Privacy Policy
Last updated: August 30, 2026
Do Not Sell or Share My Personal Information1. Information We Collect
When you use Harmiqa we may collect the following information:
- Name and email address; a password hash for email/password registration, or Google account ID and limited profile information when Google sign-in is selected
- Farm name and type (during onboarding)
- Financial transaction data (income and expense records)
- Field, asset and plan information
- Payment information for Premium subscriptions; card details are processed by Paddle in its secure checkout
2. How We Use Information
We use the information we collect only for the following purposes:
- To create and manage your account
- To provide accounting and reporting services
- To process Premium subscription transactions
- To provide technical support
- To collect anonymous usage statistics for product improvement
3. Data Security
Supabase encrypts your data in transit and at rest. Passwords are never stored in plain text. We do not process payment details directly; they are handled securely by Paddle and its payment providers.
4. Third Parties
We do not sell your data to third parties. We use the following trusted third parties in our infrastructure:
- Supabase — Database and authentication
- Google LLC — Only when the user chooses to continue with Google: verifying the account identity and providing limited profile data such as name and email
- Paddle — Merchant of Record for checkout, payments, subscriptions, invoicing and applicable taxes
- Resend — Transactional email delivery (password resets, account notifications)
- Google Firebase (FCM) — Push notification delivery
- Esri / ArcGIS — Map basemap imagery (field maps)
5. Your Rights
Under Turkey's KVKK law you have the right to access, correct or delete your data. Contact us to exercise these rights.
6. Contact
For questions about our privacy policy, write to destek@harmiqa.com .
7. Your Rights Under GDPR & KVKK
All users: including non-Turkish nationals: benefit from rights under both Turkey's KVKK (Law No. 6698) and the EU GDPR. As data controller and in accordance with GDPR Articles 13 and 14, we inform you of the following data subject rights:
- Right of access to your personal data (GDPR Art. 15 / KVKK Art. 11/1-b)
- Right to rectification of inaccurate data (GDPR Art. 16 / KVKK Art. 11/1-c)
- Right to erasure ('right to be forgotten') (GDPR Art. 17)
- Right to data portability in a machine-readable format (GDPR Art. 20)
- Right to object to processing (GDPR Art. 21 / KVKK Art. 11/1-e)
To exercise any of these rights, contact us at destek@harmiqa.com. Requests will be responded to within 30 days.
8. Data Retention Period
We retain your data only as long as we provide the service or as required by our legal obligations.
- Account data: while your account is active; when you close your account, storage, database and authentication records are permanently deleted in the same request (except records subject to a legal retention obligation)
- Financial transaction records: 10 years under Turkish Commercial Code No. 6102 (tax audit obligation)
- Support tickets and communication records: 2 years
- Anonymous usage statistics: 13 months (no personal data)
- Payment records: retained by Paddle as required by applicable legal, financial and regulatory obligations; details are provided in Paddle's buyer privacy notice
9. Legal Basis for Processing
We process your personal data under one of the following legal bases:
- Performance of a contract (GDPR Art. 6(1)(b) / KVKK Art. 5(2)(c)): account, transaction and premium subscription data needed to deliver the service
- Legal obligation (GDPR Art. 6(1)(c) / KVKK Art. 5(2)(a)), retention of tax and accounting records
- Legitimate interest (GDPR Art. 6(1)(f) / KVKK Art. 5(2)(f)): service security, fraud prevention, anonymous product improvement
- Explicit consent (GDPR Art. 6(1)(a) / KVKK Art. 5(1)): optional analytics cookies, marketing communications (if any)
10. International Data Transfers
Our infrastructure may process some data outside Turkey:
- Supabase (database): server in the European Union or United States region. EU transfers comply with GDPR Chapter V; US transfers are safeguarded by EU Commission Standard Contractual Clauses (SCC).
- Vercel (application hosting): global CDN; dynamic content served primarily from EU or US region.
- Paddle: buyer data may be processed by the applicable Paddle entity and its payment providers; Paddle states that international transfers use safeguards consistent with GDPR.
- Copies of SCCs for non-EU transfers are available on request at destek@harmiqa.com.
11. Children's Data
Our service is not intended for users under 18 years of age. If we become aware that a user under 18 has provided personal data, we will delete it without delay. Parents or guardians may contact us at destek@harmiqa.com regarding any such concern.
12. Right to Lodge a Complaint
You have the right to lodge a complaint with the following supervisory authorities regarding our data processing:
- Turkey: Personal Data Protection Authority (KVKK), kvkk.gov.tr
- European Union: the data protection authority of your member state of residence (list of competent DPAs: edpb.europa.eu/about-edpb/about-edpb/members_en)
- California: California Attorney General, oag.ca.gov/privacy
- Before lodging a complaint, we kindly ask you to contact us at destek@harmiqa.com so we can resolve the issue.
13. Data Controller
Acting as data controller:
- Harmiqa (the registered trade name will be published here)
- Contact email: destek@harmiqa.com
- Designation of a Data Protection Officer (DPO) is not mandatory (GDPR Art. 37). All data subject requests are handled via the email above.
- EU Representative (GDPR Art. 27): No representative is currently designated as we do not actively market within the EU. This section will be updated once regular EU-targeted marketing begins.
14. California Privacy Rights (CCPA / CPRA)
Do Not Sell or Share My Personal InformationIf you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you the additional rights summarised below. This section applies only to California residents; the GDPR/KVKK sections above apply to other users.
Categories of personal information collected (last 12 months)
- Identifiers: name, surname, email address, account ID, IP address.
- Commercial information: subscription plan, payment history and invoice records; card numbers are processed by Paddle and are never transmitted to us.
- Internet/network activity: sign-in logs, cookie and device identifiers, error reports.
- Approximate location, only when you manually enter field coordinates or tap the "My Location" button on the map; we do not automatically collect device location.
Sale or sharing of personal information
We do not sell your personal information and we do not share it with third parties for cross-context behavioural advertising. We do not engage in any transfer that meets the CCPA definition of «sale» or the CPRA definition of «share». We do not exchange data with advertising networks, data brokers, or similar vendors.
Your rights as a California resident
- Right to know: request the categories of personal information we collect about you, the sources, the purposes of processing, and the parties to whom it is disclosed.
- Right to delete: request deletion of your personal information, subject to legally required retention.
- Right to correct, request correction of inaccurate or outdated personal information.
- Right to opt out of sale/sharing: object to the sale of your data or its sharing for behavioural advertising (because we do not sell your data, this right is proactively respected).
- Right to non-discrimination: you will not receive different prices, service levels, or quality for exercising your CCPA/CPRA rights.
How to exercise your rights
Send an email to destek@harmiqa.com with the subject line «California Privacy Request». To verify your identity it is sufficient to write from the email registered to your account; we do not require additional documentation unless strictly necessary. We resolve requests within 45 days (CCPA §1798.130) and may take a single additional 45-day extension when needed, in which case we will notify you of the reason.
Authorized agent requests
Under CCPA §1798.135 you may submit a request through an authorised agent. In that case a signed permission demonstrating the agent's authority to act on your behalf, together with written confirmation from you, must be provided. We do not begin processing the request until identity has been verified.
California «Shine the Light» (Civil Code §1798.83)
Because we do not share your personal information with third parties for their direct marketing purposes, no disclosures subject to Shine the Light requests are made. You may still submit an information request through the contact above and we will respond within 30 days.
15. Third-Party Sign-In
You may optionally register or sign in with your Google account. Google may send limited account data such as Google account ID, name, email and profile image to verify your identity through Supabase Auth; Harmiqa never sees or stores your Google password.
Google is used only for authentication. Harmiqa does not request access to your contacts, files or other Google account content; it requests only the minimum scope needed for sign-in and account recovery. If the same verified email already belongs to a Harmiqa account, the Google identity may be securely linked to that account.
This method is optional and email/password remains available. Google's privacy policy governs its processing and international transfers. You can delete your Harmiqa account and associated data from Settings, or contact destek@harmiqa.com with a request.