FORA Privacy Policy

#1. Scope

This Privacy Policy explains how the party that provides and operates FORA ("the Owner", "we") processes personal data in connection with:

• The marketing website: https://forapp.online and https://www.forapp.online.
• The FORA application: https://app.forapp.online. This is a subscription "Real Estate Management Platform" for construction and real estate development companies.
• The FORA WhatsApp assistant and notifications.
• **E-mail sent to info@forapp.online.**

The formal notice under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") is a separate document: the Data Protection Notice. Cookies and similar technologies are covered in the Cookie Policy. Read this policy together with both.

#2. Our two roles: controller and processor

The Owner acts in two different legal roles depending on the data. The difference matters because it determines whom you should contact to exercise your rights.

#2.1 Data for which the Owner is the controller

We decide why and how the following data is processed:

• Technical data of website visitors.
• Contact details of people who e-mail us or request a demo or a quote.
• Representatives of our customer companies and billing/contract contacts.
• Application users' account data (name, e-mail, role) and login records.
• Security and audit logs (IP address, browser information, activity records).
• WhatsApp authorisation records kept in the FORA operations panel (phone number, role).

#2.2 Data for which the Owner is a processor

Our customer companies ("Customers") enter the following data into the application for their own business:

• Data about their home buyers (their clients).
• Data about their agents.
• Sales, payment plan, collection and commission records.
• Contracts and documents.

The respective Customer is the controller of that data. The Owner processes it only on the Customer's behalf, on its instructions and to provide the service. This relationship is governed by the Data Processing Agreement between the Customer and the Owner.

If you bought property from a construction company and your data is kept in FORA, please contact that company first. If you contact us instead, we will forward your request to the company without undue delay and help it respond.

#3. What personal data we collect

#3.1 Website visitors

• Technical data: IP address, browser and device information (user-agent), requested page, date and time. Our server and hosting infrastructure create these records as part of serving the connection.
• Preference: your light/dark theme choice, stored only in your browser (localStorage) and never sent to us.
• Analytics and advertising: the website has no analytics, advertising or social media tracking tools.
• Fonts: the website serves its fonts from its own server; there is no third-party connection.
• Forms: the website has no forms. You contact us by e-mail only.

#3.2 People who e-mail us

• Name, e-mail address, job title and company.
• The content of the message and any attachments.
• E-mail headers (time sent, server information).

#3.3 Customer representatives and contacts

• Name, job title, business e-mail and phone number.
• Company name, address, tax details, billing and contract details.
• Correspondence.

#3.4 Application users

• Account data: name, e-mail address, role (YONETICI/Manager, FINANS/Finance or SATIS/Sales), whether the account is active, account creation date.
• Password: your password is never stored in clear text; we keep only a one-way hash (bcrypt).
• Activity records:
  • When you created, changed or deleted a record.
  • Logins and logouts, including failed attempts and their reason (e.g. "wrong password").
  • Exports and document generation.
  • The IP address and browser information used for each action.
• Name display: your name appears in notes, document records and sales representative history as it was at the time of the action.
• Session data: session and security cookies (see the Cookie Policy).

#3.5 WhatsApp assistant and notification users

• The phone number and authorisation role registered in the FORA operations panel at the Customer's request.
• The text of questions sent to the assistant and the assistant's answers.
• The content of notifications sent.

#4. Purposes and legal bases

Where the GDPR applies, the corresponding bases are Art. 6(1)(b), (c) and (f).

Marketing: we do not currently send marketing messages. If we start, we will comply with Turkish Law No. 6563 and its implementing regulation. For merchant and tradesperson recipients, prior consent is not required but they have a right to opt out; for other recipients, consent and the Message Management System (İYS) rules apply. We will also update this policy.

Special categories: FORA is not designed to process special categories of personal data (for example health, religion or biometric data) and does not ask for them. We ask Customers not to put such data in free-text notes or uploaded documents.

#5. How we collect data

• From you: by e-mail, in contracts and in meetings.
• Automatically: while you use the application and website (session, activity logs, server logs).
• Through your company: when your company administrator asks the Owner to create a user account or a WhatsApp authorisation for you.
• Entered by Customer users: data we process as a processor.

See Section 4 for the legal bases.

#6. Data we process as a processor (summary)

Under their own responsibility, Customers may enter the following data categories. This list is derived from the fields in the application's data model.

• Home buyers:
  • Identity and contact: full name, nationality, phone, e-mail, date of birth, mother's and father's names, address.
  • Passport: passport number, issuing country, passport file (PDF or image).
  • Photograph.
  • Note history.
  • Buyer status and ownership share in contracts.
• Sales and finance:
  • Sale price, list price, payment plan (installments), collections, exchange rates.
  • Payment method, expense items, extra works.
  • Contract dates and contract notes.
  • Cancellation details.
• Agents:
  • Name, agency name, phone, e-mail, tax number.
  • Bank accounts (IBAN, SWIFT), legal and branch addresses.
  • Name of the person authorised to collect payments, signature circular file, commission notes and note history.
  • Commission amounts and payments.
• Customer company:
  • Company name, address, contact phones and e-mails, logo.
  • Bank accounts (bank, branch, account name, IBAN, SWIFT).
  • Sales contacts.
• Documents:
  • Contract templates uploaded by the Customer.
  • Word contracts generated from them.
  • Uploaded signed contracts.
  • Floor plans.
  • On-the-fly PDF documents (customer statement, agent statement, lists, reports) and Excel exports.

For requests about this data, see Section 2.2.

#7. Recipients and international transfers

We do not sell personal data or share it for advertising. We use the following service providers (sub-processors) to run the service:

Data may also be shared with:

• Competent public authorities and courts: only where legally required.
• Legal, accounting and audit advisers: bound by confidentiality.
• An acquirer in a merger, transfer or sale of the business: on condition that it provides the same protections.

International transfers: the providers above have servers outside Türkiye, so your data is transferred abroad. The Turkish Personal Data Protection Board has not yet issued any adequacy decision. The process of putting in place the appropriate safeguards under KVKK Art. 9 (the standard contracts published by the Board and notification to the Authority) is under way for these transfers.

#8. WhatsApp assistant and AI

Customers may enable a WhatsApp assistant for phone numbers they report to the Owner. The Owner registers these numbers in its operations panel with the YONETICI or FINANS role only.

How it works:

1. A message from a registered number reaches the Owner through Twilio.
2. The Owner verifies the signature to confirm the message really comes from Twilio.
3. The question is sent to the AI service provider's model. The model calls read-only query tools supplied by the Owner. These tools cannot change any data.
4. The tool results are also passed to the model, which writes an answer.
5. The answer is sent back to WhatsApp through Twilio.

Data sent to the AI provider:

• The Customer's company name and the current date.
• The full text of the user's question. Whatever the user types (for example a person's name) is sent.
• The query tool results. Depending on the question, these may include:
  • Home buyers' names, project name and unit number.
  • Sale price, amount collected, remaining balance, overdue amount.
  • Contract and collection dates, payment method (bank or cash).
  • Installment schedule, available units, project and period totals.
  • For YONETICI and FINANS numbers only: agent names, agency names and commission totals.

Data not sent to the AI provider:

• The sender's phone number.
• Buyers' passport data, date of birth, address, e-mail and phone number.
• IBAN and bank details, notes, uploaded files.

Data sent to Twilio (and to Meta for the WhatsApp channel):

• Sender and recipient phone numbers.
• Question and answer text.
• Notification content: buyer name, project and unit, and amount for new sales, collections, cancellations and commission payments; the agent's name for commission notifications.

Provider data use: under the AI service provider's commercial terms, content sent through its API is not used to train models.

Accuracy of answers: answers are generated automatically and may be inaccurate. They are for information only; verify any decision against the records in the application.

No automated decisions: the assistant makes no automated decisions that produce legal effects about individuals.

#9. Retention

We keep personal data for as long as the purpose requires and for any mandatory legal retention period. After that, we delete, destroy or anonymise it.

#10. Security

Main technical and organisational measures in place today:

• Connection security: all connections are encrypted with HTTPS. HSTS is enforced.
• Security headers: a content security policy, a framing ban and MIME-sniffing protection.
• Authentication:
  • Passwords are stored as one-way hashes (bcrypt).
  • Failed logins are rate-limited to 5 attempts per e-mail per 15 minutes.
  • Sessions expire after 8 hours.
  • A deactivated user loses access immediately.
• Customer (tenant) separation: every query is scoped to the user's company. A user of one company cannot see another company's data.
• Role-based access: there are YONETICI, FINANS and SATIS roles. Permissions are re-checked server-side on every action.
• Files:
  • Files are kept in non-public storage.
  • They open only for authorised users through signed links valid for at most 1 hour.
  • Uploads are validated by file content, and size limits apply.
• Audit log: creating, changing and deleting records, logins and logouts, exports and document generation are recorded.
• WhatsApp: incoming messages are verified by Twilio signature. Only registered numbers can use the assistant.
• Search engines: the application is closed to search engines.

No system is perfectly secure. We currently hold no independent security certification (such as ISO 27001 or SOC 2).

If a personal data breach occurs, we notify the Authority and affected individuals within the legally required periods. For data processed on behalf of a Customer, we notify that Customer.

#11. Your rights

Under KVKK Art. 11 you have the right to:

• Learn whether your personal data is processed.
• Request information about the processing if it is.
• Learn the purpose of the processing and whether the data is used accordingly.
• Know the third parties, in Türkiye or abroad, to whom your data is transferred.
• Request correction of incomplete or inaccurate data.
• Request deletion or destruction under KVKK Art. 7.
• Request that corrections, deletions and destructions be notified to third parties who received the data.
• Object to an adverse outcome resulting exclusively from automated analysis.
• Claim compensation for damage caused by unlawful processing.

How to submit a request:

• E-mail: info@forapp.online

Include enough information for us to verify your identity and state your request clearly. We resolve requests within 30 days, generally free of charge. If you are not satisfied with our response, you may complain to the Personal Data Protection Board.

Individuals in the European Union: where the GDPR applies to a processing activity, you may also have these rights:

• Data portability.
• Restriction of processing.
• Objection to processing based on legitimate interests.
• Complaint to the supervisory authority of your country.

#12. Children

FORA is a business service. We do not knowingly collect data from anyone under 18. A Customer may enter data about minors, for example as co-owners. In that case the Customer is responsible for the lawfulness of that processing.

#13. Changes

We may update this policy. The current version is always published on this page. We announce material changes to Customers by e-mail or in the application.

#14. Contact

• Controller: the Owner (the party that provides and operates FORA)
• E-mail: info@forapp.online