Privacy Policy

Data controller

Under KVKK, the data controller responsible for the processing of personal data is Nafru, the operator of Finbula. You can direct requests and questions regarding the processing of your personal data to Nafru at infu@nafru.com.

Personal data we process

• Identity and contact data: the name, email address, and, where provided, phone number you give us at sign-up.
• Account and preference data: username, language and notification preferences, subscription information.
• Connected exchange data: balance, position, and portfolio information accessed via an API connection. A read-only connection is enough for monitoring; if you subscribe to automated trading bots, order data is also processed under the trading permission you grant. Withdrawal permission is never requested, in any mode.
• Transaction security data: IP address, login timestamps, device and browser information, log records.
• Usage data: interaction and performance data, anonymized wherever possible, collected to improve the product.

Purposes of processing and legal grounds

We process your personal data to provide the service, create and manage your account, build portfolio and analysis views, generate AI-powered signals, ensure security, comply with legal obligations, and improve the product. These processing activities rely on the legal grounds set out in Article 5 of KVKK: being directly related to the establishment or performance of a contract, compliance with a legal obligation, the data having been made public by the data subject, being necessary for the establishment, exercise or protection of a right, and being necessary for the controller’s legitimate interest. Where explicit consent is required (for example, marketing communications), we obtain your consent separately.

The scope of the exchange API connection

If you only want to monitor your market, exchange accounts are connected through read-only API keys; in that scope we view and analyze information such as balances, positions and trade history, and no orders are placed on your behalf. If you choose to subscribe to automated trading bots, a trading permission you grant is added to your connection so those bots can place orders on your behalf. Withdrawal or transfer permission is never requested, in any mode. Your API keys are stored encrypted and are never displayed in full in the interface.

Retention periods

We retain your personal data for as long as necessary for the purpose of processing, subject to any statutory retention periods under applicable law. When you delete your account, personal data outside the scope of our legal retention obligations is deleted, destroyed, or anonymized within a reasonable period.

Transfers and data processors

To provide the service, we work with service providers such as hosting and cloud infrastructure providers, email communication providers, payment processors, exchange API integrations, and AI model providers. Only the minimum data necessary for the relevant service is shared with them, and these arrangements are secured by contractual confidentiality and data security obligations. Except for the exceptions provided under KVKK, we do not share or sell your data to third parties for marketing purposes without your explicit consent.

International transfers

Some of the service providers we use (such as cloud infrastructure and AI model providers) may operate servers located outside Turkey. In such cases, any transfer of your personal data abroad is carried out in accordance with Article 9 of KVKK and the adequate safeguard mechanisms determined by the Turkish Personal Data Protection Board (explicit consent, appropriate safeguard agreements, or other methods provided under applicable law).

Cookies

Finbula uses essential and optional cookies to manage your session, remember your preferences, ensure security, and analyze usage statistics. You can manage your preferences or withdraw your consent for non-essential cookies through your browser settings.

Your rights as a data subject (KVKK Art. 11)

• To learn whether your personal data is being processed,
• To request information about the processing if your personal data has been processed,
• To learn the purpose of processing and whether it is used in accordance with that purpose,
• To know the third parties to whom your personal data is transferred, domestically or abroad,
• To request correction of your personal data if it has been processed incompletely or incorrectly,
• To request deletion or destruction of your personal data within the conditions set out in Article 7 of KVKK,
• To request that correction, deletion, or destruction be notified to third parties to whom the data has been transferred,
• To object to a result that arises to your detriment through the exclusive analysis of processed data via automated systems,
• To request compensation for damages arising from the unlawful processing of your personal data.

How to exercise your rights

To exercise the rights above, you can submit a written request, together with information verifying your identity, to infu@nafru.com. Your request will be answered within 30 days at the latest, depending on its nature, and in accordance with the procedures set out in KVKK. If your request is rejected, found insufficient, or not answered within the statutory period, you retain the right to file a complaint with the Turkish Personal Data Protection Board.