Scope notice: This Privacy Policy applies only to the website zfinanceapp.com. A separate, dedicated privacy policy will be published for the zFinance mobile application when it becomes available. Nothing in this Policy describes processing that takes place inside an app.

1. Who we are (Controller / Operator)

The controller responsible for processing personal data on this website — within the meaning of Art. 4(7) GDPR (EU/EEA/UK), data controller under the Turkish Personal Data Protection Law (KVKK Law No. 6698), and "business" under the California Consumer Privacy Act (CCPA/CPRA) — is:

Bonita İnternet Teknoloji Ticaret Ltd.
General Manager: Sefa Koç
Company No: 789758-0
Altunizade Mah. Ord. Prof. Fahrettin Kerim Gökay Cad. No: 35/1
Üsküdar / Istanbul, Türkiye
General contact: info@zfinanceapp.com

Person responsible for data protection (Datenschutzbeauftragter / Privacy Officer):
Bera Duranoğlu
Privacy-specific contact: privacy@zfinanceapp.com

Please use the privacy address above for any data-protection request (access, deletion, objection, complaint, etc.). We aim to respond within statutory deadlines (typically 30 days under GDPR/KVKK; 45 days under CCPA).

2. Scope and audience

This Policy describes how Bonita İnternet Teknoloji Ticaret Ltd. ("we", "us", "our") collects, uses, stores, shares and protects personal data when you visit zfinanceapp.com (the "Website"). It is written to comply with:

• the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and equivalent regulations in the EEA, UK and Switzerland;
• the Turkish Personal Data Protection Law (KVKK Law No. 6698) and its secondary legislation;
• the California Consumer Privacy Act as amended by the CPRA ("CCPA/CPRA"); and
• reasonable, generally-accepted privacy practices for visitors from other jurisdictions.

Region-specific rights are detailed in Section 10.

3. What personal data we collect

3.1 Automatically — when you visit the Website

Our hosting and content-delivery providers automatically receive technical access data necessary to deliver the page to your browser. This may include:

• Your IP address (anonymized or truncated wherever technically possible)
• Date, time and time zone of access
• The page or resource requested (URL, query parameters)
• HTTP method, status code and transferred data volume
• Referring URL (the page that linked you to us)
• Browser type, version, language and user-agent string
• Operating system and device type
• An approximate geographic region (country level) derived from your IP

This data is processed in short-lived server logs. We do not use it to identify you personally, build a profile, or combine it with other datasets.

3.2 When you submit the waitlist form

If you choose to sign up via the waitlist form, we collect:

• Your email address (required to send you updates)
• A timestamp of when you submitted the form (used for audit and consent records)
• The IP address from which the form was submitted (used by Mailchimp for double-opt-in / anti-abuse purposes)

Submitting any additional personal data is not requested.

3.3 When you contact us by email

If you write to us at any of our email addresses, we receive your email address, your name (if provided in the message), and the content of your message. This content is processed solely to respond to your enquiry.

3.4 Cookies, similar technologies, and analytics events — see Section 6. If you accept analytics, we also collect: event names and parameters describing how you interact with the site (e.g. pricing_section_view, pricing_tier_hover_intent, plan_cta_click, waitlist_signup, scroll_depth, language_switch, feature_card_open, legal_link_click, time_on_page); a pseudonymous Google Analytics identifier (_ga); and, if behavioural-analytics tools are enabled, anonymized session-replay data (mouse movements, clicks, scroll positions). Sensitive input values (e.g. text typed into form fields) are masked by the relevant tools and not captured.

3.5 Sensitive personal data — We do not knowingly collect sensitive personal data (special categories of data under Art. 9 GDPR / KVKK Art. 6, or sensitive personal information under CPRA). Please do not submit such data to us through the Website.

4. Purposes and legal bases of processing

We process personal data only for the purposes listed below.

(a) Operating, securing and stabilizing the Website — processing of technical access data.
• GDPR: Art. 6(1)(f) — legitimate interest in a stable, secure website.
• KVKK: Art. 5(2)(f) — legitimate interests.
• CCPA business purpose: security and integrity, debugging, short-term transient use.

(b) Waitlist and marketing communications — to send you product news, launch announcements, product updates, promotional offers, special campaigns, and other marketing emails about zFinance and related products or features we believe may interest you.
• GDPR: Art. 6(1)(a) — your explicit consent, given by submitting the form ("opt-in"). You can withdraw consent at any time and unsubscribe via the link in every email — see Section 10.
• KVKK: Art. 5(1) — explicit consent (açık rıza), including under the Turkish Law on Electronic Commerce (Law No. 6563) which requires explicit consent for commercial electronic messages.
• CCPA: collected directly from you with notice at collection. You can opt out at any time.

(c) Responding to email enquiries — to handle questions, support requests, complaints or pre-contractual communication.
• GDPR: Art. 6(1)(b) — pre-contractual/contractual measures; or Art. 6(1)(f) — legitimate interest.
• KVKK: Art. 5(2)(c) or 5(2)(f).

(d) Storing your cookie-consent choice and language preference — saved locally in your browser so we do not have to ask again on every visit.
• GDPR: Art. 6(1)(f). § 25(2) TTDSG: strictly necessary, no consent required.
• KVKK: Art. 5(2)(f).
• CCPA: necessary to honour your stated preferences.

(e) Compliance with legal obligations — e.g. tax retention or law-enforcement requests.
• GDPR: Art. 6(1)(c). KVKK: Art. 5(2)(a). CCPA: legal obligation.

(f) Establishing, exercising or defending legal claims.
• GDPR: Art. 6(1)(f). KVKK: Art. 5(2)(e). CCPA: business purpose.

(g) Analytics, performance measurement and product improvement — to understand how visitors use the Website, which sections capture attention (e.g. pricing visibility, plan-tier hover/clicks), traffic sources, devices, and to improve the product. Performed via Google Tag Manager, Google Analytics 4 and, optionally, behavioural-analytics tools (see Section 5).
• GDPR: Art. 6(1)(a) — your explicit consent, given by clicking "Accept All" on the cookie banner. You can withdraw at any time via the "Cookie preferences" link in the footer.
• KVKK: Art. 5(1) — explicit consent (açık rıza).
• CCPA: notice at collection; opt-out available.

4a. Marketing emails — what to expect

By submitting the waitlist form, you give us your explicit consent to send you marketing emails. These may include:

• Launch announcements — when zFinance becomes available;
• Product updates — new features, improvements and milestones;
• Promotional offers — discounts, special deals or limited-time campaigns related to zFinance or related products and features;
• Educational content — financial-literacy tips, news, and content we believe will interest you;
• Surveys and feedback requests — to help us improve the product.

We may send these emails on a regular basis. Each email will include a clear, one-click unsubscribe link at the bottom. You can also unsubscribe at any time by emailing privacy@zfinanceapp.com. Unsubscribing applies immediately to all marketing communications and does not affect the lawfulness of any messages sent before you unsubscribed.

We do not rent, sell or trade your email address with third parties for their own marketing. The only third party that receives your email is Mailchimp, our email delivery provider, acting strictly on our behalf (see Section 5).

5. Service providers we use (processors / sub-processors)

We rely on the following third-party service providers, each processing personal data on our behalf under a written data-processing agreement where required.

5.1 Hosting — Strato AG
Pascalstraße 10, 10587 Berlin, Germany
Role: web hosting and server-log processing
Location of processing: Germany (EU)
Safeguards: Art. 28 GDPR data-processing agreement; data remains within the EU.
Privacy policy: strato.de/datenschutz

5.2 Hosting / CDN — Netlify, Inc.
44 Montgomery Street, Suite 300, San Francisco, CA 94104, USA
Role: static-site hosting, content delivery network, basic DDoS protection
Location of processing: global CDN with edge servers worldwide; some processing may occur in the US.
Safeguards: EU Standard Contractual Clauses (SCCs) under Art. 46(2)(c) GDPR; Netlify participates in the EU-U.S. Data Privacy Framework.
Privacy policy: netlify.com/privacy

5.3 Waitlist email management — Mailchimp (Intuit Inc.)
2700 Coast Avenue, Mountain View, CA 94043, USA
Role: storage of the waitlist list, delivery of waitlist emails, opt-in/opt-out management
Location of processing: United States, with global delivery infrastructure
Safeguards: EU Standard Contractual Clauses; Intuit/Mailchimp participates in the EU-U.S. Data Privacy Framework; KVKK explicit consent at point of submission.
Privacy policy: intuit.com/privacy/statement

5.4 Google Tag Manager & Google Analytics 4 — Google Ireland Limited / Google LLC
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (for EU/EEA) / Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Role: tag management (GTM container ID: GTM-W4C966F4) and analytics (page views, traffic source, device/browser, demographics at aggregate level, custom interaction events such as pricing-section visibility, pricing tier hovers, plan-CTA clicks, scroll depth, time on page, language switches, waitlist sign-ups, contact clicks, feature-card opens, legal-link clicks)
Cookies & identifiers used: _ga, _ga_*, and similar (lifetime up to 24 months by default — we use a shorter retention where possible)
Location of processing: EU, with possible processing in the United States
Safeguards: EU Standard Contractual Clauses under Art. 46(2)(c) GDPR; Google participates in the EU-U.S. Data Privacy Framework; IP-address anonymization (IP-Anonymization) is enabled where supported.
Legal basis: only loaded after you give consent (Art. 6(1)(a) GDPR; explicit consent under KVKK; notice at collection under CCPA). We use Google Consent Mode v2 — until you accept analytics, no analytics or advertising cookies are written.
Privacy policy: policies.google.com/privacy

5.5 Optional behavioural-analytics tools (e.g. Microsoft Clarity, Hotjar)
We may also use behavioural-analytics services such as Microsoft Clarity (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland / Microsoft Corporation, USA) and/or Hotjar Ltd. (Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian's STJ 3141, Malta) to collect anonymized session replays, heatmaps, scroll maps and click maps. These tools may capture mouse movement, clicks, scrolling and screen interaction. They do not record passwords, form-input values, or content you type into private fields.
Location of processing: EU/EEA and, for Microsoft Clarity, the United States.
Safeguards: EU Standard Contractual Clauses; both providers participate in the EU-U.S. Data Privacy Framework where applicable.
Legal basis: only loaded after you give consent (Art. 6(1)(a) GDPR; explicit consent under KVKK; notice at collection under CCPA).
Microsoft Clarity privacy: privacy.microsoft.com/privacystatement
Hotjar privacy: hotjar.com/legal/policies/privacy

6. Cookies and local storage

We use both strictly necessary storage (always active) and analytics/tracking cookies (only after you give consent).

Strictly necessary (always active — no consent required under Art. 6(1)(f) GDPR and § 25(2) TTDSG):
• zf_cookie_consent (localStorage) — your accept/decline decision. Retention: up to 12 months or until you reset it.
• zf_language (localStorage, where used) — your interface-language preference.

Analytics & tracking (only loaded after you click "Accept All" on the banner):
• Google Tag Manager + Google Analytics 4 — cookies such as _ga, _ga_* (retention up to 24 months); used to understand visitor numbers, sources, interactions with the pricing section, scroll depth, and other engagement signals.
• Behavioural-analytics tools (e.g. Microsoft Clarity, Hotjar), if enabled — set their own cookies / local storage for session replay, heatmaps and click maps.

Your control: when you first visit, we ask via a banner. You can change your choice at any time using the "Cookie preferences" link in the footer, or by clearing your browser storage for this site. We use Google Consent Mode v2: until you actively give consent, all analytics and advertising signals are set to denied, and Google's tags transmit only non-identifying pings (no cookies).

For questions about cookies, contact privacy@zfinanceapp.com.

7. International data transfers

Because our hosting (Netlify), our newsletter provider (Mailchimp), our analytics provider (Google) and any optional behavioural-analytics provider (e.g. Microsoft Clarity, Hotjar) may rely on US-based infrastructure, certain processing may take place outside the EU/EEA/Türkiye, including in the United States.

For these transfers, we rely on:

• EU Standard Contractual Clauses (SCCs) under Art. 46(2)(c) GDPR (Commission Implementing Decision (EU) 2021/914);
• Participation by the recipient in the EU-U.S. Data Privacy Framework (DPF);
• For Türkiye-originating data, the explicit consent (açık rıza) provided by you when submitting the form, in accordance with KVKK Art. 9.

You can request a copy of the relevant safeguards by emailing privacy@zfinanceapp.com.

8. Recipients of data — do we sell or share your data?

We do not sell personal data and we do not share personal data for cross-context behavioural advertising — terms defined under CCPA/CPRA. We have not done so in the past 12 months and have no plans to do so.

Personal data is disclosed only to:

(a) the service providers listed in Section 5, acting as processors / sub-processors under contract;
(b) competent public authorities, where legally compelled (e.g. court orders, regulatory requests);
(c) professional advisors (lawyers, accountants) bound by professional confidentiality, where strictly necessary;
(d) successors in the event of a merger, acquisition, restructuring or sale of assets — in which case you will be notified and your rights will be preserved.

9. How long we keep your data (retention)

We keep personal data only as long as necessary for the purpose for which it was collected, or as required by law.

• Server log data — automatically deleted or anonymized within 7 days of collection, except where extended retention is required to investigate a security incident.
• Waitlist email address — kept until (i) you unsubscribe via the link in any email, (ii) you ask us to delete it, or (iii) our launch communications are concluded. Following any of these, your data is removed from active systems within 30 days. Backups are overwritten on rolling cycles.
• Cookie-consent / language preference (localStorage) — stored on your device for up to 12 months or until you clear it.
• Email correspondence — retained for the duration of the matter and for up to 12 months thereafter, then deleted, unless statutory retention obligations apply.
• Legal / tax retention — where applicable (e.g. invoices), Turkish Tax Procedure Law and German commercial/tax law (§§ 257 HGB, 147 AO) require retention for up to 10 years.

10. Your rights

The exact rights you have depend on the jurisdiction whose law applies to you. Please contact us if you are unsure.

10.1 For visitors from the EU, EEA, UK and Switzerland (GDPR / UK GDPR)

You have the right to:

• Access (Art. 15 GDPR);
• Rectification (Art. 16 GDPR);
• Erasure — "right to be forgotten" (Art. 17 GDPR);
• Restriction of processing (Art. 18 GDPR);
• Data portability (Art. 20 GDPR);
• Object to processing based on legitimate interest (Art. 21 GDPR);
• Withdraw consent at any time (Art. 7(3) GDPR), without affecting prior lawfulness;
• Lodge a complaint with a supervisory authority (Art. 77 GDPR);
• Not be subject to a decision based solely on automated processing (Art. 22 GDPR) — we do not carry out such decisions on this Website.

10.2 For visitors from Türkiye (KVKK)

Under Art. 11 KVKK you have the right to:

• Learn whether your personal data is being processed;
• Request information if it has been processed;
• Learn the purpose and whether the data is used in accordance with that purpose;
• Know third parties to whom data has been transferred (domestically or abroad);
• Request correction of incomplete or inaccurate data;
• Request erasure or destruction within the framework of KVKK Art. 7;
• Request notification of these operations to third parties to whom data has been transferred;
• Object to results based solely on automated processing;
• Claim compensation for damages arising from unlawful processing.

You may file a complaint with the Turkish Personal Data Protection Authority (KVKK, kvkk.gov.tr).

10.3 For residents of California (CCPA / CPRA)

You have the right to:

• Know / access the categories and specific pieces of personal information we have collected, the sources, the business or commercial purpose, and the categories of third parties with whom it is shared;
• Delete personal information we collected from you, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt out of "sale" or "sharing" of personal information — as noted in Section 8, we do not sell or share, but you may submit a request at any time;
• Limit use of sensitive personal information — we do not knowingly collect sensitive PI, so this right is automatically honoured;
• Non-discrimination — we will not deny you service, charge a different price, or provide a different level of service because you exercised your rights.

You may also designate an authorized agent. We may need to verify your identity before fulfilling certain requests.

10.4 For visitors from other jurisdictions — We will honour reasonable requests for access, correction or deletion of your personal data even where no specific law applies.

How to exercise your rights: Email privacy@zfinanceapp.com. Please describe your request and provide enough information for us to identify you. We will respond within statutory deadlines.

11. Supervisory authorities

If you believe your rights have been violated, you may lodge a complaint with the competent authority:

• EU/EEA: the data protection authority of your country of residence, place of work, or place of alleged infringement;
• Germany: the Landesdatenschutzbeauftragter of your federal state;
• UK: Information Commissioner's Office (ico.org.uk);
• Türkiye: Kişisel Verileri Koruma Kurumu (kvkk.gov.tr);
• California, USA: California Privacy Protection Agency (cppa.ca.gov) and the California Attorney General.

12. Security

We use industry-standard technical and organizational measures, including:

• TLS / HTTPS encryption for all data transmitted to and from the Website (HSTS where supported);
• Restricted access to user data on a strict need-to-know basis;
• Vendor due diligence on all processors we use;
• Regular review of access permissions, logs and security configurations.

No internet transmission is 100% secure. If a personal-data breach occurs that is likely to result in a high risk to your rights, we will notify you and the competent supervisory authority within the statutory deadlines (72 hours under GDPR Art. 33).

13. Children's privacy

This Website is not directed at children under 13 (or, where applicable, under 16). We do not knowingly collect personal data from children below this age. If you become aware that a child has provided us with personal data, please contact privacy@zfinanceapp.com and we will delete it promptly.

14. Links to third-party websites

The Website may contain links to third-party websites. We are not responsible for their privacy practices. Please consult their privacy policies before providing any personal data.

15. Updates to this Policy

We may update this Privacy Policy from time to time. The current version is always published on this page with the "Last updated" date. Material changes will be highlighted via a notice on the Website or communicated to you directly where required by law.

16. Contact

For any privacy-related question, request or concern:

Bera Duranoğlu — Person responsible for data protection
Bonita İnternet Teknoloji Ticaret Ltd.
Altunizade Mah. Ord. Prof. Fahrettin Kerim Gökay Cad. No: 35/1, Üsküdar / Istanbul, Türkiye
Email: privacy@zfinanceapp.com

For non-privacy enquiries: info@zfinanceapp.com

Last updated: May 2026 — Version 2.0 (website-only)