How we handle your data

SmartSkor is a financial analytics platform operated by TuneUp Fintech Finansal Teknolojileri Ltd. Şti. ("SmartSkor", "we", "us"), a company registered in İstanbul, Turkey. We provide stock and fund scoring, model portfolios, watchlists, and related analytics for the Borsa İstanbul (BIST) and U.S. markets.

This Privacy Policy applies to the SmartSkor web application and the emails we send you. It describes how we handle personal data and the rights you have under applicable law, including the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where relevant, the EU General Data Protection Regulation ("GDPR").

We collect the following categories of information.

Information you provide

• Account details: your name, email address, and the password or third-party sign-in (such as Google) you use to authenticate.
• Profile and preferences: your language, investment style, and product settings.
• Content you create: watchlists, model portfolio selections, and messages you send to our support team or to the in-product assistant.

Information we collect automatically

• Usage data: pages viewed, features used, and actions taken within the app.
• Device and log data: IP address, browser type, device identifiers, and timestamps.
• Cookies and similar technologies: described under “Cookies and analytics” below.

We do not ask for or intentionally collect special categories of data (such as health or biometric data), we do not collect your brokerage credentials, and we never place trades on your behalf.

We use personal data to:

• Provide the Service: create and secure your account, and deliver scores, portfolios, and watchlist alerts.
• Communicate with you: send transactional and notification emails (for example, score alerts and portfolio rebalance summaries) and respond to support requests.
• Improve SmartSkor: understand how features are used, debug issues, and develop new functionality.
• Keep things safe: detect, prevent, and address fraud, abuse, and security incidents.
• Meet legal obligations: comply with applicable laws and enforce our Terms of Service.

Where the law requires a legal basis, we rely on the performance of our contract with you, your consent (which you can withdraw at any time), our legitimate interests in operating and improving the Service, and compliance with legal obligations.

We use cookies and similar technologies to keep you signed in, remember your preferences (such as language and layout), and understand how the app is used.

We use Google Analytics to measure aggregate usage. You can decline non-essential cookies through our cookie banner, and most browsers let you block or delete cookies. Blocking essential cookies may prevent parts of the Service from working.

We do not sell your personal data. We share it only in the circumstances below.

Service providers

We work with vendors who process data on our behalf under contract, including:

• Hosting and infrastructure providers that run our application and databases.
• Email delivery providers (such as SendGrid and Brevo) that send our transactional and notification emails.
• Analytics providers (such as Google Analytics) that help us measure usage.
• Authentication providers (such as Google) when you choose to sign in with them.
• AI providers (such as Anthropic) that process the messages you send to our in-product assistant in order to generate responses.

Legal and safety

We may disclose information if required by law, regulation, or legal process, or where necessary to protect the rights, property, or safety of SmartSkor, our users, or the public.

Business transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your personal data.

SmartSkor operates in Turkey, and some of our service providers are located in other countries, including the United States and the European Union. When we transfer personal data internationally, we take steps to ensure it is protected in line with this policy and applicable law, including working with providers that offer appropriate safeguards.

We keep personal data for as long as your account is active and for as long as we need it to provide the Service. After you close your account, we delete or anonymize your data within a reasonable period, unless we are required to retain it to comply with legal obligations, resolve disputes, or enforce our agreements.

We use technical and organizational measures designed to protect personal data, including encryption in transit, access controls, and secure authentication. No method of transmission or storage is completely secure, so we cannot guarantee absolute security — but we work to protect your information and to address vulnerabilities promptly.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data, subject to legal exceptions.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.
• Data portability, where applicable.

You can exercise many of these rights directly in the app — for example, by updating your profile or email preferences, or by closing your account. For any other request, contact us using the details below; we will respond within the timeframes required by applicable law. Under the KVKK, you also have the right to lodge a complaint with the Turkish Data Protection Authority.

SmartSkor is not directed to children, and we do not knowingly collect personal data from anyone under the age of 18. If you believe a minor has provided us with personal data, please contact us and we will take steps to delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you in the app or by email. Your continued use of SmartSkor after an update means you accept the revised policy.

If you have questions about this Privacy Policy or how we handle your data, or if you want to exercise your rights, contact us at: