Privacy Policy

Last updated: October 12, 2026

1. Data Controller

VectorFi ("we", "the app") acts as the data controller for your personal data under the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the EU General Data Protection Regulation ("GDPR") where applicable.

2. Data We Collect

At registration: username, email address (optional), password hash. When signing in with Google: Google profile information (name, email, profile photo). During app usage: portfolio data (holdings, transactions, watchlist), preferences (currency, widget settings).

3. Purpose of Processing

- Account creation and authentication - Providing portfolio tracking and analysis services - Price alerts and notifications - Ensuring application security

4. Data Transfers

If you use the AI Analyst feature, your portfolio data is sent to Anthropic Inc. (USA) servers for analysis. This transfer is based on your explicit consent under KVKK Article 9. Price data is fetched from third-party API providers (Finnhub, CoinGecko, Yahoo Finance). No personal data is shared with these providers. If you allow analytics, Google Analytics processes visit and feature-usage events, browser/device information and cookie identifiers. Google may process this data outside Türkiye. We do not include your name, email address, account ID, investment amounts, stock symbols or AI conversation content in analytics events. Google Signals and advertising personalization are disabled.

5. Data Retention

Your personal data is retained as long as your account is active. Upon account deletion request, all your data is permanently deleted within 30 days.

6. Your Rights

Under KVKK Article 11 and GDPR, you have the right to: - Know whether your personal data is being processed - Request information about processing - Request correction of your data - Request deletion or destruction of your data - Export your data You can exercise these rights via the "Download My Data" and "Delete My Account" options on your Profile page.

7. Cookies

We use essential session cookies for authentication. With your permission, Google Analytics 4 measures visits and feature usage. Google Analytics is not loaded when analytics is declined. You can change your choice using Privacy preferences on the page. See the Cookie Policy for details.

8. Contact

For privacy-related inquiries: [email protected]

9. Portfolio Screenshot Import

With your explicit consent, uploaded broker screenshots are transferred to Anthropic Inc. (USA) for analysis, constituting an international transfer of personal data under KVKK Article 9. VectorFi processes images in memory only, without storing, logging or using them for training. Metadata, including EXIF and location, is removed before sending. Before uploading, crop or redact account numbers, balances and any information you do not want transmitted. Extracted positions are suggestions, not financial advice; they are not saved to your portfolio until you review the editable preview and explicitly confirm. Each user has a monthly allowance of 30 screenshot analyses.

10. AI Chat Quality Review

Your AI Analyst questions, answers (including incomplete answers), account ID and usage metadata are retained on VectorFi servers for 30 days to evaluate service quality and cost, and may be reviewed by authorized administrators. Expired records become inaccessible and are automatically purged. Raw images and full portfolio snapshots are not added to these records; portfolio information appearing in questions or answers remains part of the text. Deleting browser chat history does not delete the server record; deleting your account also deletes server records. Server records are included in your data export. Physical cleanup runs every minute while the application is running. This period does not determine Anthropic retention or your browser history.

11. Cookieless Visit Statistics

When enabled, we use Umami on our own infrastructure for basic visit statistics: sanitized page addresses, referring domains, browser/operating system, device type, language and approximate location. No cookies or persistent browser identifiers are written. The server processes the IP address and browser information to derive a site-specific daily visitor identifier; raw IP addresses are not stored in the analytics database. This identifier is not linked to your account. Being cookieless does not by itself mean that all data is legally anonymous. Portfolio data, account IDs, email addresses and AI conversations are excluded; session replay and heatmaps are not used. Records are deleted by hourly cleanup after 90 days. You can turn off cookieless measurement or choose Disable all measurement. This measurement is disabled for Do Not Track and Global Privacy Control signals.