Privacy Policy

This policy explains what data Drawlytic (drawlytic.com, operated by Teknoset Ltd, sole proprietorship, registered in Türkiye — the "data controller") collects, why, and what your rights are. It is written to comply with the Turkish Personal Data Protection Law (KVKK No. 6698) and, for users in the EU/EEA and UK, the GDPR / UK GDPR. Contact: privacy@drawlytic.com. Postal address: P.O. Box 21, Üsküdar, İstanbul, Türkiye.

1. Data we collect

• Account data: your email address, an optional display name, and a salted hash of your password (we never store the password itself). Google sign-in additionally stores your Google account identifier.
• Your files: the CAD models you upload and the drawing outputs generated from them, stored so your projects remain available to you.
• Billing status: plan, subscription period and credit balance. Payments are processed by Polar (merchant of record) — we never see or store card numbers; we receive only order/subscription status and Polar's customer reference.
• Product events ("Drawlytic product events"): our own first-party, cookie-free analytics table on our own infrastructure. It records the event name (e.g. "drawing generated", "pricing viewed"), a timestamp, your user id when signed in, and a small technical note — never your IP address, device fingerprint or file contents.
• Messages you send us: emails to our addresses and replies in support conversations, stored in our support inbox (see section 5a).
• Consent records: when you grant or withdraw a marketing subscription or the cookie choice, we log the action with timestamp, IP address, browser information, where it happened and the version of the consent text — this is our legal proof of your choice.

2. What we do NOT do

• Your CAD files are not used to train models and are never shared with other users or third parties, except the processors below as needed to run the Service.
• We do not sell personal data, and we show no third-party ads on the site.
• Marketing email is strictly opt-in with confirmation; service emails carry no promotional content.

2a. Advertising measurement (Meta Pixel) — only with your consent

To measure whether our ads work, we use the Meta Pixel (Meta Platforms) — but only after you explicitly accept it in the cookie banner. Until you choose, and whenever you decline, the pixel script is not loaded at all and nothing is sent to Meta.

• If you accept: standard page views of our public marketing pages, with the technical data any web request carries (IP address, browser information, Meta cookies such as _fbp). After a purchase, we also send Meta a server-side confirmation of the order value with your email in hashed form — again only if you accepted.
• What is never sent: your CAD files, file names, project contents, drawing outputs or links to them, and pages inside your account (projects, account settings, sign-in, email-verification and password-reset pages are excluded from tracking entirely).
• Legal basis: your consent (KVKK Art. 5/1, GDPR Art. 6(1)(a)), withdrawable at any time. Details of every cookie: see the Cookie Policy.

Change my cookie choice

3. Legal bases and purposes

We process your data to perform our contract with you (running your account, storing projects, enforcing plan limits, answering your messages), for our legitimate interests (security, abuse prevention, first-party product analytics), with your consent (marketing email per topic, advertising measurement), and to comply with legal obligations (tax and accounting records for purchases).

4. Processors and transfers

• Cloudflare, Inc. — hosting, databases, file storage, inbound email routing and network security. Cloudflare operates a global network; data may be processed in the EU and the United States.
• Resend (Plus Five Five, Inc., USA) — sends our transactional and (opt-in) marketing email and tells us when an address bounces.
• Polar Software Inc. (USA) — merchant of record for payments; Polar is an independent controller for the payment records it must keep.
• Meta Platforms Ireland Ltd — advertising measurement, only with your consent (section 2a).

Where these providers process data outside Türkiye or the EU/EEA, we rely on the EU Standard Contractual Clauses included in their data-processing agreements. For KVKK, transfers abroad are based on the standard contract mechanism under Art. 9, with the notification to the Personal Data Protection Authority (KVKK) where required.

5. Retention

• Account data: kept while your account exists; deleted on account-deletion request (30-day purge window for recoverable project deletions).
• Uploaded models and outputs: kept per your plan's history window and until you delete the project or your account.
• Support inbox messages: 24 months after the last message in the conversation.
• Mailing-list data and campaign logs: campaign history 24 months; unsubscribed addresses stay on a suppression list indefinitely so we never email them again by mistake.
• Consent records: life of the account plus 3 years after deletion (proof of consent).
• Product events: 12 months, then deleted.
• Billing records: kept by Polar as merchant of record under its own statutory retention duties.

5a. Email — support inbox and the mailing list

• Inbound email: mail you send to our addresses is received through Cloudflare Email Routing and stored in our support inbox (message text and attachments), so we can answer you and keep the conversation history. Legal basis: performing our contract / legitimate interest in handling support.
• Service email (verification, password reset, receipts, replies to your own messages) is sent via Resend and needs no opt-in; it never carries promotional content.
• Marketing email (product news, offers, surveys) is sent only to the topics you explicitly subscribed to, confirmed by a double opt-in email. Every message contains a working one-click unsubscribe. Legal basis: consent, withdrawable at any time from your account page or any email footer.

6. Your rights

Under KVKK Art. 11 and GDPR Art. 15–21 you may request access, correction, deletion, restriction, portability, or object to processing. You can delete individual projects yourself at any time, manage marketing subscriptions on your account page, and for data export, full account deletion or any other request, email privacy@drawlytic.com from your account address — we respond within 30 days. EU/EEA users may also lodge a complaint with their local supervisory authority, and Turkish users with the KVKK Authority.

EU representative (GDPR Art. 27): we are assessing whether our processing requires appointing a representative in the Union; if appointed, their contact details will be listed here. Until then, privacy@drawlytic.com reaches the controller directly.

7. Security and breach notification

Passwords are hashed with PBKDF2; session tokens are stored hashed; admin access is restricted and audited. Files live in access-controlled object storage tied to your account. If a personal-data breach is likely to result in a risk to your rights, we will notify the competent authority without undue delay (within 72 hours where GDPR applies, and per KVKK Board rules) and inform affected users directly when the risk is high.

8. Changes

For material changes we give at least 14 days' advance notice on this page (and by email to affected registered users) before the change takes effect. Minor clarifications take effect on publication.

Version history

• October 10, 2026: Mailing list, admin inbox, cookie policy, retention table, named analytics, transfer safeguards.
• September 11, 2026: Meta Pixel / advertising measurement section (consent-gated).
• July 2026: Initial version.

Contact

Teknoset Ltd · P.O. Box 21, Üsküdar, İstanbul, Türkiye
Privacy requests: privacy@drawlytic.com · General: hello@drawlytic.com

See also: Cookie Policy · Terms of Service