Draft — not legal advice. / Taslak — hukuki görüş değildir. Prepared from opened templates (translated/adapted): KVKK Guide on the Duty to Inform (Sample 1), Paraşüt KVKK notice, Kolay İK notice, PatronFinans agreement, KVKK Board Decision 2026/347. GDPR Art. 13 items added. Turkish counterpart:
gizlilik-politikasi-kvkk-aydinlatma.tr.md.
Last updated: 2026-10-15 (draft)
This Policy is the information notice under Art. 10 of Turkish Law No. 6698 ("KVKK") and the Communiqué on the Duty to Inform, and under Art. 13 of the EU GDPR where the GDPR applies.
Language
This text is published in Turkish and English. For users in Türkiye, the Turkish text prevails in case of conflict; for users outside Türkiye, the English text prevails.
1. Data controller
Ali Ravza Barlak, sole proprietorship ("Craft", "we"), operates the Craft AI workspace ("Service") and is the data controller.
| Field | Information |
|---|---|
| Controller | Ali Ravza Barlak (sole proprietorship / şahıs şirketi) |
| Tax ID (VKN) | 1421541880 |
| Tax office | [[STUB: vergi dairesi]] |
| Chamber / trade registry | None (no chamber registration) |
| Address | Üniversite Mah. Eskimezarlık Sok. No: 16/16, Ortahisar, Trabzon |
| KEP (registered e-mail) | aliravza.barlak@hs01.kep.tr |
| General contact | info@usecraft.app |
| Data protection requests (KVKK / GDPR) | gdpr@usecraft.app |
| Data Protection Officer | Not appointed |
| EU / UK representative (GDPR Art. 27) | None at launch |
2. Personal data we process
| Category | Examples |
|---|---|
| Identity | Name and surname (if given); age declaration (18+) |
| Contact | Email address |
| Customer transaction / account | Account ID, plan (free / trial / paid), team/workspace memberships |
| User content | Canvases, chat and agent inputs and outputs, vault uploads (files/media) |
| Transaction security | IP address, session and log records, the craft_session_user cookie (user ID only) and the craft_auth_token authentication cookie |
| Payment (not stored by Craft) | Subscription status; card and payment data are processed by Paddle |
| Visual | Profile image (if uploaded) |
Storage split: Cloudflare R2 stores only objects and media (files). Canvases and account data are stored in MongoDB Atlas, Germany (Frankfurt, AWS eu-central-1).
Providing data: email address and the 18+ declaration are required to create an account (contractual requirement); without them we cannot provide the Service.
3. Purposes and legal bases
| Purpose | KVKK legal basis (Art. 5) | GDPR legal basis (Art. 6) |
|---|---|---|
| Account creation; providing the Service (canvases, chat, vault, agents, AI features) | Necessary for the conclusion or performance of a contract (5(2)(c)) | Contract (6(1)(b)) |
| Security, session management, abuse prevention, logs | Legitimate interest (5(2)(f)); legal obligation (5(2)(ç)) where applicable | Legitimate interests (6(1)(f)); legal obligation (6(1)(c)) |
| Support and communication (incl. transactional/service emails) | Contract; legitimate interest | Contract; legitimate interests |
| Billing and subscriptions (via Paddle) | Contract; legal obligation | Contract; legal obligation |
| Product improvement (anonymised usage) | Legitimate interest | Legitimate interests |
| Legal requests and disputes | Legal obligation; establishment, exercise or defence of a right (5(2)(e)) | Legal obligation; legitimate interests |
We do not send newsletters or marketing messages at launch.
KVKK Board Decision 2026/347: this notice is information only and does not ask for your consent or approval. If processing ever requires explicit consent, we will ask for it in a separate text with a separate unticked checkbox.
Automated decisions: we do not make decisions with legal or similarly significant effects solely by automated means (GDPR Art. 22). AI features generate content at your request.
4. Recipients, countries and transfer basis
Personal data is shared with the following recipients only as needed to provide the Service:
| Recipient | Role / data | Country |
|---|---|---|
| Contabo | Server hosting (application infrastructure) | Germany |
| Cloudflare (incl. R2) | CDN, DNS, security; R2: file/media objects only | US (Cloudflare, Inc.; global edge network) |
| MongoDB Atlas | Database: canvases and account data | Germany — Frankfurt (AWS eu-central-1) |
| Amazon Web Services — SES | Transactional email | Germany — Frankfurt (eu-central-1) |
| Paddle (Paddle.com Market Limited) | Merchant of Record / seller — payment, invoicing, tax, refunds | United Kingdom |
| OpenAI | AI inference (training off) | US |
| AI inference (training off) | US | |
| Anthropic | AI inference (training off) | US |
| xAI | AI inference (training off) | US |
| Serper | Web search (query text) | [[STUB: Serper country — no address on its official pages; only UK governing law stated]] |
| Parallel Web Systems Inc. (Parallel.ai) | Web search (query text) | US (San Francisco) |
| Competent public authorities | Legal obligation | Türkiye |
International transfers. All recipients above, except public authorities, are outside Türkiye. For transfers abroad Craft relies on KVKK Art. 9(4) standard contracts (the standard contract text published by the KVKK Board, to be notified to the Authority) and, where the GDPR applies, on GDPR Chapter V safeguards (adequacy decisions or EU Standard Contractual Clauses).
Full list: subprocessors.en.md.
5. Method of collection
Data is collected by automated or partly automated means: the registration form, your use of the Service, session cookies, email, support channels, and the redirect to Paddle checkout.
6. Retention and deletion
| Data | Retention |
|---|---|
| While the account is active | For the duration of the Service |
| After account closure | Personal data is permanently deleted within 30 days of closure (implemented: backend 3bb4cdb014e55bd12301a424d49ee488a79b4624, frontend d27090a6474a56d8d5d227bea6c5296c14f80b66) |
llm_usage_events | userId / actorId fields are set to null |
| Team workspace content | Not deleted when one member closes their account (belongs to the team) |
| Logs | Limited to the security purpose and any statutory periods |
| Financial / commercial records | Statutory retention periods (largely kept by Paddle as seller) |
Two ways to delete: (1) close your account in the Service — permanent deletion follows within 30 days; or (2) email a deletion request to gdpr@usecraft.app from your registered address — we verify it and delete within the same period. Statutory retention obligations are reserved.
7. Cookies
We use only two strictly necessary cookies: the craft_session_user session cookie, which holds your user ID, and the craft_auth_token authentication cookie, which verifies that you are signed in. We use no analytics or advertising cookies, so no cookie banner is shown. If this changes, we will update this section and ask for consent where required.
8. Artificial intelligence
AI features send your prompts and the relevant context to OpenAI, Google, Anthropic or xAI (US) for inference. Model training is turned off (opt-out enabled) with all four providers, and Craft does not train models on your data. Details: ai-disclosure.en.md.
9. User content — controller vs processor
Craft is the controller for account data and Service-operation data. If you upload personal data about others, you are responsible for informing them and, where needed, obtaining their consent; for that content Craft acts as a processor within the limits of technical processing.
10. Your rights
Under KVKK Art. 11 you may: learn whether your data is processed and request information; learn the purpose and whether data is used accordingly; know third parties in Türkiye or abroad to whom data is transferred; request correction; request deletion or destruction under Art. 7; request that correction/deletion be notified to recipients; object to an adverse result arising solely from automated analysis; and claim compensation for unlawful processing.
Under the GDPR (where applicable): access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and complaint to a supervisory authority.
How to apply: in writing, by KEP, secure e-signature, mobile signature, or from your registered email to:
- Email: gdpr@usecraft.app
- KEP: aliravza.barlak@hs01.kep.tr
- Address: Üniversite Mah. Eskimezarlık Sok. No: 16/16, Ortahisar, Trabzon
We respond within 30 days at the latest (KVKK Art. 13). You may also complain to the Personal Data Protection Board.
11. Changes
We may update this Policy. Material changes are announced in the Service or by email; the current version is always published on this page.