Privacy Policy

This Privacy Policy has been prepared by HESAPP LTD ("Company", "we", "our"). Under the Personal Data Protection Law No. 6698 ("KVKK") and the UK General Data Protection Regulation ("UK GDPR"), our Company acts as the Data Controller.

This Privacy Policy applies to all persons who use the Adiso mobile application, website, or any of our services. By using our services, you acknowledge that you have read and understood this Policy.

Personal data is retained for the period required by the processing purpose and applicable legal retention obligations:

• •Account data: For as long as the account is active; up to 3 years after account closure.
• •Transaction data: 7 years from the date of the last transaction (required by tax and accounting regulations).
• •Usage and technical data: 12 months.
• •Customer support records: 2 years from resolution of the request.
• •Marketing consent records: Until consent is withdrawn, or 3 years from the last interaction.
• •Advertising measurement consent records (each grant and withdrawal): Kept even after account deletion, for as long as needed to prove the consent, in line with limitation periods.
• •Install source: For as long as the account is active, as part of account data.

Upon expiry of the retention period, data is securely deleted or anonymised.

Your data is shared only with the following categories of recipients and only to the extent necessary:

• •Infrastructure and cloud services: Server hosting, database, and file storage (e.g. AWS, Render).
• •OCR and image processing services: Used to extract text from receipt photos; minimum data required.
• •Product analytics: PostHog (EU servers), which receives in-app activity and session recordings linked to your account, with on-screen text masked.
• •Crash reporting: Google Firebase Crashlytics, which receives error and crash reports.
• •Usage statistics (Android app): Google Analytics for Firebase, which receives app opens, sessions, screens viewed, device model, operating system and app version, under an app instance identifier. Advertising identifier collection and ad personalisation are switched off, and Google processes this data on our behalf.
• •Advertising measurement: Meta Platforms, which receives only the measurement data in Section 3.6. We never send Meta your name, email address, username, receipts, amounts or search terms. Meta also processes this data under its own Data Policy.
• •Listed venues: Aggregated statistics only, such as how many people viewed or saved a venue. They never identify you, and figures based on too few people are not shown.
• •Competent public authorities: Where legally required.

Transfers to Meta Platforms and PostHog are transfers outside Turkey. The transfer to Meta is based on your explicit consent. Other transfers outside Turkey or the United Kingdom rely on standard contractual clauses under Article 9 of KVKK and UK GDPR, or equivalent safeguards.

Your personal data is never sold to third parties.

Under Article 11 of KVKK and UK GDPR, you have the following rights:

• •Right to be informed: Learn whether and how your personal data is being processed.
• •Right of access: Request access to your processed personal data.
• •Right to rectification: Request correction of inaccurate or incomplete data.
• •Right to erasure (right to be forgotten): Request deletion of your data under certain conditions.
• •Right to restriction: Request that processing be halted under certain conditions.
• •Right to data portability: Receive your data in a structured, machine-readable format.
• •Right to object: Object to processing based on legitimate interests or direct marketing.
• •Rights related to automated decision-making: Request human review of decisions made solely by automated processing.
• •Right to withdraw consent: Withdraw consent at any time for consent-based processing.
• •Right to lodge a complaint: Users in Turkey may apply to the Personal Data Protection Authority (KVKK); users in the UK may apply to the Information Commissioner's Office (ICO).

To exercise any other rights, please email admin@adiso.app. Requests will be responded to within 30 days.

Our website uses session cookies that are essential for it to function, and analytics cookies and local storage from Google Analytics and PostHog (EU servers) to count visits and see which pages are viewed. The mobile app does not use cookies. It uses the analytics, usage statistics, crash reporting and advertising measurement tools described in Sections 3 and 6. Meta's advertising measurement only runs with your consent, which you can withdraw at any time in Profile → Settings → Account Settings → Ad measurement.

The following technical and administrative measures are in place to protect your personal data:

• •TLS/HTTPS encryption in transit.
• •Passwords stored using strong one-way hashing algorithms.
• •Role-based access control; access limited to authorised personnel only.
• •Regular security updates and dependency audits.
• •Data breach response plan; notification to authorities and affected individuals within the legally required timeframe (72 hours).

No system is completely secure. We recommend using a strong, unique password and not sharing it with anyone.

Adiso is not directed at children under the age of 13 and does not knowingly collect personal data from them. Users aged 13–18 must use our services with parental or guardian consent. If you have a concern in this regard, please contact us.

We may update this Privacy Policy from time to time. In the event of significant changes, advance notice will be given via an in-app notification or email. Continued use of our services after changes take effect constitutes acceptance of the updated Policy.

For any questions, requests, or complaints regarding our privacy practices:

• •Email: admin@adiso.app
• •App: Adiso — adiso.app
• •Address: HESAPP LTD, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

This document is legally binding.