Privacy policy

Who we are

TheFinly is a B2B financial-statement analysis service provided by Metoraz AI & Consultancy (İzmir, Türkiye). Privacy contact: info@thefinly.com. A full street address, MERSIS, tax number and VERBIS status are intentionally omitted. No data protection officer or EU representative has been appointed. No certification is claimed.

Controller and processor

For account and site data, Metoraz AI & Consultancy is the controller. For company financial data uploaded into the app, the customer company is typically the controller and Metoraz AI & Consultancy acts as processor under GDPR Art. 28. This split also applies to German and Dutch customer companies.

Invoice Control module

When the Invoice Control module is enabled, the invoices you upload or send via the API are processed on behalf of your company and on its instructions. These are Turkish e-invoices and e-archive invoices (e-Fatura, e-Arşiv) and, for Germany and the Netherlands, EN 16931 compliant e-invoices (XRechnung, ZUGFeRD/Factur-X, Peppol/NLCIUS). Data processed: supplier and buyer names, tax numbers or VAT IDs, amounts and invoice lines. The role split above also applies here: your company is the controller and Metoraz AI & Consultancy acts as processor under GDPR Art. 28. Your company, as controller, determines the legal basis according to the bookkeeping and retention obligations of its own country. The data is used only for rule-based checks and, for companies in Türkiye, chart-of-accounts suggestions, and is not transferred to AI services. Chart-of-accounts suggestions are generated only for companies in Türkiye; no suggestions are made for German or Dutch invoices. Fields read from PDFs or photos are not stored without your confirmation, and raw files are not retained. Data is deleted on your company's instruction, taking its statutory retention periods into account. Data subject requests should be addressed to the controller; requests we receive are forwarded to your company.

Data we process

Account (email, password hash, optional name, company name), demo request (name, company, email, phone, message, IP), language cookie, session cookies and hosting logs.

Customer business data: parsed financial-statement lines (the raw file is not stored), company display name, periods, country framework, ratios, regulatory findings, AI text, forecast snapshot and generated Company Health Report. Data may also arrive via read-only integrations or inbound API pushes from connected accounting or ERP systems (trial balance JSON); we do not write back to those systems. Officer or shareholder names in a workbook or connected system may be processed on the customer's instruction.

Purposes

Providing the contracted analytics service (upload, rule engine, Forecasting, PDF report, regulation catalogues), optional AI commentary, account security, answering demo requests, hosting and language preference.

Legal bases (GDPR Art. 6)

Art. 6(1)(b): performing the account and analysis contract; for a demo request, steps at the request of the person before a contract. Art. 6(1)(f): security, session integrity, the strictly necessary language cookie, hosting logs and technical operation of the service, balanced against fundamental rights. For customer business data the Art. 6 basis sits primarily with the customer controller; we follow contractual instructions as processor. We do not seek marketing consent.

Processors and recipients

We use the sub-processors listed below to provide the service. AI sub-processors receive masked financial context only, and the Company Admin can turn Metoraz AI processing off in company settings. Email may also be sent through a configured SMTP server. No external font service is loaded in the browser; no analytics or tracker packages are installed.

International transfers

The application and database are hosted in the EU (Frankfurt); Metoraz AI processing may take place in the United States. Email delivery may also take place outside Türkiye and the EEA (United States). Under the GDPR, standard contractual clauses (SCCs) and the providers' terms are the intended safeguards. KVKK Art. 9 as amended by Law 7499 also applies to transfers from Türkiye.

Retention

Account and analyses are kept while the account is active. There is no in-product delete flow; request erasure at info@thefinly.com. Demo rows have no coded expiry. Raw xlsx is not written. A session lasts at most 12 hours and ends after 30 minutes without activity.

Your rights (GDPR Arts. 15-22)

Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21) and the safeguards around automated decisions in Art. 22. KVKK Art. 11 rights also apply in Türkiye. Requests: info@thefinly.com.

Automated decisions (Art. 22)

We do not take solely automated decisions that produce legal effects or similarly significant effects on individuals. Scores, rules, forecasts and AI text are board information. They are not investment, credit, contract or official-filing decisions. A qualified reviewer should make the final judgement.

Supervisory authorities

Türkiye: Personal Data Protection Board (KVKK Kurulu). Germany: the competent state data protection authority (Landesdatenschutzbehörde); BfDI for federal matters. The Netherlands: Autoriteit Persoonsgegevens. In the EU you may also complain to the authority in your habitual residence, place of work or the place of the alleged infringement.

Contact

Metoraz AI & Consultancy, İzmir, Türkiye. Email: info@thefinly.com.

Metoraz AI (AI sub-processors)

While Metoraz AI processing is on, TheFinly sends masked parsed statement lines, period labels, ratio and regulatory summaries to the AI provider in the sub-processor list for executive and forecast commentary. Raw files are not sent. The Company Admin can turn this processing off in company settings; while it is off, no data is sent. This processing may take place outside Türkiye/the EEA (United States). Generated text is stored on the analysis record; retention at the provider follows the provider's policy. info@thefinly.com.