Your account information, projects, shares and comments, and support tickets are stored on our servers on Cloudflare infrastructure (see 05 Transfer of personal data). Only temporary copies for faster loading and your preferences are kept in your browser.
01Data controller
Murat Can Akatay (“Nodaform” or “we”) is the data controller under the Turkish Personal Data Protection Law No. 6698 (“KVKK”) with respect to your personal data processed in connection with the nodaform.com website and the browser-based floor plan drawing service (the “Service”).
This privacy notice has been prepared pursuant to Article 10 of the KVKK and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, in order to explain for what purposes, on what legal grounds and by what methods your personal data is processed, to whom it may be transferred, and your rights.
| Name | Murat Can Akatay |
|---|---|
| info@nodaform.com |
02Categories of personal data processed
Depending on how you use the Service, the following personal data may be processed. The Service is not designed to collect special categories of personal data (health, biometric data, religion, ethnic origin, etc.); we ask that you do not include such data in your plans or support tickets.
| Category | Data |
|---|---|
| Identity | The first name (and surname, if any) you provide in your account. If you sign in with Google, the name and profile photo link from your Google account. |
| Contact | Email address; other contact details you share in support or contact correspondence. |
| Customer transaction | Projects and floor plans, drawing sheet templates, title block details and, if you upload one, your company logo; shares (the email addresses of the people you invite and the permissions you grant) and comments; support requests and correspondence; plan and subscription records; team membership records (team name, role, date joined, assigned license, team invitations and the team activity log); for business accounts, the company name, country, tax ID and billing address; preferences such as language and region. |
| Feedback | Only if you answer the optional feedback card in the editor: score (1–5), the features you use most, your comment and your initials. Your comment is shown on the website only with your permission to publish. |
| Use of AI | Only if you use the assistant or render: the request you write to the assistant and a summary of the open floor; for render, the 3D view shot within the frame, the scene description, the style and lighting you select and the request you write (these are transmitted only to the provider and are not stored by us); for the monthly allowance, the number, time and size of uses; render credit records (pack, purchase and expiry date, credits used). |
| Transaction security | Sign-in and session logs (date, time); date, time and IP records of project saves, shares and comments (not the content itself); IP address, browser and device information, a one-way hash of your password (the password itself is not stored), the result of the bot check; the country derived from your IP address to show prices in your country’s currency (not stored on our server; only the two-letter country code is kept in your browser). To prevent abuse, IP addresses in the sign-in records may be linked to accounts, and IP addresses involved in abuse may be blocked. |
| Gift code | If you purchase a gift code: the code's plan, duration, status and the encrypted code; and, optionally, the recipient's email address, the email language and the note that you enter. If a code has been sent to you: your email address and the note entered by the person who purchased the code; if you use the code, the account that used it, the date of use and the duration of the plan unlocked. |
| Financial | If you purchase a paid plan, render credits or a gift code: the limited transaction information forwarded to us by the payment institution (transaction number, amount, date, payment status) and records relating to the invoice issued by Paddle; a record of the consents you tick before the payment window (date, time, IP address and the version of the agreement text accepted); a record of the discount code you used. |
Your card details are collected and processed in the checkout window directly by our online reseller Paddle. The card number, expiry date and security code are neither seen nor stored by Nodaform.
If you add information about third parties to your plans (e.g. your client’s name or the address of a property), you are responsible for obtaining that information lawfully and for adding it to the Service.
03Purposes of processing personal data
Your personal data is processed for the following purposes and only to the extent limited by them:
- creating the user registration, authentication and account management;
- providing the Service: saving projects, drawing and export functions, share links and comments;
- carrying out subscription, payment and billing processes, and applying plan entitlements and usage limits;
- Operating the gift code feature: delivering the code, sending the gift email to the recipient and redeeming the code;
- Operating the team (business membership) features: invitations, assigning and transferring team licenses, and, at the team admin's choice, transferring the projects that a removed member created while in the team;
- receiving, responding to and recording support tickets, requests and complaints;
- carrying out information security processes; preventing unauthorized access, fraud and abuse;
- sending mandatory notices about the Service (such as security, changes to the agreement and prices, and subscription renewal);
- fulfilling legal obligations and responding to requests from competent authorities and institutions;
- Establishing, exercising and protecting rights in potential disputes.
04Legal grounds
Your personal data is processed on the basis of the following legal grounds listed in Article 5 of the KVKK:
| Legal ground | Processing activities |
|---|---|
| Art. 5/2-c — Conclusion or performance of a contract | Account creation and sign-in, storing projects, sharing and comment functions, subscription and payment processes, responding to support tickets. |
| Art. 5/2-ç — Compliance with a legal obligation | Invoice and accounting records (Tax Procedure Law, Turkish Commercial Code), record-keeping and information obligations under consumer legislation, records under Law No. 5651, requests from competent authorities. |
| Art. 5/2-e — Establishment, exercise or protection of a right | Retaining and using relevant records in dispute, complaint and objection processes. |
| Art. 5/2-f — Legitimate interest | Security and sign-in logs, preventing abuse, transactional notices about the service, remembering your language and region preferences. This processing is carried out in a manner that does not harm your fundamental rights and freedoms. Evaluating optional feedback to improve the service. |
| Art. 5/1 — Explicit consent | Meta Pixel, Google Analytics and Google Ads for ad and usage measurement (with your consent in the cookie banner); transfers abroad where the other conditions in Art. 9 of the KVKK are not met. Showing your feedback comment on the website with your initials (with the permission to publish given on the card). |
Explicit consent is not a precondition for using the Service. You may withdraw your explicit consent at any time; withdrawal does not affect the lawfulness of prior processing.
05Transfer of personal data
Your personal data may be transferred to the following groups of recipients to the extent necessary for the purposes above and in accordance with Articles 8 and 9 of the KVKK. Your data is not sold. For ad and usage measurement, it is transferred to Meta and Google only with your explicit consent and to the extent described below.
| Recipient | Data transferred and purpose |
|---|---|
| Hosting and infrastructure service provider (Cloudflare, Inc.) | All account, project and log data stored on the servers on which the Service runs; serving the website, the database, security, and forwarding emails sent to info@nodaform.com. The primary location of the database is Eastern Europe; website content is delivered through Cloudflare’s global network. Also the bot check when you sign up and reset your password (Turnstile: IP address, browser signals) and cookie-free visitor statistics (Web Analytics). |
| Password breach check (Have I Been Pwned / Pwned Passwords) | Only the first 5 characters of the SHA-1 hash of your password when you sign up, change or reset your password; preventing the use of a leaked password. The password, email and identity information are not sent. |
| Paddle (online reseller) | Name, email, order amount and transaction information; for business accounts, the company name, tax ID and billing address so that they appear on the invoice; collecting and refunding payments and preventing fraud. You provide your card details directly to the payment institution. |
| Google (only if Sign in with Google is chosen) | When you sign in with Google, authentication is performed by Google, and Google provides us with your name, email and profile photo link. |
| Email delivery service provider (Resend, Inc.) | Email address and message content; delivering account verification, password reset, security and subscription notifications. The sending server is located in Ireland (EU). |
| AI service provider (Anthropic, PBC; only if you use the assistant) | The request you write to the assistant and a summary of the open floor (room names and dimensions, door, window and furniture positions); generating a response to the request. Your account information and email address are not sent. Its servers are in the USA; the provider retains this data for a limited period under its own commercial terms and does not use it for model training. |
| AI image service provider (Google LLC, Gemini API; only if you use render) | The 3D view shot within the render frame, a scene description (room names, types of furniture in the room, number of windows and doors), the style and lighting you select and the request you write and any reference images you add with their notes; generating the image. Your account information and email address are not sent. Google retains this data for a limited period solely to prevent abuse and does not use it to improve its products; the data may be processed temporarily in countries where Google has facilities (including the USA). |
| Meta Platforms Ireland Ltd. (only if you consent in the cookie banner) | Address of the page visited, IP address, browser information, Meta cookie identifier and events (page view; sign-up and the method by which the account was created (email or Google); saving of the first real floor plan; opening of the payment window and purchase: amount, currency, and the subscription plan and billing period purchased or the render credit pack); through Meta Pixel’s automatic events, the buttons clicked on the page and page information such as the page title and description; measurement of the results of our advertising. The name and email address you type into forms may be transmitted, in order to match events with your Meta account, only in one-way hashed form from the browser (Automatic Advanced Matching); floor plan data and password are not sent. Meta may also process the data on its servers in other countries, including the United States; the transfer is based on your explicit consent, and you can withdraw your consent at any time in the cookie preferences. |
| Google Ireland Ltd. — Google Analytics and Google Ads (only if you consent in the cookie banner) | Address of the page visited, IP address, browser and device information, Google cookie identifiers, ad click identifier and events (page view, sign-up, saving of the first plan, opening of the payment window, purchase amount, currency and transaction number); measurement of the use of the site and of the results of our advertising. Plan information, password, name and email address are not sent. Google may also process the data on its servers in other countries, including the United States; the transfer is based on your explicit consent, and you can withdraw your consent at any time in the cookie preferences. |
| Team admin (only if you join a team) | Name, email address, date joined, the license assigned to you and the number of projects you have created while in the team; if the team admin so chooses when removing you from the team, the projects you created while in the team and their shares. Operating the team features (performance of a contract). |
| Accountants and legal advisors | Invoice and accounting records, dispute-related records; fulfilling legal obligations. |
| Competent public authorities and institutions, judicial authorities | Only in cases provided for by law and to the extent requested. |
When you share a plan, it opens only for a person who signs in with the email address you invited and whose email address is verified; this person can see the information in the plan with the permission you granted. An invitation email containing your name and the plan’s name is sent to the invited address. This sharing takes place at your choice; you can remove the share at any time.
Transfers abroad (Art. 9 of the KVKK)
The servers of our hosting, payment, email, AI, authentication or advertising providers may be located outside Türkiye. These transfers are made under Article 9 of the KVKK as follows:
- Transfers to our service providers (Cloudflare, Paddle, Resend, Anthropic, Google, Have I Been Pwned) are necessary to provide the Service and perform the contract; they rely on the safeguards in these providers’ data processing terms (including the standard contractual clauses they provide for international transfers).
- Transfers to Meta Pixel, Google Analytics and Google Ads rely solely on the explicit consent you give in the cookie banner. You can withdraw your consent at any time using the link in the Cookie Policy.
06Method of collection
Your personal data is collected on the basis of the legal grounds stated above, by fully or partly automated means and electronically, through the following channels:
- registration, sign-in, account settings, support and contact forms;
- the plan editor, drawing sheet templates, sharing and comment functions;
- from Google, when Sign in with Google is chosen;
- From the payment institution, when a paid plan, render credits or a gift code is purchased;
- From the person who purchased the code, when a gift code is sent to you (your email address and the note);
- from server and security logs generated automatically while the Service is used;
- from your browser’s local storage (for details, see the Cookie and Local Storage Policy);
- from your correspondence with us by email.
07Retention periods
Your personal data is retained for as long as required by the purpose of processing and provided for by law. At the end of that period, the data is deleted, destroyed or anonymized in accordance with the Regulation on the Deletion, Destruction or Anonymization of Personal Data; periodic destruction is carried out at intervals of no more than six months.
| Data | Retention period |
|---|---|
| Account, project and template data | For as long as your account remains open. A project you delete stays in the trash for 30 days and is then permanently deleted (at most 20 projects are kept in the trash; any beyond that are permanently deleted, oldest first). When you delete your account, your account, projects, remaining render credits, shares and comments are deleted from the live system immediately and are removed from database recovery records within 30 days at the latest. |
| Free render and sign-up campaign record | Irreversible hash of the email address (not the address itself), so the gift is given to the same address only once: 2 years from creation; kept for this period even if you delete your account. Irreversible hash of the IP address, so that the gift is given once to accounts opened from the same connection: 30 days. |
| Team invitations and team activity log | Invitee's email address: until the invitation is accepted or declined, for at most 14 days. Team activity log (license assignment, transfer, member removal and project transfer): 2 years. Team membership: until the person leaves or is removed from the team, or the team is closed. |
| Gift code records | Recipient's email address and note: deleted 30 days after the code is used, cancelled or expires. Code record (plan, duration, purchasing and redeeming account, dates): 2 years from the code's expiry date or, if used, from the end of the plan it unlocked. The record of an unpaid order is deleted after 2 days. Payment-related records are kept for the period of the invoice records below. |
| IP block | An IP address involved in abuse, the reason and duration of the block: for as long as the block lasts (for a permanent block, until it is lifted). |
| Subscription, payment and invoice records | Payment notifications received from the payment institution, payment transaction and pre-payment consent records, and discount code usage records: 10 years under the applicable tax and commercial legislation; even if you delete your account, they are kept with restricted access for this period. |
| Distance contract and pre-contractual information records | At least 3 years pursuant to the Regulation on Distance Contracts; for potential disputes, for the general limitation period (10 years). |
| Support tickets and correspondence | 3 years from the closing of the ticket. |
| Feedback responses | Until your account is deleted; deleted when the account is deleted. To withdraw your permission to publish, you can write to info@nodaform.com. |
| Session records | IP address and browser information of an active session: for the duration of the session, up to 30 days; deleted when you sign out. Failed sign-in attempt counters are deleted within 1 day. |
| Sign-in, IP and security logs | Sign-in records and traffic records of project saves, shares and comments (date, time, IP address): for the period provided for in Law No. 5651 and related legislation (not less than one year and not more than two years): 1 year. |
| AI assistant and render usage records | Only the number, time and size of uses, for tracking the monthly allowance and costs: 400 days. The content of the request, the plan, the image sent for render and the image generated is not stored by us. |
| Administrator activity log | Records of actions taken in the admin panel (e.g. changes to plan or account status, account deletion, IP bans, gift code cancellations; the action, date and account concerned): 5 years. |
| Browser security reports | Content Security Policy (CSP) violation reports sent by browsers: only the day, the rule violated, the address of the blocked resource, the page and the count; they contain no personal data. 90 days. |
| Entries kept in your browser | Until you delete them or clear your browser data; these records are stored on your device. Temporary copies of projects are deleted when you sign out. |
08Your rights under Article 11 of the KVKK
Pursuant to Article 11 of the KVKK, by applying to the data controller, you have the right to:
- a) learn whether your personal data is being processed;
- b) request information about the processing if your personal data has been processed;
- c) learn the purpose of the processing of your personal data and whether it is used in accordance with that purpose;
- ç) know the third parties in Türkiye or abroad to whom your personal data is transferred;
- d) request the rectification of your personal data if it has been processed incompletely or inaccurately;
- e) request the erasure or destruction of your personal data under the conditions set out in Article 7 of the KVKK;
- f) request that the actions taken under subparagraphs (d) and (e) be notified to the third parties to whom your personal data has been transferred;
- g) object to any outcome to your detriment arising from the analysis of the processed data exclusively by automated systems;
- ğ) claim compensation for damages if you suffer loss due to the unlawful processing of your personal data.
You may correct your account information under My account › Settings, and delete your account and projects from the same section (if you have an auto-renewing subscription, you must first cancel it under My account › My plan, and if you are a team owner, you must first cancel the team subscription under My account › Team and licenses).
09How to submit a request
In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit requests concerning your rights in Turkish, by one of the following means:
- Signed with a secure electronic signature or mobile signature: info@nodaform.com
- From the email address you previously provided to us and that is registered in our system: info@nodaform.com
Your request must include the following: your first name and surname; for citizens of the Republic of Türkiye, your Turkish national identity number, and for foreign nationals, your nationality and passport or identity number; your residential or business address for service of notices; if any, your email address and telephone number for notifications; and the subject of your request. Any relevant information and documents should be attached to the request.
Your request will be concluded free of charge as soon as possible depending on its nature, and within thirty days at the latest. If the process entails an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. We may request additional information to verify your identity.
If your request is rejected, if you find the response insufficient, or if no response is given in due time, you may file a complaint with the Personal Data Protection Board within thirty days of learning of the response and, in any case, within sixty days of the date of your request (KVKK Art. 14).
10Changes
This privacy notice may be updated in line with changes to legislation, to the Service or to our data processing activities. The current version is always published on this page; material changes are also announced by email or by an in-Service notification.
For our general privacy practices, please see the Privacy Policy; for records kept in your browser, please see the Cookie and Local Storage Policy.