ApplycasTR
Expify

Expify — Privacy Policy

Last updated: 25 September 2026

This policy explains how Expify handles your data. It is the same as the privacy declarations in the stores (App Privacy on the App Store, Data safety on Google Play).

Data we collect

Expify collects the following data as a developer:

  • Identifiers
    Purpose: App functionality · Linked to your identity · Not used for tracking
  • Diagnostics (crashes, performance)
    Purpose: App functionality · Not linked to your identity · Not used for tracking
  • Purchase information
    Purpose: App functionality · Linked to your identity · Not used for tracking

Your documents

Your documents never go to our servers.

Sync

If you turn on cross-device sync, your documents are backed up to your own iCloud (iOS) or Google Drive (Android) account. Only you can access this data; it never reaches us.

Third-party services

Expify uses the following third-party services:

  • Google ML Kit
    Used in the Android app only. Runs on-device document scanning and text recognition; in the process, device/app identifiers and performance and diagnostic metrics are sent to Google. Document content is never sent. On iOS, scanning and text recognition use Apple's on-device tools, and no data is sent to a third party for this.
  • RevenueCat
    Manages subscription and purchase status, remembering it across devices with an anonymous customer ID.

Changes

If we change this policy, we will update the date and publish the new text on this page.

Contact

If you have questions about this policy, write to support@applycas.com.

KVKK Notice

Under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”), we inform you about how your personal data is processed. This section is for people located in Türkiye.

Data controller. Oktay Tanrıkulu (Applycas). Address: Bağlar Mah., 46. Sokak No: 22, Flat 8, Bağcılar/Istanbul, Türkiye. Contact: support@applycas.com.

Personal data processed. When you email us: your email address, your name (if you give it), the content of your message and any information you attach. When you visit the website: technical data such as your IP address and browser information in the hosting infrastructure’s server logs. We do not process special categories of personal data.

Purpose of processing. Answering your support requests and messages, fixing problems in the apps, keeping the site running securely and meeting legal obligations.

Legal basis. KVKK Art. 5/2(f) (the controller’s legitimate interests, provided they do not harm your fundamental rights and freedoms) and Art. 5/2(ç) (the controller’s compliance with a legal obligation).

Method of collection. By email, and automatically through the website’s hosting infrastructure.

Transfers. To the extent necessary to provide the service, your personal data is processed by our hosting and email forwarding provider Cloudflare, Inc. (USA) and Google LLC (USA), which hosts our mailbox, and to that extent is transferred abroad. A data processing agreement under KVKK Art. 12 is in place with Cloudflare. Google’s Gmail service is used under Google’s standard terms of service and privacy policy for account holders. As the Personal Data Protection Board has issued no adequacy decision for these countries, the transfer is made under paragraph six of KVKK Art. 9, on an incidental basis and only to the extent strictly necessary for the technical performance of the operation you initiated — delivering the email you sent us and our reply to you, serving the page you asked to view. Your data is not transferred to any other third party and is not sold.

Retention. Correspondence is kept for no more than twenty-four months after your request is resolved, and, where a legal dispute is possible, for the applicable limitation period. It is then deleted or anonymised. Server logs are kept for a short period under the hosting provider’s own retention policy.

Automated decision-making. No profile is built about you and no decision against you is produced by automated analysis.

Your rights. Under Article 11 of the KVKK, you may apply to the data controller to:

  • Learn whether your personal data is processed,
  • Request information if it has been processed,
  • Learn the purpose of processing and whether it is used accordingly,
  • Know the third parties to whom it is transferred, in Türkiye or abroad,
  • Request correction if it is incomplete or inaccurate,
  • Request deletion or destruction under the conditions set out in the law,
  • Request that corrections, deletions and destruction be notified to third parties to whom the data was transferred,
  • Object to a result against you that arises from analysis of the data by automated systems,
  • Request compensation for damage arising from unlawful processing.

How to apply. Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may apply: in writing with a wet signature to the address above; by email to support@applycas.com using a secure electronic signature or mobile signature; or by a message sent to support@applycas.com from an email address you have previously notified to us and which is registered in our system. Your application should state your name and surname, your signature (for written applications), your Turkish ID number (for foreign nationals, your nationality and passport number), your address for service, your email address and phone number if any, and the subject of your request.

Time limit and cost. Your application is concluded free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. If the request requires an additional cost, the fee set out in the Board’s tariff may be charged.

Complaints. If your application is rejected, our reply is insufficient, or we do not reply within thirty days, you may complain to the Personal Data Protection Board within thirty days of learning of our reply and in any event within sixty days of the date of your application.

GDPR Notice

This section explains your rights under the General Data Protection Regulation (GDPR) and the UK GDPR if you are located in the European Economic Area (EEA) or the United Kingdom.

Controller. Oktay Tanrıkulu (Applycas), Bağlar Mah., 46. Sokak No: 22, Flat 8, Bağcılar/Istanbul, Türkiye. Contact: support@applycas.com. Given the scope of our processing, we are not required to appoint a Data Protection Officer.

EU representative. We have no establishment in the EEA. Because the processing described here is occasional, limited in scope and involves no special categories of data, we have not appointed a representative, relying on the exemption in Article 27(2)(a) GDPR. We will reassess this if our processing changes.

Data, purposes and legal bases.

  • Email correspondence (your email address, your name, the content of your message and any attachments) — to answer your support request. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in responding to requests addressed to us; where the request concerns performance of an app contract, Art. 6(1)(b).
  • Server logs (IP address, browser information) — to serve the page you asked for and keep the infrastructure secure. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in keeping the site running and secure.
  • Legal obligations — Legal basis: Art. 6(1)(c) GDPR.

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms; the data processed is minimal and is never used for marketing.

Recipients. Cloudflare, Inc. (hosting and email forwarding) and Google LLC (the Gmail service that hosts our mailbox). Cloudflare acts as our processor under Art. 28 GDPR and process data only on our instructions. Google’s Gmail service is used under Google’s standard terms of service and privacy policy for account holders. There are no other recipients; your data is not sold and not shared for advertising.

International transfers. These providers (including Google) process data in the United States. Transfers rely on the European Commission’s Standard Contractual Clauses included in Cloudflare’s data processing agreement and, where the provider is certified, on the EU–US Data Privacy Framework. You can request a copy of the safeguards in place by writing to support@applycas.com.

Retention. Correspondence is kept for no more than twenty-four months after your request is resolved, and, where a legal dispute is possible, for the applicable limitation period. Server logs are kept for a short period under the hosting provider’s own retention policy.

Your rights. Under Arts. 15–22 GDPR you have the right to access your data, to have it rectified, to have it erased, to restrict its processing, to receive it in a portable format, and to object at any time to processing based on legitimate interests. Our processing is not based on consent, so there is no consent to withdraw.

Automated decision-making. We carry out no decision-making based solely on automated processing, and no profiling, within the meaning of Art. 22 GDPR.

Do you have to provide data? You need to provide nothing to browse the site. The information you share when emailing us is used only so that we can reply; without it we may not be able to answer your request.

Right to complain. You may lodge a complaint with the data protection authority of your EEA member state. In the United Kingdom the competent authority is the Information Commissioner’s Office (ico.org.uk). If you contact us first, we will do our best to resolve the matter.