Privacy Policy

This policy explains what data Drawlytic (drawlytic.com, operated by Cengiz Bayazit, sole proprietorship, Türkiye — the "data controller") collects, why, and what your rights are. It is written to comply with the Turkish Personal Data Protection Law (KVKK No. 6698) and, for users in the EU/EEA, the GDPR.

1. Data we collect

• Account data: your email address and a salted hash of your password (we never store the password itself).
• Your files: the CAD models you upload and the drawing outputs generated from them, stored so your projects remain available to you.
• Usage data: product events (e.g. sign-up, drawing generated, checkout started), timestamps, plan and credit balance — used for operating quotas and improving the product.
• Technical logs: IP address and request metadata processed by our hosting provider for security and abuse prevention (short-lived operational logs).
• Payment data: handled by our merchant of record, Polar. We never see or store card numbers; we receive only order/subscription status, and Polar's customer reference.

2. What we do NOT do

• No advertising trackers, no third-party analytics scripts, no sale of personal data — ever.
• Your CAD files are not used to train models and are never shared with other users or third parties, except the processors below as needed to run the Service.
• The only cookie we set is the essential session cookie (bs_session) that keeps you logged in.

3. Legal bases and purposes

We process your data to perform our contract with you (running your account, storing projects, enforcing plan limits), for our legitimate interests (security, abuse prevention, product analytics on our own infrastructure), and to comply with legal obligations (tax and accounting records for purchases).

4. Processors and transfers

• Cloudflare, Inc. — hosting, storage (databases and file storage) and network security. Data may be processed on Cloudflare's global infrastructure.
• Polar Software Inc. — merchant of record for payments (receives your email and payment details you enter at checkout).
• Resend (Plus Five Five, Inc.) — transactional email delivery (e.g. password-reset messages; receives your email address).

Where these providers process data outside Türkiye or the EU/EEA, transfers rely on the providers' standard contractual clauses and equivalent safeguards.

5. Retention

• Account data: kept while your account exists; deleted on account-deletion request.
• Uploaded models and outputs: kept per your plan's history window and until you delete the project or your account.
• Purchase records: kept as long as tax law requires.
• Password-reset tokens: 1 hour. Operational logs: short rotation windows.

6. Your rights

Under KVKK Art. 11 and GDPR Arts. 15–21 you may request access, correction, deletion, restriction, portability, or object to processing. You can delete individual projects yourself at any time; for full account deletion or any other request, email privacy@drawlytic.com from your account address — we respond within 30 days. EU/EEA users may also lodge a complaint with their supervisory authority; Türkiye residents with the KVKK Board.

7. Security

All traffic is encrypted (TLS). Passwords are hashed with PBKDF2; session tokens are stored hashed. Files live in access-controlled object storage tied to your account. No method is 100% secure, but we notify affected users of any breach as required by law.

8. Changes

We will announce material changes to this policy on the site or by email. This page always shows the current version and its date.

Contact

Data controller: Cengiz Bayazit (sole proprietorship, Türkiye) · privacy@drawlytic.com · see also our Terms of Service.