Skip to content
Nakitte

Privacy Policy — International edition (English)

Privacy Policy

Last updated: 30 June 2026 — Draft pending legal review.

This is the English-language international edition (covering KVKK and US privacy law). For users in Türkiye, the binding privacy notice is the Turkish KVKK Aydınlatma Metni (also available there in English).
Draft for review. This policy is a working draft prepared for legal review and is not yet a final, counsel-approved document. Items marked “TODO” must be confirmed before publication.

This Privacy Policy explains how CELİK GROUP TEKNOLOJİ LİMİTED ŞİRKETİ (“Nakitte”, “we”, “us”), the operator of nakitte.com and related applications (the “Service”), collects, uses, discloses, and protects personal data. It is written to address both the Turkish Personal Data Protection Law (Kişisel Verilerin Korunması Kanunu, “KVKK”, Law No. 6698) and applicable United States privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”) and comparable US state laws.

1. Data Controller / Business Identity

The data controller (KVKK) and the “business” (CCPA/CPRA) responsible for your personal data is:

  • Legal name: CELİK GROUP TEKNOLOJİ LİMİTED ŞİRKETİ
  • Registered address: ÇALCA OSB MAH. 1 CAD. NO: 1 İÇ KAPI NO: 45, MERKEZ / KÜTAHYA, Türkiye
  • MERSİS no: 0205123079900001 · Trade registry no: 13589
  • Privacy contact: kvkk@nakitte.com · General: info@nakitte.com
  • KEP (registered e-mail): celikgroupteknoloji@hs01.kep.tr

TODO (counsel): confirm VERBİS registration status and whether a designated contact/representative must be named.

2. Personal Data We Collect

We collect the following categories of personal data:

  • Identity & contact data: name, email address, and account credentials you provide on registration.
  • Account & preference data: subscription tier, feed and language preferences, watchlists, and portfolio composition you enter (Nakitte stores portfolio composition only — never values or balances).
  • Usage & device data: pages viewed, interactions, IP address, browser/device type, and similar analytics signals collected via cookies and similar technologies.
  • Communications: messages you send to support and your responses to surveys or emails.

We do not intentionally collect special categories of personal data (KVKK Art. 6) or sensitive personal information, and we ask that you not submit it through the Service.

3. Purposes & Legal Bases (KVKK Art. 5–6)

We process personal data to:

  • create and operate your account and provide the Service;
  • deliver news briefings, reports, and notifications you request;
  • process payments and manage subscriptions;
  • secure the Service, prevent fraud and abuse, and meet legal and regulatory obligations (including MASAK/AML and tax record-keeping);
  • measure and improve the Service through analytics; and
  • send service and, where permitted, marketing communications.

Under KVKK, our legal bases include performance of a contract (Art. 5/2-c), compliance with a legal obligation (Art. 5/2-ç), our legitimate interests (Art. 5/2-f), and, where required, your explicit consent (Art. 5/1) — for example for certain marketing or non-essential cookies. You may withdraw consent at any time.

4. Cookies & Analytics

We use strictly necessary cookies to operate the Service and, subject to applicable consent requirements, analytics cookies (Google Analytics / Firebase, and optional Cloudflare Web Analytics) to understand usage. See our Cookie Policy for details and your choices. Where we deploy Google Reader Revenue Manager, it is configured in open-access mode for audience signals only.

5. Disclosure of Personal Data

We share personal data with service providers (processors) acting on our behalf — including cloud hosting (Amazon Web Services), analytics providers (Google), our payment provider (Tosla Sanal POS), and email delivery — and with authorities where required by law. We require processors to protect personal data and use it only for the services they provide to us.

We do not sell your personal data, and we do not “sell” or “share” personal information for cross-context behavioral advertising within the meaning of the CCPA/CPRA.

6. International Transfers

Nakitte is operated from Türkiye, and our infrastructure and service providers may process data in the European Union (AWS Frankfurt) and the United States. Where personal data subject to KVKK is transferred abroad, we rely on the cross-border transfer mechanisms permitted under KVKK Art. 9 (as amended in 2024), such as adequacy, appropriate safeguards (e.g. standard contractual clauses / undertakings), or your explicit consent where applicable.

7. Data Retention

We retain personal data only as long as necessary for the purposes above and to meet legal retention obligations (for example, Turkish tax and commercial-law record-keeping periods), after which it is deleted, destroyed, or anonymized.

8. Your Rights — Türkiye (KVKK Art. 11)

If you are in Türkiye, you have the right to learn whether your personal data is processed; request information about the processing; learn its purpose and whether it is used accordingly; know the third parties to whom it is disclosed; request correction of incomplete or inaccurate data; request erasure or destruction; request notification of these actions to third parties; object to outcomes arising from automated analysis; and claim compensation for damage caused by unlawful processing. To exercise these rights, contact kvkk@nakitte.com or our KEP address. We respond within the periods set by KVKK.

9. Your Rights — United States (CCPA/CPRA and other state laws)

If you are a US resident (and, in particular, a California resident), you may have the right to: know and access the categories and specific pieces of personal information we collect; know the categories of sources, purposes, and third parties; request deletion; request correction; and opt out of any “sale” or “sharing” of personal information. We do not sell or share personal information, so no opt-out is required, but you may still submit a request. We will not discriminate against you for exercising these rights.

To exercise these rights, email kvkk@nakitte.com. We will verify your request consistent with applicable law and may ask you to confirm information matching our records. You may use an authorized agent where the law permits.

10. Children’s Privacy

The Service is intended for adults and is not directed to children. We do not knowingly collect personal data from children under 18 (Türkiye) or under 13 (United States, per COPPA). If you believe a child has provided us personal data, contact us and we will delete it.

11. Security

We apply appropriate technical and organizational measures — encryption in transit, access controls, and secrets management — to protect personal data against unauthorized access, loss, or disclosure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Policy from time to time. We will post the updated version here and revise the “Last updated” date; material changes will be communicated as required by law.

13. Not Investment Advice

Nakitte provides financial information and AI-generated analysis for educational purposes only. It is information, not investment advice (SPK Communiqué V-128.4 §7/5). See our Terms of Service.

14. Contact

For any privacy question or request, contact kvkk@nakitte.com. You also have the right to lodge a complaint with the Turkish Data Protection Authority (Kişisel Verileri Koruma Kurumu, “KVKK Kurumu”).