⌬
Drawlytic

Privacy Policy

Last updated: September 11, 2026

This policy explains what data Drawlytic (drawlytic.com, operated by Cengiz Bayazit, sole proprietorship, Türkiye — the "data controller") collects, why, and what your rights are. It is written to comply with the Turkish Personal Data Protection Law (KVKK No. 6698) and, for users in the EU/EEA, the GDPR.

1. Data we collect

  • Account data: your email address and a salted hash of your password (we never store the password itself).
  • Your files: the CAD models you upload and the drawing outputs generated from them, stored so your projects remain available to you.
  • Usage data: product events (e.g. sign-up, drawing generated, checkout started), timestamps, plan and credit balance — used for operating quotas and improving the product.
  • Technical logs: IP address and request metadata processed by our hosting provider for security and abuse prevention (short-lived operational logs).
  • Payment data: handled by our merchant of record, Polar. We never see or store card numbers; we receive only order/subscription status, and Polar's customer reference.

2. What we do NOT do

  • No sale of personal data — ever.
  • Your CAD files are not used to train models and are never shared with other users or third parties, except the processors below as needed to run the Service.
  • The only cookie set without your consent is the essential session cookie (bs_session) that keeps you logged in. Any advertising measurement (section 2a) runs only if you explicitly accept it.

2a. Advertising measurement (Meta Pixel) — only with your consent

To measure whether our ads work, we use the Meta Pixel (Meta Platforms) — but only after you explicitly accept it in the cookie banner. Until you choose, and whenever you decline, the pixel script is not loaded at all and nothing is sent to Meta.

  • What it records if you accept: standard page views of our public marketing pages (e.g. the homepage, pricing, help) together with the technical data any web request carries (IP address, browser information, Meta cookies such as _fbp).
  • What is never sent: your CAD files, file names, project contents, drawing outputs or links to them, and pages inside your account (projects, account settings, sign-in, email-verification and password-reset pages are excluded from tracking entirely).
  • Legal basis: your consent (KVKK Art. 5/1, GDPR Art. 6(1)(a)), which you can withdraw at any time.

3. Legal bases and purposes

We process your data to perform our contract with you (running your account, storing projects, enforcing plan limits), for our legitimate interests (security, abuse prevention, product analytics on our own infrastructure), and to comply with legal obligations (tax and accounting records for purchases).

4. Processors and transfers

  • Cloudflare, Inc. — hosting, storage (databases and file storage) and network security. Data may be processed on Cloudflare's global infrastructure.
  • Polar Software Inc. — merchant of record for payments (receives your email and payment details you enter at checkout).
  • Resend (Plus Five Five, Inc.) — transactional email delivery (e.g. password-reset messages; receives your email address).
  • Meta Platforms Ireland Ltd. / Meta Platforms, Inc. — advertising measurement via the Meta Pixel, only if you consent (see section 2a; receives page-view data from public pages, never your files or project data).

Where these providers process data outside Türkiye or the EU/EEA, transfers rely on the providers' standard contractual clauses and equivalent safeguards.

5. Retention

  • Account data: kept while your account exists; deleted on account-deletion request.
  • Uploaded models and outputs: kept per your plan's history window and until you delete the project or your account.
  • Purchase records: kept as long as tax law requires.
  • Password-reset tokens: 1 hour. Operational logs: short rotation windows.

6. Your rights

Under KVKK Art. 11 and GDPR Arts. 15–21 you may request access, correction, deletion, restriction, portability, or object to processing. You can delete individual projects yourself at any time; for full account deletion or any other request, email privacy@drawlytic.com from your account address — we respond within 30 days. EU/EEA users may also lodge a complaint with their supervisory authority; Türkiye residents with the KVKK Board.

7. Security

All traffic is encrypted (TLS). Passwords are hashed with PBKDF2; session tokens are stored hashed. Files live in access-controlled object storage tied to your account. No method is 100% secure, but we notify affected users of any breach as required by law.

8. Changes

We will announce material changes to this policy on the site or by email. This page always shows the current version and its date.

Contact

Data controller: Cengiz Bayazit (sole proprietorship, Türkiye) · privacy@drawlytic.com · see also our Terms of Service.