Draft — have it checked by your legal adviser. This text is not ready for publication; the fields marked in yellow [SQUARE BRACKETS] must be filled in and the text must be reviewed by a lawyer.

Privacy Policy

We explain in plain language what information we collect, why and how we use it, and the rights you have over your data.

Last updated: [EFFECTIVE DATE]

Versions of this document in languages other than Turkish are translations provided for information purposes only; in the event of any discrepancy, the Turkish text shall prevail.

01Scope and data controller

This Privacy Policy sets out in general terms how personal data is collected, used and protected in connection with the nodaform.com website and the browser-based floor plan drawing service (the “Service”) provided by [COMPANY NAME] (“Nodaform”, “we”).

The statutory information notice for users in Türkiye is set out in detail in the KVKK Privacy Notice; this policy should be read together with that notice. Data controller: [COMPANY NAME], [ADDRESS], info@nodaform.com.

02Summary

  • We collect the data required to provide the Service: your name, email address, projects and support tickets.
  • We do not sell your data, and we do not use it for advertising or profiling purposes.
  • No analytics or advertising tools are currently used on the site.
  • Your plans belong to you; you may export or delete them at any time.
  • Your card details remain with the payment institution; we neither see nor store them.
Where your data is stored

Your account, project, sharing, comment and support data is stored on our servers on Cloudflare infrastructure, so you can access your projects from any device. Your browser holds only a temporary copy of your projects for fast loading and your preferences; when you sign out, the project copies are deleted from the browser.

03Information we collect

Information you provide to us

  • Account: name, email address and password (the password is stored only as a one-way hash).
  • Content: projects, floor plans, drawing sheet templates, title block details, the company logo you upload, share links and comments.
  • Support and communication: support tickets, emails and any information you include in them.
  • Payment: billing information when you purchase a paid plan; card details are transmitted directly to the payment institution.

Information generated automatically

  • IP address, browser type, device information, sign-in dates and security logs.
  • Your preferences, such as language, region and price display (stored in your browser; see the Cookie Policy).

Information from third parties

  • If you choose Sign in with Google: your name, email address and profile photo link from Google.
  • From the payment institution: transaction number, amount and payment status.

04How we use information

  • To create your account, manage your session and provide the Service;
  • To save, share and export your projects;
  • To manage your subscription, payments and invoices;
  • To respond to your support tickets;
  • To ensure security and to prevent abuse and fraud;
  • To comply with our legal obligations;
  • To send you emails about new features and promotions, if you have given your consent.

We do not make decisions that produce legal effects concerning you by means of automated decision-making or profiling.

05Sharing of information

We share your personal data only with service providers that help us provide the Service (hosting, database and email routing: Cloudflare; email delivery: Resend; payment: [PAYMENT INSTITUTION]; Google, if Sign in with Google is chosen), with competent authorities as required by our legal obligations, and on your instruction. Our service providers may process your data only on our behalf and in accordance with our instructions.

When you share a plan via a share link, anyone who has the link can view the plan. You can manage links under My account › Sharing.

In the event of a merger, transfer or sale of the company, your data may pass to the acquiring party together with the safeguards in this policy; in that case, you will be notified.

For detailed information on recipient groups and transfers abroad, see KVKK Privacy Notice › Transfers.

06Retention period

We retain your data for as long as your account remains open and for the period required by our legal retention obligations. When you delete your account, your projects and account information are deleted; records that must be retained by law, such as invoices, are kept with restricted access until the relevant period expires. Detailed retention periods are set out in the KVKK Privacy Notice.

07Security

We take reasonable technical and organisational measures to protect your data. These include serving the site over an encrypted connection (HTTPS), storing passwords as one-way hashes rather than in plain text, limiting access to data to authorised persons, and confidentiality obligations with our service providers.

No system is completely secure. To keep your account secure, choose a strong password that you do not use elsewhere, sign out on shared computers and report any suspicious activity to us.

If we become aware that your personal data has been unlawfully obtained by others, we will notify you and the Turkish Personal Data Protection Board as soon as possible, in accordance with Article 12 of the KVKK (Turkish Personal Data Protection Law).

08Your rights

To access your data, request its correction or erasure, object to its processing or exercise your other rights, you may contact us at info@nodaform.com. The rights of users in Türkiye and the application procedure are explained in the KVKK Privacy Notice.

You can update your account information or delete your account under My account › Settings. You can download your projects from the editor as project files (.json).

09Users in the European Union (GDPR)

To the extent that we provide the Service to users located in the European Union or the European Economic Area, your personal data is also processed in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

Legal bases

  • Performance of a contract (GDPR Art. 6(1)(b)): account, projects, subscription and support;
  • Legal obligation (Art. 6(1)(c)): invoices and accounting records;
  • Legitimate interests (Art. 6(1)(f)): security, abuse prevention, service notifications;
  • Consent (Art. 6(1)(a)): marketing emails. You may withdraw your consent at any time.

Your rights

Under the GDPR, you have the right of access to your data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You may also lodge a complaint with the data protection supervisory authority in the EU Member State where you live or work or where the infringement took place (Art. 77).

International transfers

Nodaform is established in Türkiye, and your data may be processed in Türkiye or in other countries where our service providers are located. For transfers to countries not covered by an adequacy decision of the European Commission, appropriate safeguards such as the EU Standard Contractual Clauses or, where necessary, the derogations in Art. 49 GDPR are relied upon.

EU representative

Representative designated under Art. 27 GDPR: [EU REPRESENTATIVE (if required)].

10Children’s privacy

The Service is not directed at children. Persons under 16 should not create an account; in some EU countries this age limit has been lowered by national law to as low as 13, and in those countries the applicable age applies. Users under 18 require the consent of a parent or guardian to purchase a paid plan.

If we become aware that we have collected data from a child under the age limit without authorisation, we will delete that data. If you are aware of such a case, please notify us at info@nodaform.com.

11Cookies and local storage

The site sets only one strictly necessary cookie: a session cookie that recognises your session when you sign in. Your preferences and a temporary copy of your projects are kept in your browser’s local storage. No analytics or advertising cookies are used. You can find out which records are kept and how to delete them in the Cookie and Local Storage Policy.

12Marketing communications

We send you commercial electronic communications about new features and promotions only if you have given prior consent. Your consent is recorded in accordance with Turkish Law No. 6563 on the Regulation of Electronic Commerce and the related regulation. You may exercise your right to opt out at any time, free of charge, via the link in each message or by writing to us. Transactional messages, such as account, security and subscription notifications, are not covered by this section.

13Third-party links

The site may contain links to third-party services or websites, such as Google. We are not responsible for the privacy practices of these services; we recommend that you review the privacy policy of the relevant service.

14Changes

We may update this policy from time to time. The current version is always published on this page together with the date of the last update. We will announce material changes by email or by an in-Service notice before they take effect.

15Contact

For privacy-related questions: info@nodaform.com · KEP (registered email): [KEP ADDRESS] · [ADDRESS]. Other contact channels are listed on the Contact page.