1. Introduction

At Giderly ("We", "Us", "Service"), we respect your privacy. This Privacy Policy provides information about the personal information we collect, use, and share when you use our service.

2. Information We Collect

We collect the following information when you use our Service:

Account Information: Email address, full name, company name, and account type.
Documents and Data: Invoices and receipts you upload, document images/PDF files, manually entered expense information, and fields extracted from documents when you use AI-powered analysis, such as date, amount, and tax number.
Employee Information: Names, surnames, and contact information of employees you define.
Technical Data: IP address, device information, browser type, and usage statistics.

3. Data Controller

Under applicable privacy law (including KVKK), the data controller is the natural person/business owner providing the service under the Giderly brand/product. On business accounts, the employer/company may also act as a separate data controller for its employees' data.

Contact: info@giderly.com

4. Use of Data

We use the collected information for the following purposes:

To provide and improve our service
To process and analyze your invoices
To manage and secure your account
To provide customer support
To fulfill our legal obligations
To inform about service improvements and new features

5. Data Sharing, Processing, and International Transfers

We only share your personal data with third parties in the following cases:

AI Processing: AI-powered document analysis is optional. Unless this feature is used, document contents are not sent to the AI service provider for analysis, and expenses/documents may be created manually. When you use the feature, document images, PDF content, and related text/data fields may be transferred to the AI service provider for analysis. The AI service provider states that data processed through its enterprise API services is not used to train AI models.
Service Infrastructure: The primary application/database infrastructure used for account information, employee records, expense records, and document archives is hosted on Türkiye-based servers. Limited technical data may be processed by service providers for infrastructure, backup, security, error monitoring, or operational support.
Legal Requirements: To meet legal requests from official authorities.

International transfers: When you use AI-powered analysis, invoice/receipt images, PDF files, and extracted content may be processed outside Türkiye on the AI service provider's infrastructure. You acknowledge that you have been informed of the potential risks of this transfer and, by using the relevant feature, provide explicit consent for the transfer under the Explicit Consent Text.

Important: Your expense data is not sold or shared with third parties for advertising purposes. Each company's data is logically isolated.

6. Data Security

We take industry-standard security measures to ensure the security of your data:

The primary database used for account, company, employee, expense, and document records is hosted on Türkiye-based servers
Your data is stored encrypted (encryption)
Secure HTTPS connections are used
Regular security audits are performed
Access controls and authentication mechanisms are applied
On business accounts, company data is logically separated per account

7. Data Retention

We retain your personal data as long as your account is active and as required by our legal retention obligations. When you delete your account, your data is securely deleted after legal retention periods.

8. Your Rights Under GDPR/KVKK

You have the following rights regarding your personal data:

To learn whether your personal data is processed
To request information if processed
To learn the purpose of processing and whether used appropriately
To know third parties transferred to domestically or abroad
To request correction if incomplete or incorrectly processed
To request deletion or destruction if reasons for processing disappear
To request notification of correction, deletion, or destruction to third parties
To object to a result against you by analyzing exclusively through automated systems
To demand compensation for damages due to unlawful processing

9. Cookies

We use cookies when you use our service. Cookies are used to improve your website experience, manage sessions, and perform usage analysis. You can manage cookies from your browser settings.

10. Children's Privacy

Our service is not intended for individuals under 18. We do not knowingly collect personal information from individuals under 18. If you are a parent or guardian and learn that your child has provided us with personal information, please contact us.

11. Policy Changes

We may update this Privacy Policy from time to time. We will notify you of significant changes. Continuing to use the service after changes means you accept the updated policy.

12. Contact

If you have questions about our privacy policy or want to exercise your rights, you can contact us:

Email: info@giderly.com