Privacy Policy

01Scope and data controller

This Privacy Policy sets out in general terms how personal data is collected, used and protected in connection with the nodaform.com website and the browser-based floor plan drawing service (the “Service”) provided by Murat Can Akatay (“Nodaform”, “we”).

The statutory information notice for users in Türkiye is set out in detail in the KVKK Privacy Notice; this policy should be read together with that notice. Data controller: Murat Can Akatay, info@nodaform.com.

02Summary

• We collect the data required to provide the Service: your name, email address, projects and support tickets.
• We do not sell your data; we do not use it for profiling.
• To measure the results of our advertising and how the site is used, Meta Pixel, Google Analytics and Google Ads run only if you give cookie consent. To measure the general use of the site we also use Cloudflare Web Analytics, which does not use cookies (aggregate statistics such as page view counts; it does not identify you or create any record in your browser).
• Your plans belong to you; you may export or delete them at any time.
• Your card details remain with our online reseller Paddle; we neither see nor store them.

03Information we collect

Information you provide to us

• Account: name, email address and password (the password is stored only as a one-way hash).
• Content: projects, floor plans, drawing sheet templates, title block details, the company logo you upload, shares (the email addresses of the people you invite and the permissions you grant) and comments.
• AI assistant (Pro and Ultimate): the request you write to the assistant and a summary of the floor open at that time (room names and dimensions, door, window and furniture positions). These are transmitted to our provider solely to generate a response and are not stored by us; for your monthly allowance and cost tracking, only figures such as the number, time and duration of uses and the number of tokens are recorded.
• AI render (Pro and Ultimate): when you request a render, the 3D view shot within the frame, a scene description (room names, types of furniture in the room, number of windows and doors), the style and lighting you select and the request you write and any reference images you add with their notes. These are transmitted to our provider solely to generate the image; neither the image sent nor the image generated is stored by us. For your monthly allowance, only the number, time and image size of uses are recorded. Free renders given to Free and Plus members are handled the same way.
• Gift and campaign record: an irreversible hash of your email address (not the address itself), so that a free render or the timed plan from a sign-up campaign is given to the same address only once. This hash is kept for 2 years even if you delete your account; your address cannot be recovered from it. An irreversible hash of your IP address is also kept for 30 days so that they are not given to several accounts opened from the same connection.
• Business account: if you open a business account, your company name, country and, optionally, tax ID and billing address. This information is forwarded to our online reseller Paddle at checkout so that it appears on the team license invoice.
• Team (business membership): if you join a team, the team admin can see your name, email address, the date you joined the team, the license assigned to you and the number of projects you have created while in the team. When removing you from the team, the team admin may transfer the projects you created while in the team, together with their shares, to their own account; if you leave of your own accord, your projects remain with you. The email address of a person invited by the team admin is used only for the invitation email; an invitation that is not accepted is deleted after 14 days. Records of team actions such as assigning and transferring licenses and removing members are kept for 2 years.
• Gift code: if you purchase a gift code, the code's plan, duration and status; and, optionally, the recipient's email address, the email language and a short note that you enter. The recipient address and note are used solely to send the gift email; they are deleted 30 days after the code is used, cancelled or expires. The code itself is stored encrypted. If a gift code has been sent to you, your email address and the note were entered by the person who purchased the code; if you use the code, the account that used it and the duration of the plan unlocked are recorded.
• Support and communication: support tickets, emails and any information you include in them.
• Feedback: if you answer the optional feedback card in the editor, the score you give, the features you select and the comment you write. If you give permission to publish, your comment may be shown on the Nodaform website with your initials; to withdraw this permission, you can write to info@nodaform.com. When you delete your account, your feedback is deleted too.
• Payment: when you purchase a paid plan, render credits or a gift code, your card and billing details are collected by our online reseller Paddle; only the transaction number, amount and payment status are forwarded to us.

Information generated automatically

• IP address, browser type, device information, sign-in dates and security logs; date, time and IP records of project saves, shares and comments (not the content itself).
• A record of the consents you tick before the payment window (date, time, IP address and the version of the agreement text accepted).
• The country derived from your IP address (Cloudflare) to show prices in your country’s currency; this information is not stored on our server, and only the two-letter country code is kept in your browser for the price region (qwall.country).
• Your preferences, such as language, region and price display (stored in your browser; see the Cookie Policy).

Information from third parties

• If you choose Sign in with Google: your name, email address and profile photo link from Google.
• From the payment institution: transaction number, amount and payment status.

04How we use information

• To create your account, manage your session and provide the Service;
• To save, share and export your projects;
• To manage your subscription, payments and invoices;
• To respond to your support tickets;
• To ensure security and to prevent abuse and fraud;
• To comply with our legal obligations.

We do not make decisions that produce legal effects concerning you by means of automated decision-making or profiling.

05Sharing of information

We share your personal data only with service providers that help us provide the Service (hosting, database, email routing, bot protection (Turnstile) and cookie-free visitor statistics: Cloudflare; password breach check: Have I Been Pwned (only the first 5 characters of the password hash are sent; neither the password nor the email is sent); email delivery: Resend; payment: our online reseller Paddle.com (United Kingdom); Anthropic (USA), if you use the AI assistant; Google (Gemini API), if you use render; Google, if Sign in with Google is chosen; Meta Platforms Ireland Ltd. (Meta Pixel) and Google Ireland Ltd. (Google Analytics, Google Ads) for ad and usage measurement, if you give consent in the cookie banner), with competent authorities as required by our legal obligations, and on your instruction. Our hosting, email and AI providers (including Google Gemini API for render) may process your data only on our behalf and in accordance with our instructions. Paddle (in its capacity as seller) and Google for Sign in with Google, however, process the data as independent data controllers in accordance with their own privacy policies. The data transmitted to Meta and Google for ad and usage measurement is described in Section 13 and in the Cookie Policy.

When you share a plan, it opens only for a person who signs in with the email address you invited and whose email address is verified, with the permission you granted (review, comment or edit); even if the invitation link falls into someone else’s hands, it does not open for them. An invitation email containing your name and the plan’s name is sent to the address you invite. You can manage shares under My account › Sharing.

In the event of a merger, transfer or sale of the company, your data may pass to the acquiring party together with the safeguards in this policy; in that case, you will be notified.

For detailed information on recipient groups and transfers abroad, see KVKK Privacy Notice › Transfers.

06Retention period

We retain your data for as long as your account remains open and for the period required by our legal retention obligations. When you delete your account, your account information, projects, shares, comments and remaining render credits are deleted. Payment records (payment notifications, payment transaction and pre-payment consent records, and discount code usage records) are kept for 10 years, and administrator activity logs for 5 years, with restricted access. Detailed retention periods are set out in the KVKK Privacy Notice.

07Security

We take reasonable technical and organizational measures to protect your data. These include serving the site over an encrypted connection (HTTPS), storing passwords as one-way hashes rather than in plain text, limiting access to data to authorized persons, and confidentiality obligations with our service providers. When you sign up or use forgot password, bots are checked with Cloudflare Turnstile (your IP address and browser signals are transmitted to Cloudflare). When you sign up, change or reset your password, it is checked against known data breaches using the k-anonymity method, without the password itself being sent. To prevent abuse (for example, one person opening many accounts), IP addresses in the sign-in records may be linked to accounts, and IP addresses involved in abuse may be blocked temporarily or permanently.

No system is completely secure. To keep your account secure, choose a strong password that you do not use elsewhere, sign out on shared computers and report any suspicious activity to us.

If we become aware that your personal data has been unlawfully obtained by others, we will notify you and the Turkish Personal Data Protection Board as soon as possible, in accordance with Article 12 of the KVKK (Turkish Personal Data Protection Law).

08Your rights

To access your data, request its correction or erasure, object to its processing or exercise your other rights, you may contact us at info@nodaform.com. The rights of users in Türkiye and the application procedure are explained in the KVKK Privacy Notice.

You can update your account information or delete your account under My account › Settings; if you have an auto-renewing subscription, you must first cancel it under My account › My plan, and if you are a team owner, you must first cancel the team subscription under My account › Team and licenses. You can download your projects from the editor as project files (.json).

09Users in the European Union (GDPR)

To the extent that we provide the Service to users located in the European Union or the European Economic Area, your personal data is also processed in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

Legal bases

• Performance of a contract (GDPR Art. 6(1)(b)): account, projects, subscription and support;
• Legal obligation (Art. 6(1)(c)): invoices and accounting records;
• Legitimate interests (Art. 6(1)(f)): security, abuse prevention, service notifications;
• Consent (Art. 6(1)(a)): Meta Pixel, Google Analytics and Google Ads with your consent in the cookie banner. You can withdraw your consent at any time.

Your rights

Under the GDPR, you have the right of access to your data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You may also lodge a complaint with the data protection supervisory authority in the EU Member State where you live or work or where the infringement took place (Art. 77).

International transfers

Nodaform is established in Türkiye, and your data may be processed in Türkiye or in other countries where our service providers are located. For transfers to countries not covered by an adequacy decision of the European Commission, appropriate safeguards such as the EU Standard Contractual Clauses or, where necessary, the derogations in Art. 49 GDPR are relied upon.

10Children’s privacy

The Service is not directed at children. Persons under 16 should not create an account; in some EU countries this age limit has been lowered by national law to as low as 13, and in those countries the applicable age applies. Users under 18 require the consent of a parent or guardian to purchase a paid plan.

If we become aware that we have collected data from a child under the age limit without authorization, we will delete that data. If you are aware of such a case, please notify us at info@nodaform.com.

11Cookies and local storage

The site itself creates only one strictly necessary cookie: the session cookie that recognizes your session when you sign in. Cloudflare's bot protection and the Google sign-in window may set their own strictly necessary cookies. Your preferences and a temporary copy of your projects are kept in your browser’s local storage. Cloudflare’s visitor statistics are cookie-free. For ad and usage measurement, the cookies of Meta Pixel (_fbp, _fbc), Google Analytics (_ga, _ga_*) and Google Ads (_gcl_au, _gcl_aw) are activated only if you give your consent in the cookie banner; you can change your preference at any time. You can find which records are kept and how to delete them in the Cookie and Local Storage Policy.

12Marketing communications

We do not send you commercial electronic communications (marketing emails, newsletters) about new features and promotions. We send only transactional messages related to your account and the features you use, such as email verification, password reset, security, subscription and payment, sharing invitations, comments, team, gift code and support reply messages. If we wish to send marketing messages in the future, we will do so only after obtaining your prior explicit consent in accordance with Turkish Law No. 6563 on the Regulation of Electronic Commerce.

13Third-party links

The site may contain links to third-party services or websites, such as Google. We are not responsible for the privacy practices of these services; we recommend that you review the privacy policy of the relevant service.

If you consent, Meta Pixel (Meta Platforms Ireland Ltd.) transmits to Meta, in order to measure the results of our advertising, the address of the page you visit, your IP address, browser information and the following events: page view; sign-up and the method by which the account was created (email or Google); saving of the first real floor plan; opening of the payment window and purchase (amount, currency, and the subscription plan and billing period purchased or the render credit pack). Meta Pixel’s automatic events are also enabled: Meta may also collect data about the buttons you click on the page and page information such as the page title and description. Meta’s Automatic Advanced Matching feature may transmit to Meta the name and email address you type into forms on the site, hashed one-way in your browser, in order to match events with your Meta account; the plain values are not sent. Your floor plans and password are not sent. Meta processes this data in accordance with its own privacy policy.

If you consent, Google Analytics and Google Ads (Google Ireland Ltd.) transmit to Google, in order to measure how the site is used and the results of our advertising, the address of the page you visit, your IP address, browser and device information, Google cookie identifiers, the ad click identifier, and sign-up, first-plan-saving, payment-window-opening and purchase (amount, currency and transaction number) events. Your floor plans, password, name and email address are not sent. Google may also process this data on its servers in other countries, including the United States, and processes it in accordance with its own privacy policy.

14Changes

We may update this policy from time to time. The current version is always published on this page together with the date of the last update. We will announce material changes by email or by an in-Service notice before they take effect.

15Contact

For privacy-related questions: info@nodaform.com. Other contact channels are listed on the Contact page.