Privacy policy
Updated:
This notice explains how the Bina iPhone app, the public statement pages and the bina.sayfa.app website handle personal data. It is the English version of our information notice under Article 10 of Turkey’s Personal Data Protection Law No. 6698 (KVKK).
In short
- Bina manages the dues of apartment buildings and sites. It keeps a building’s dues, payment and expense records on behalf of that building’s management.
- No ads, no ad tracking, no third-party analytics, and we never sell your data.
- We keep no national ID number (TC kimlik) and no date of birth.
- Residents never pay anything; Bina does not take payments, it only keeps records.
Data controller and data processor
- For your account data (your name, e-mail address, sign-in details, devices) the data controller is Bina (bina.sayfa.app). For any question about this notice or your data: [email protected].
- For a building’s records (units, dues, payments, expenses, announcements, documents and the personal data in them) the data controller is that building’s management (the manager or board under the Condominium Law, Kat Mülkiyeti Kanunu). Bina is a data processor that handles them only on the management’s behalf and to provide the service. For example, to ask what a unit owes you need to contact your building’s management; if you send the request to us we forward it to them. The terms are in the data processing agreement.
What we process
When you create an account
- Account data: your name, e-mail address, optional phone number and language. If you sign in with Apple, the identifier Apple gives us and (if you chose to share it) your e-mail address. We keep no password; you sign in with Apple or with a 6-digit code sent by e-mail.
- Session and security records: the device name, IP address and times of use of your sessions, and sign-in attempts.
- Notifications: your push token, to send notifications to your iPhone, and your notification settings.
- Memberships: which building you belong to, with which role (manager, board member, auditor, owner, tenant) and which unit.
When your building uses Bina
On the management’s behalf and instructions we keep: the building’s details and unit list; the name, e-mail and (if given) phone of people linked to units; the dues plan, periodic charges and late fees; payment records, “I paid” claims and receipts; expenses and their receipts; cash and fund records; announcements and messages; uploaded documents and photos; imported bank statements; and audit records of who did what and when.
The location data of photos is removed on your phone before they are uploaded.
The statement link
A resident without the app sees their unit’s statement through a link or QR code from the
management or the owner: balance, open charges, the last 12 months and payment instructions. It
shows nothing about other units. The link is random and unguessable, closed to search engines
(noindex) and can be turned off at any time by the management or the owner. For each view we keep
only the time; no identity and no IP address.
Privacy between neighbours
Residents see the total of the building’s arrears, never another unit’s name or debt. The list of debtors is published only if the building’s decision to do so has been recorded in the app.
Product events
Our server counts events such as “building created” or “claim confirmed”. They carry no personal data: only the kind of event, the building, a count and the time. We use no third-party analytics or advertising tool. Crash reports come through Apple only.
Cookies
The bina.sayfa.app website uses no cookies.
Support access
Bina staff cannot see a building by default. A manager can grant read-only support access from Settings for 7 days, revocable at any time, with a stated reason. While it lasts, every read is written to the Activity log that the building’s managers and auditor can see.
When you e-mail us
Your e-mail address, name and message, used only to reply.
What we do not collect
A national ID number, a date of birth, your phone’s location. Dues are not paid through Apple’s in-app purchase.
Why and on which legal ground
| Purpose | KVKK Art. 5/2 |
|---|---|
| Creating your account, signing you in, linking you to your building | (c) performance of a contract |
| Sending sign-in codes, invitations, notifications and reminders | (c) performance of a contract |
| Keeping dues, payment, expense and account records and showing the year-end account | (ç) legal obligation (the bookkeeping and accounting duties of Law No. 634, for the management) and (c) performance of a contract |
| Security, preventing abuse, finding errors, audit and access logs | (f) legitimate interest |
| Improving the product by counting events (no personal data) | (f) legitimate interest |
| Running the subscription and plan limit (manager accounts) | (c) performance of a contract |
| Lawful requests of competent public authorities | (ç) legal obligation |
| Answering support and deletion requests | (c) performance of a contract |
We do not use your data for marketing, profiling or advertising, and we do not sell it.
Where it is stored and who receives it
- Our servers: the database and the app run in Hetzner Online GmbH’s data centre in Finland (Helsinki), inside the European Union. Uploaded documents and database backups are kept in object storage in the EU.
- Cloudflare, Inc.: carries and protects the traffic of bina.sayfa.app and bina-api.sayfa.app; forwards the e-mail that arrives at [email protected].
- Amazon Web Services (Amazon SES): sends sign-in code, invitation and reminder e-mails from its Ireland region in the EU (eu-west-1), processing the recipient address and the content of the e-mail.
- Apple: Sign in with Apple and iPhone notifications (Apple Push Notification service); notifications carry only a short title and a record id. Apple also distributes the app on the App Store and takes managers’ Bina Pro subscriptions, under its own privacy policy.
- RevenueCat, Inc. (USA): verifies managers’ Bina Pro subscriptions and reports their status to us; the only user id it receives is your account id, never your name or e-mail.
Some of these providers are outside Turkey, so this is a transfer abroad under Article 9 of the KVKK. The providers process data only on our behalf and for the purposes in this notice. Bina shares your data with no one else, and one building’s data is never shown to another building.
How long it is kept
| Data | Kept for |
|---|---|
| Join requests | 30 days after they were approved, declined or withdrawn; a waiting request stays until it is decided |
| E-mail sign-in codes | 1 day |
| Revoked sessions | 30 days after they were ended |
| A deleted account’s personal data (name, e-mail, Apple link, sessions, devices, memberships, notification settings) | Deleted at once; records show “Former resident”, “Former manager” or “Former member” |
| A deleted account’s uploaded files | 30 days, then deleted; receipts of recorded payments and expenses and announcement files are the building’s records and stay |
| Statement-link access log (time only) | 90 days |
| Copies in database backups | At most 30 days |
| Audit log and ledger | As long as the building exists in Bina (legal records); deleted 10 years after the building leaves Bina |
How to delete your account is on the delete account page.
Exporting your data
A manager can export the whole building (entries, units, people, expenses) as a spreadsheet plus a ZIP of the receipt files at any time, on every plan. A resident can export their own data in the app.
Your rights
Under Article 11 of the KVKK you can apply to:
- learn whether your personal data is processed and ask for information if it is,
- learn the purpose and whether it is used accordingly,
- know the third parties it is transferred to in Turkey and abroad,
- ask for correction if it is incomplete or wrong,
- ask for deletion or destruction under the conditions of Article 7,
- ask that corrections and deletions be notified to the third parties it was transferred to,
- object to a result against you produced solely by automated analysis,
- claim compensation if you suffer damage through unlawful processing.
Send your application (Article 13) from your account’s e-mail address to [email protected]. We answer free of charge within 30 days at the latest. If your application concerns a building’s records, the data controller is that building’s management and we forward it to them. If you are not satisfied with our answer you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu). If you are in the European Economic Area your GDPR rights also apply; you can contact the supervisory authority of your country.
Children
Bina is not aimed at people under 18.
Changes
When we change this notice we update the date on this page. We also announce important changes in the app.