Hiroo Studio
Galata Finance

Galata Finance privacy policy

This policy explains how personal and financial data is collected, used, shared, retained, and deleted when you use Galata Finance.

Effective: August 14, 2026 · Last updated: September 27, 2026

In short: We do not sell your data or use it for advertising. Sharing financial summaries with Google Gemini is off by default and starts only with your explicit permission. You can withdraw permission in Settings and delete your account and Galata-stored data from within the app.

1. Controller and contact

“Galata,” “Galata Finance,” “we,” and “the service” refer to the developer and operator of the Galata Finance application. For privacy questions and data-subject requests, contact the controller at hello@galatafinance.com.

2. Data we collect

  • Account and profile: email, name, language and currency preferences, account and consent timestamps, and the timestamp of your 18+ eligibility confirmation.

  • Setup preferences: your goals, the markets you invest in, how you track today, your investing experience, your occupation (optional), and how you heard about Galata — each question can be skipped.

  • Setup step records: which setup steps you viewed, answered or skipped, time spent on each, and a random installation ID created on your device. No advertising identifier is used and there is no cross-app tracking.

  • Financial content you provide: portfolios, assets, transactions, costs, cash flow, subscriptions, goals, household data, notes, and uploaded documents.

  • Derived results: portfolio values, performance, allocation, budgets, goal progress, AI commentary, and reports calculated from your data.

  • Technical and security data: session, device/browser type, IP and request records, errors, and security logs collected by our infrastructure and authentication providers.

  • Communications: invitation, sign-in and service email records, and support requests.

Galata does not automatically connect to your bank or brokerage account. We cannot access financial data unless you provide or explicitly import it.

3. Why we process data

We process data to provide and secure your account; operate portfolio, cash-flow, subscription, goal, and household features; calculate and display financial results; send essential service messages; respond to support; meet legal obligations; and, only with separate explicit permission, create personalized AI commentary and reports.

4. Google Gemini and AI

Galata uses the Google Gemini API to produce narrative text for personalized transaction commentary and financial reports. This feature is off by default.

With permission, we may send transaction amounts, prices, fees and dates; asset symbols, markets and currencies; portfolio performance, allocation, goal and data-quality summaries; cash-flow, subscription and goal summaries; and household summaries only when household sharing is separately enabled.

We do not add your name, email, Galata user ID, password, or session token to AI prompts, and Gemini does not receive raw database access. Only limited summaries prepared for the relevant report are sent.

You can withdraw AI permission in iOS or web Settings at any time. This stops new transfers to Gemini but does not automatically delete AI reports already stored by Galata. Delete them with your account or request deletion by email.

Google’s processing depends on our service plan and its then-current terms. See the Gemini API Additional Terms. AI output is not investment advice.

5. Service providers and transfers

We use Supabase for authentication, database and file storage; Railway and Vercel for API and web hosting; Google Gemini for AI generation only after consent; email providers for account and service messages; and market-data providers for symbol-level pricing without sharing your identity or portfolio. Provider systems may be located outside Türkiye. We limit transfers to what is needed to provide the service and require appropriate privacy and security protections under applicable contracts and law. We do not sell or rent data, use it for third-party advertising, or share it for cross-app tracking.

6. Retention and deletion

Account and financial data is retained while your account is active or as needed to provide the service. AI reports and their supporting summaries remain linked to your account for report history. Security and technical logs are retained only as needed for security, troubleshooting, and legal obligations. Setup step records are deleted automatically after 180 days. Setup preferences are kept while your account exists and are deleted with it. Your occupation is never sent to AI providers. Unless legal retention or an active dispute requires otherwise, “Permanently delete my account” removes your profile, portfolios, transactions, cash flow, documents, reports, and notifications. Data belonging to other members of a shared household is not deleted.

Use account deletion in Settings or email hello@galatafinance.com.

7. Security

We use reasonable safeguards including encryption in transit, access controls, user-scoped authorization, and application-level encryption for sensitive financial fields. No internet system is completely secure; contact us if you identify a security concern.

8. Your rights

Depending on applicable law, including Türkiye’s Law No. 6698, you may have rights to learn whether data is processed, request information and copies, correct data, request deletion or destruction, learn recipients, object to certain automated outcomes, and seek compensation for unlawful processing. Include your account email and request; we may ask for information to verify identity and account ownership.

9. Children

Galata Finance is intended for users aged 18 and over. We do not knowingly collect data from people under 18 for AI features. Contact us if you believe a child’s data has been processed.

10. Changes

We may update this policy when the product, providers, or law changes. Material changes—especially to the AI provider, purpose, or categories of data sent—will trigger new in-app disclosure and, where required, renewed explicit permission. The current version and effective date are posted here.