ENTR
Get matched

Legal

KVKK notice

Last updated: November 9, 2026

This notice is given under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) by SOFTWEEN YAZILIM LİMİTED ŞİRKETİ as data controller. The Turkish text is the binding version; this English translation is provided for convenience.

Legal name
SOFTWEEN YAZILIM LİMİTED ŞİRKETİ
MERSIS number
0772146927900001
Tax ID
7721469279
Address
Ankara Cad. Yenişehir, 360 Office No:405 Kat:2 Ofis:17, 34912 Pendik / İstanbul, Türkiye
  • Identity and contact data: your email address.
  • Customer transaction data: startup profile answers, matches shown to you, saved items, tracker notes and reminders.
  • Documents and content you generate: the files you keep in My documents (deck, one-pager, financial statements, company registry papers, Findeks credit report, CV and other files) and the facts, drafts and application answers built from them.
  • Hosted apply data: when you apply through getfund's browser, the screenshots, confirmation page and step list of each run and the recording of its browser session (section 12).
  • Transaction security data: hashed one-time codes, session tokens and browser extension tokens, IP address, browser details and request logs.
  • Financial data: plan, subscription status and Paddle customer and subscription identifiers (no card details).
  • Marketing and usage data: pseudonymous product analytics events, when your browser does not send Do Not Track or Global Privacy Control; if you accept in the cookie banner, device and usage data and a sampled screen recording (form fields masked); your signup source, meaning where you first came from (campaign tags, ref, the referring site's domain and the first page you opened); and, when you came from a Google ad, the ad click identifier (gclid, gbraid or wbraid).
  • Optional founder track answers, which you give only if you want to see programs meant for those founders.
  • Setting up and running your membership and sign-in
  • Matching and ranking funding opportunities, writing explanations and sending reminders
  • Filling the forms of the programs you choose in a remote browser on your behalf and submitting them after your approval
  • Carrying out subscription, payment and refund processes
  • Ensuring information security and preventing abuse
  • Improving the service through product analytics
  • Measuring which channels and ads bring sign-ups and paid plans, including sending the ad click identifier to Google Ads for that measurement
  • Meeting legal obligations and answering requests from authorities

We collect your data electronically, through the forms, cookies and requests you make on the site and from Paddle when you pay. We process it on the grounds in KVKK Article 5(2): it is necessary to set up and perform the contract with you (c), to meet our legal obligations (ç), to establish or protect a right (e), and for our legitimate interests provided your fundamental rights are not harmed (f). Analytics cookies and the sampled session recording rest on your explicit consent under KVKK Article 5(1), which you give in the cookie banner and can withdraw at any time from "Cookie preferences" in the site footer. Where any other process needs your explicit consent, we ask for it separately.

Under KVKK Articles 8 and 9, we share your data with our service providers only as far as their service needs: Cloudflare (hosting, database, email delivery, bot protection, a fallback AI model for document reading and application drafts, and the remote browser that fills application forms, with its session recording), Google Cloud Vertex AI (profile tags, match explanations, document facts and application drafts) and Google Ads (measuring which ads lead to sign-ups and paid plans, using the gclid, gbraid or wbraid ad click identifier, the time of the sign-up or payment, the price of the paid plan and our internal reference code for that sign-up or payment), Anthropic (Claude AI models for document facts, application drafts and reading an application page when a form cannot be filled directly), Linkup (competitor scan and Radar search), DigitalOcean (our self-hosted SearXNG fallback search server, which passes search queries on to public web search engines), Serper (search API for Radar web search), PACKEND, LLC / Scrape.do (web data proxy fetching the public program pages Radar reads), Apify (fallback page reading for Radar, form discovery and your kit's website import), Paddle (payments as merchant of record) and PostHog (product analytics, cookieless until you accept in the cookie banner; with your consent, PostHog's cookies and a sampled session recording with form fields masked), and with authorised public institutions when the law requires. Some of these providers are abroad, Google Ads among them; for these transfers we rely on the safeguards in KVKK Article 9, such as standard contracts.

We keep your data while your account exists and delete or anonymise it within 30 days after you ask us to delete your account, and our copy of your billing records goes with it; Paddle, our merchant of record, keeps invoices and tax records under its own legal obligations. One-time codes are deleted within two days and sessions expire after 30 days without use. Documents you upload and what we build from them are kept while the document, the startup or your account exists, whichever ends first, and extension tokens are kept as a hash until you revoke them or delete your account. Screenshots of applications made through getfund's browser are deleted 90 days after they are taken, and Cloudflare deletes the recordings of those browser sessions after 30 days.

  • To learn whether your personal data is processed and to ask for information about it
  • To learn the purpose of processing and whether it is used for that purpose
  • To know the third parties in Türkiye or abroad to whom your data is transferred
  • To ask for incomplete or incorrect data to be corrected
  • To ask for your data to be deleted or destroyed under the conditions in Article 7
  • To ask for corrections, deletions or destruction to be notified to the third parties who received the data
  • To object to a result against you that arises only from automated analysis of your data
  • To claim compensation if you suffer damage from unlawful processing

You can send your request in writing to the address above, by registered electronic mail (KEP), with a secure electronic or mobile signature, or by email to support@getfund.space from the email address registered with us, as set out in the Communiqué on the Procedures and Principles of Application to the Data Controller. We answer free of charge within 30 days at the latest.

This section applies only if you connect a Gmail account to getfund. It adds to sections 1 to 7 and does not replace them.

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements. The policy is at https://developers.google.com/workspace/gmail/api/policy

  • Personal data processed: from mails in the connected account that match a search for application result words (last 180 days on first connect, then new mails once a day), the sender, subject, date and Gmail snippet. Mail bodies and attachments are never fetched. We store only the Gmail message id, the date, the sender's domain, a guess of the program name, the result class and confidence, the matched application and your encrypted refresh token. We do not store the subject, snippet, body or attachments.
  • Purpose of processing: to detect accepted, rejected, interview and received results of your program applications and to update, or suggest updates to, your getfund application tracker and stats.
  • Legal ground and method: your explicit consent under KVKK Article 5(1), which you give by choosing to connect Gmail and approving access on Google's screen. The data is collected electronically through the Gmail API. You can withdraw your consent at any time by disconnecting Gmail in getfund, which revokes our access and deletes all stored mail data immediately. You can also revoke access at https://myaccount.google.com/permissions
  • Transfer abroad: the sender, subject and snippet of a matching mail are sent to Google Cloud Vertex AI (Gemini), under getfund's own Google Cloud account, only to classify the mail. Google's infrastructure is outside Türkiye. As in section 4, we rely on the safeguards in KVKK Article 9, such as standard contracts. The data is not used to train models or for advertising and is never sold or shared.
  • Retention: until you disconnect Gmail or delete your account. Your rights in section 6 apply to this data as well.

This section applies only if you choose Sign in with Google, an alternative to the email code. It adds to sections 1 to 7 and does not replace them.

Google processes your sign-in under its own privacy policy, which is separate from this notice. The policy is at https://policies.google.com/privacy

  • Personal data processed: your name, your email address and your Google account identifier. We ask only for the basic profile and email scopes, so getfund gets no access to your Gmail, Drive, contacts or any other Google data through sign-in.
  • Purpose of processing: only to create and authenticate your getfund account. If a getfund account with the same verified email address already exists, signing in with Google opens that same account.
  • Legal ground and method: KVKK Article 5(2)(c), because the data is necessary to set up and perform the contract with you, the same ground we use for your other account and sign-in data in section 3. The data is collected electronically from Google when you choose to sign in with it.
  • Gmail stays separate: the Gmail application results feature (gmail.readonly) is a different, optional connection based on your explicit consent, and it is described in section 8. Signing in with Google does not connect Gmail.
  • Retention: as for your other account data, until you delete your account. Your rights in section 6 apply to this data as well.

This section applies only if you choose Sign in with LinkedIn, an alternative to the email code. It adds to sections 1 to 7 and does not replace them.

LinkedIn processes your sign-in under its own privacy policy, which is separate from this notice. The policy is at https://www.linkedin.com/legal/privacy-policy

  • Personal data processed: your name, your email address (and whether LinkedIn has verified it) and your LinkedIn member identifier. We ask only for the openid, profile and email scopes, so getfund gets no access to your LinkedIn connections, messages, posts or anything else on LinkedIn through sign-in, and never posts on your behalf.
  • Purpose of processing: only to create and authenticate your getfund account. If a getfund account with the same verified email address already exists, signing in with LinkedIn opens that same account.
  • Legal ground and method: KVKK Article 5(2)(c), because the data is necessary to set up and perform the contract with you, the same ground we use for your other account and sign-in data in section 3. The data is collected electronically from LinkedIn when you choose to sign in with it.
  • Retention: as for your other account data, until you delete your account. Your rights in section 6 apply to this data as well.

This section applies only if you choose to set a password. Setting one is optional; signing in with an email code or with Google keeps working without one. It adds to sections 1 to 7 and does not replace them.

  • Personal data processed: your password, only as a one-way hash. getfund never stores the password itself. The hash is made with a random salt and a server-side secret, so it cannot be turned back into your password.
  • Breach check: the first 5 characters of the SHA-1 hash of a new password are sent to the Have I Been Pwned service (k-anonymity). The password and the full hash never leave getfund.
  • Purpose of processing: only account authentication and security.
  • Legal ground and method: KVKK Article 5(2)(c), because the data is necessary to set up and perform the contract with you, the same ground we use for your other account and sign-in data in section 3. The hash is created by getfund when you set the password.
  • Retention: the hash is deleted when you remove your password or delete your account. Your rights in section 6 apply to this data as well.

This section applies only if you use hosted apply, where getfund fills and, after your approval, submits an application form in a remote browser it runs for you. It adds to sections 1 to 7 and does not replace them.

  • Personal data processed: the answers and documents you confirmed for the application, the program's application address, a screenshot of each step of the run, a screenshot and the text of the site's confirmation page, the list of steps, and the recording of the browser session, in which values in form fields are masked. Your passwords for other sites are not processed: you sign in yourself in the live view, and getfund never stores or types them. Payment pages are not captured and card details are never entered.
  • Purpose of processing: to fill the application form you asked us to submit in a remote browser on your behalf, to submit it after your approval, to keep the record of your application and to give support when something goes wrong.
  • Legal ground and method: KVKK Article 5(2)(c), because the data is necessary to perform the contract with you for the service you asked for. The data is collected electronically through the remote browser when you start a run.
  • Transfer and transfer abroad: the remote browser is Cloudflare Browser Run (Cloudflare, Inc.). It cannot be pinned to a region, so the data can be processed on Cloudflare's global network outside Türkiye. When a form cannot be filled directly, the structure and text of the page are sent to Anthropic's Claude model (Anthropic, PBC, United States) to choose the next step. As in section 4, we rely on the safeguards in KVKK Article 9, such as standard contracts. The CAPTCHA-solving service 2Captcha (ALTWEB LLC FZ, United Arab Emirates), which may solve a CAPTCHA in front of a form, receives only the address of the page the CAPTCHA is on (without its query parameters) and the CAPTCHA's own settings from that page; no personal data about you is sent to it. The program you apply to receives the application you submit under its own responsibility.
  • Retention: screenshots are deleted 90 days after they are taken, or with your account if you delete it first; Cloudflare deletes the session recording after 30 days; the step list and the confirmation text are kept while the application, the startup or your account exists, whichever ends first. Your rights in section 6 apply to this data as well.