Privacy Policy

This Privacy Policy of Yonevo ("Yonevo", "we", "the platform") explains how the personal data of visitors, subscribing managers, management companies and residents (the "User") using its apartment and residential complex management platform is collected, processed and protected.

• Data Controller: Yonevo Yazılım — the registered company name is shown on the subscription invoice.
• Personal Data: any information relating to an identified or identifiable natural person.
• Processing: any operation performed on data, including obtaining, recording, storing, altering, transferring, classifying and deleting it.

Yonevo processes personal data in the following categories:

• Account information: first name, surname, email, phone, role (manager / resident / accounting), password hash.
• Property and unit information: property name, block, apartment number, owner / tenant details, maintenance fee plan.
• Financial records: collection / payment vouchers, bank transactions, cash transactions, cheque and promissory note portfolio, images of invoices and receipts.
• Technical data: IP address, device and browser information, session identifier, log records (kept for security purposes).
• Communication data: your support requests, our email correspondence, feedback forms, the messages you send to the help assistant and the answers it gives.
• Consented visit and sign-up source data: marketing page visits, referring domain, campaign tags, first and last visit source. If you have given analytics consent, this information is linked to your account when you sign up. Advertising click identifiers additionally depend on your marketing consent.

Your data is processed for the following purposes, on the relevant legal grounds:

• Performance of the contract: setting up the subscription, maintenance fee collection, reporting, bank integration, invoicing.
• Legal obligation: record-keeping obligations under the Tax Procedure Law, the KVKK, MASAK and related legislation.
• Legitimate interest: improving service quality, preventing fraud, system security, audit trail.
• Explicit consent: optional marketing messages, product update newsletters, cookie-based analytics and identifying the sign-up source; and, with marketing consent, advertising conversion measurement.

Your personal data is shared with a limited number of trusted service providers so that the service can be provided. All transfers are made over encrypted channels and are protected by confidentiality agreements.

• Cloud infrastructure: hosting providers with servers located in Turkey.
• Bank integrations: the banks you connect at your own request, so that account transactions can be brought into the system (currently Türkiye İş Bankası and Garanti BBVA). The integration is read-only.
• Payment institution: iyzico, a PCI-DSS certified payment institution, for credit card collections. Card details are not stored on Yonevo's servers.
• Email / SMS providers: for delivering information and verification messages.
• Google Analytics and Google Ads: when analytics consent is given, Google Analytics is used to measure marketing pages and sign-up conversions. If the Google Ads connection is active and marketing consent has also been given, advertising conversions are sent to Google. Names, email addresses and phone numbers are not added to measurement events. Google processes this measurement data on its own service infrastructure.
• Competent authorities: in the event of a court order, a request from an administrative authority or a legal obligation.

Your data is not sold or rented to third parties. Transfers to the measurement services you consent to are described above.

Data is kept for as long as the purpose of processing requires and in line with the following minimum periods:

• Financial records: 5 years under the Tax Procedure Law and 10 years under the Turkish Commercial Code.
• Account information: for as long as the subscription is active; after cancellation, deleted once a data download period of up to 30 days has ended.
• Log records: 6 months (for security investigations).
• Measurement preferences and visit identifiers: the cookie preference is kept for 180 days, the visit identifier for the sign-up source for up to 90 days and the visit session for 30 minutes. How long Google's own cookies are kept depends on the settings of the service used.
• Sign-up source records: advertising click identifiers are removed after 90 days, and source details linked to a sign-up after a 400-day retention period, through a scheduled clean-up. This does not change the retention period of subscription and financial records.
• Help assistant conversations: kept with your account for 90 days and then removed by a scheduled clean-up. You can also delete the conversation yourself from the assistant panel at any time.

Yonevo applies the following technical and administrative measures to protect your data:

• TLS encryption in transit; HSTS enforced.
• Encryption with AES-256-GCM for sensitive fields such as bank credentials; passwords are hashed with bcrypt.
• Session management based on HttpOnly + Secure cookies, CSRF protection and rate limiting (by IP address and phone number).
• A per-property backup plan that can be set to daily, weekly or monthly.
• Role-based access, per-property data isolation and an audit trail enforced at the data layer.
• Support for two-step verification (TOTP or SMS).

For the full list of the security measures we apply and those we do not yet apply, see our Security page.

Under Article 11 of the KVKK you have the following rights. Your requests are concluded within 30 days at the latest after your application reaches us.

• Learn whether your personal data is processed.
• Request information about it if it has been processed.
• Learn the purpose of processing and whether the data is used in line with that purpose.
• Know the third parties to whom it is transferred in Turkey or abroad.
• Request correction if it has been processed incompletely or inaccurately.
• Request its deletion or destruction.
• Object to a result against you that arises from analysis exclusively by automated systems.
• Claim compensation if you suffer damage due to unlawful processing.

Our platform uses strictly necessary, analytics, preference and marketing cookies. You can change your cookie preferences at any time via the "Cookie settings" link at the bottom of the page. Strictly necessary cookies are required for session security and cannot be switched off.

Analytics consent also covers linking the visit source to your sign-up account; this data is not anonymous. The preference and the visit identifier are shared between the marketing website and the sign-up application. You can sign up without giving analytics consent. Advertising click identifiers are not stored without marketing consent. Queries that Google withholds for privacy in organic search and the content of AI chats are not collected.

You can use the following channels for all questions under this Privacy Policy and for KVKK applications:

• Email: destek@yonevo.com
• Please add "KVKK Başvurusu" (KVKK application) or "Veri Talebi" (data request) to the subject line.

This Policy may be updated because of changes in legislation or in the scope of the service. Significant changes are notified to your registered email address, and the effective date at the top of the page is always kept up to date.