Privacy policy

Operator and scope

This policy applies to the Sarraf.ai website and the Sarraf iOS/Android app (ai.sarraf.pro). The operator and data controller is BACKHUB YAZILIM BILGI TEKNOLOJILERI ANONIM SIRKETI. Contact destek@sarraf.ai for privacy and personal data requests.

Account and information you provide

Account creation, phone verification and account management process your phone number, name, email if provided, account ID, sessions and security information. Optional profile fields may include birth year/place, occupation, address and avatar. If you use document verification or uploads, we also process the documents and images you submit. These records are linked to your account.

Portfolio and Sara conversations

Portfolio assets, quantities, purchase/sale and cost records, calculated values/profit, notes and images are stored on our servers to provide personal record features. Sara messages and conversation summaries are also stored with your account. When you use Sara, messages, conversation summaries and relevant profile/portfolio context are sent to the OpenAI API to generate a response. Consider this transfer before sharing private information.

Device, usage and location

Device/client identifiers, platform, app/browser information, language, time zone, notification token, active/background status, last-seen time, visited app screens and technical errors/logs may be processed for notifications, session security and troubleshooting. If you use a feature such as selecting a business location and grant permission, we process precise location and the address you enter. Address/location added for publication on a business profile may be visible to other users. Manage location and photo permissions in device settings.

Purposes and service providers

We use data to verify accounts, provide selected features, personalise portfolio records and conversation responses, deliver notifications, support users and maintain security. Processing grounds include providing the service, applicable legal obligations, legitimate interests in secure operation, and your permission for features that require it.

Depending on the feature, OpenAI (Sara), Google/Firebase (notifications and file services), Cloudflare (hosting, security and media), Sentry (server error monitoring) and the SMS verification provider process necessary data. Providers may process data outside Türkiye; transfers are subject to applicable data protection requirements. We do not sell app data to data brokers or combine it with data from other companies’ apps/sites for advertising tracking.

Offline copies and web preferences

Language/display preferences and previously loaded market/chart data may be stored on your device. Signed-in users may also have offline copies of some personal records. An offline copy does not mean a synchronised server record is absent. Sign out on shared devices and clear local app data when necessary.

The website stores your language choice in a preference cookie. Cloudflare Web Analytics may measure traffic on general web pages. Its measurement script is not loaded on privacy, deletion, MASAK, AI, API or query-string pages. Web measurement does not replace the mobile app’s data collection disclosure.

Retention and deletion — 14 days

Active account data is retained to provide the services you select. Associated personal data is deleted or anonymised within 14 days of account closure or a verified deletion request. Account closure stops access/sessions; it does not automatically erase all associated data at once. Support handles the deletion process separately. Any legal or security retention exception and its duration are explained in the request response. Backup copies are included in the deletion process; restoring a backup must not reactivate deleted account data.

Your rights and contact

Under applicable data protection laws, you may request access, correction, deletion, information about processing, objection and, where applicable, portability or restriction. Change permissions in device settings or close your account. Send requests to destek@sarraf.ai. We request only the information necessary to verify account ownership. Policy changes are published here with an updated date.