Privacy Policy
Last updated: 2026-09-15
This Privacy Policy explains which personal data FinalWork ("FinalWork", "we") collects through the FinalWork mobile app, the browser version (finalwork.net/finalwork) and the marketing site (finalwork.net), how we use and share it, and what your rights are. It follows the Turkish Personal Data Protection Law (KVKK, Law No. 6698) and the EU General Data Protection Regulation (GDPR).
FinalWork is a workforce management app that lets employers (account owners) track their employees' shifts and tasks. Because of this structure there are two roles, and this policy covers both.
1. Controller and processor
For the data you provide as an account owner (name, username, email, workspace details, subscription status) the data controller is FinalWork.
For employee data (name, username, shift records, tasks, leave, team messages, location) the data controller is the EMPLOYER who created the workspace. FinalWork processes this data on the employer's instructions, solely to provide the service, as a DATA PROCESSOR. The employer is responsible for informing employees; see the "Note for employers" section below.
2. What we collect
| Data | From whom | Purpose |
|---|---|---|
| Name, username, password (stored as an irreversible hash) | Owner and employee | Creating the account and signing in |
| Email address | Owner (required), employee (optional) | Password reset code, support replies, account notices |
| Workspace name, industry, time zone, working hours, reminder settings | Owner | Running the service |
| Shift start/end and break times | Employee | Time tracking and reports; shown to the employer |
| Shift start and end location (latitude/longitude) | Employee — only if the employer enabled location and the employee granted device permission | Lets the employer see where a shift was started; stored with the shift record and shown in reports |
| Tasks, completion status and task notes | Employee and employer | Task tracking and reports |
| Leave requests and records (type, dates and times, note, approval or rejection reason) | Employee and employer | Leave management and reports; shown to the employer. The "Sick leave" type may count as health data: you do not need to write details such as a diagnosis in the note |
| Team messages and read status | Employer (sender) and employee (reader) | Letting the employer post announcements to the team and see who read them |
| Device push token, notification and location permission status | Employee and owner | Sending phone notifications |
| App version, operating system, device model, language, IP address, last sign-in | All users | Debugging, security (sign-in attempt limits), version compatibility, usage statistics |
| Support conversations | Users who open a support request | Providing support |
| Error logs (error text, screen, device details) | All users | Finding and fixing crashes; deleted after 90 days |
| Telegram chat IDs | Owner (optional) | Forwarding shift and task notifications to Telegram |
| Subscription status and expiry | Owner | Unlocking Premium. Payment details (cards etc.) are processed by Apple and Google; FinalWork never sees them |
| Advertising identifier (free plan only, and only with your permission) | Free plan users | Showing ads via Google AdMob |
3. Why we use it
- To create your account, verify you and provide the service
- To keep shift, break, task and leave records and produce reports
- To let the employer message the team and see who read the message
- To send shift start/end notifications to the employer (optionally with location)
- To send required emails such as password reset codes, support replies and account changes
- To detect errors, keep the service secure (sign-in limits, token revocation) and improve it
- To manage Premium subscriptions
- To show ads on the free plan
- To meet legal obligations
4. Legal basis
- Performance of a contract (KVKK art. 5/2-c; GDPR art. 6(1)(b)): account, shift and task records, notifications
- Legal obligation (KVKK art. 5/2-ç; GDPR art. 6(1)(c)): retention and store rules
- Legitimate interest (KVKK art. 5/2-f; GDPR art. 6(1)(f)): security, error logs, service improvement, usage statistics (Google Analytics)
- Consent (KVKK art. 5/1; GDPR art. 6(1)(a)): location sharing (device permission), personalised ads (tracking permission), optional email
5. Who we share it with
We do not sell your data. We share it only with the providers needed to run the service, and only as much as needed:
| Provider | Purpose | Location |
|---|---|---|
| Heroku (Salesforce) | Server and database hosting | EU / USA |
| Google Firebase Cloud Messaging | Phone notifications | USA |
| Resend | Email delivery (reset codes, support replies) | USA |
| RevenueCat, Apple App Store, Google Play | Subscriptions and payments | USA |
| Google AdMob / AdSense | Ads on the free plan | USA |
| Telegram | Shift notifications, only if the employer enabled Telegram | Global |
| ip-api.com | Country lookup for language detection in the browser version (only when the browser language cannot be read; can be disabled) | Global |
| Google Fonts | Fonts on the marketing site | USA |
| Google Analytics | Visit and usage statistics on the marketing site and browser version (cookies) | USA |
| Google Firebase Analytics | Screen and usage statistics in the mobile app (no advertising ID) | USA |
Some of these providers are located abroad, so your data is transferred internationally (KVKK art. 9). Transfers rely on the providers' standard data protection commitments and, where needed, your consent. We may disclose data to authorities when legally required, and to a successor in case of a business transfer; you would be informed.
6. How long we keep it
- Account and workspace data: until the account is deleted
- Shift, break and task records: as long as the workspace exists (the employer's payroll and legal record needs)
- An employee's account is removed by the employer; the person can no longer sign in, and shift, task and leave records and team messages remain with the employer because of their legal record-keeping duty
- When an owner deletes their account, every workspace they own and everything inside it is deleted
- Support conversations: until the account is deleted
- Error logs: at most 90 days
- Password reset codes: 10 minutes; deleted immediately once used
- Database backups: at most 30 days
7. Security
- Passwords are stored irreversibly (scrypt) and never appear on any screen or in any response
- All traffic uses encrypted connections (HTTPS)
- Each workspace's data is isolated; no workspace can reach another's data
- Sign-in attempts are rate-limited; changing your password signs out other devices
- Secrets live in server environment variables, never in code
8. Your rights
Under KVKK art. 11 and GDPR arts. 15–22 you may:
- Learn whether your data is processed and request information
- Learn the purpose and whether it is used accordingly
- Know the third parties it is transferred to, domestically or abroad
- Request correction of incomplete or inaccurate data
- Request erasure (account deletion is available in the app)
- Object to processing and request your data in a portable format
- Object to decisions based solely on automated processing (FinalWork makes no such decisions)
- Claim compensation for damages
Send requests in writing to the contact address below; we respond within 30 days at the latest. If you are an employee, requests about your shift records must first go to your employer (the controller); FinalWork cannot alter those records without the employer's instruction.
9. Account deletion
Owner: in the app, Settings → Account → Delete my account. After confirming with your password, your account and every workspace you own — employees, shift and task records, support conversations — are permanently deleted. If you have a Premium subscription, deleting the account does not cancel it; cancel it from your App Store or Google Play account.
Employee or manager: your account was created and is removed by your employer. In the app, Profile → "Request account deletion" sends your request to the employer. Once removed you can no longer sign in; your shift, task and leave records remain with the employer because of their legal record-keeping duty. Contact your employer (the data controller) about these records.
If you cannot access the app, you can also request deletion by emailing ahyesilmen@gmail.com; after identity verification the request is completed within 30 days.
10. Children
FinalWork is not directed at children under 16 and does not knowingly collect their data. If you believe a child's data was collected, contact us and we will delete it.
11. Cookies and local storage
The mobile app uses no cookies; it uses Google Firebase Analytics for usage statistics (such as which screens are opened; no advertising ID is collected). The browser version keeps your sign-in in the browser's local storage (localStorage); this is not a cookie and is used only to keep you signed in.
The marketing site and the browser version use Google Analytics cookies (_ga) to measure visits and page usage; your IP address and browser information are sent to Google in the process. These cookies are not used for advertising, and personal details such as your name or email are not sent to Google. You can delete or block cookies in your browser settings, or opt out with Google's browser add-on (tools.google.com/dlpage/gaoptout). Fonts are loaded from Google Fonts, which receives your IP address in the process.
12. Advertising
On the free plan, Google AdMob (app) and AdSense (browser) ads may be shown. On iPhone you are asked for tracking permission before the advertising identifier is used; if you decline, ads are still shown but not personalised. Users in the European Economic Area and the UK see Google's consent form; you can change your choice in the app (Settings → Ad privacy options). Premium shows no ads.
13. Note for employers
The employer who creates a workspace is the controller of their employees' personal data. You must inform your employees that their shift, task and (if enabled) location data is processed through FinalWork, and obtain consent where required. You may share the link to this policy with your team.
14. Changes
We may update this policy. For significant changes we notify you in the app or by email; the current text is always on this page.
15. Contact
- Company: FinalWork
- Email: ahyesilmen@gmail.com