be completed at launch]. Making the application from the email address registered to your account helps us verify your identity and speeds things up. Your application will be concluded as soon as possible and within thirty days at the latest (art. 13/2). This is free of charge; where the operation entails a separate cost, the fee in the tariff set by the Board may be charged. Deletion requests are carried out by hand, because there is no self-service delete button.

For consent-based processing, withdrawing consent requires no application: for analytics, the “Cookie preferences” link in the footer is enough (section 5).

If your application is refused, if you find our answer insufficient, or if you receive no answer in time, you may lodge a complaint with the Personal Data Protection Board within thirty days of learning our answer and in any event within sixty days of the date of application (art. 14).

10. Changes

This notice is updated when the data processed, the purposes, the legal grounds or the recipients change, and the current version is always published on this page. The cookie list is kept in the Cookie Policy rather than here, and is updated there. If the scope of the cookie classes changes, your consent is asked again.

11. Governing text

The Turkish version of this document governs. This English translation is provided for convenience only; in a dispute the Turkish text prevails.