This list is part of the privacy notice; a new sub-processor is announced here before it is added. The Turkish version prevails.
Current list
| Sub-processor | Service | Location | Data accessed |
|---|---|---|---|
| Hostinger | Server (app, website, database, documents) | Germany | All data in the app; sensitive fields (such as national ID number and IBAN) encrypted with a separate key |
| Google (Gmail) | Sending email and emails sent to us | Google's data centers (including the European Union and the United States) | Recipient's name and email address, email content (notifications, reminders, receipts) |
| Google (Drive) | Off-server copy of backups | Google's data centers | Encrypted backup of the database and documents; we hold the key, Google cannot read the content |
Because these providers are located abroad, the transfer is made under KVKK Art. 9 with the standard contract set by the Personal Data Protection Board.
Running on our own server
Components such as PDF generation, virus scanning, queues and caches run on the same server under our management; no data is sent to a third party for them. The website's fonts, icons and images are also served from our own server.
Not used yet
The following join the list when the related feature is enabled and are announced before any transfer begins:
- iyzico (payment institution) and Paraşüt (accounting software, e-invoicing): when paid plans are introduced.
- Firebase Cloud Messaging (Google; mobile notifications): when the mobile app is released.