Skip to content
Teklif Atölyesi
Try free

Privacy policy and KVKK notice

Effective from 31 October 2026.

This notice is provided under Turkey's Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR) to inform people who use the Teklif Atölyesi website and app.

Data controller

Your personal data is processed by Teklif Atölyesi as the data controller. Contact address for requests and questions: merhaba@teklifatolyesi.com.

If Teklif Atölyesi becomes subject to registration with the Data Controllers Registry (VERBİS) under KVKK, it will register and publish the registry details on this page.

Personal data we process

  • Account details: full name, email address, a one-way hash of your password (the password itself is never stored), and language and region preferences. If Sign in with Google is used: the name, email address and account ID sent by Google.
  • Company details: company name, industry, country, currency, logo and app settings.
  • Usage and security logs: sign-in times, IP address, browser details, and audit logs of critical actions in the app.
  • Content you enter in the app: material and operation prices, customer records, quotes, orders, work orders and files you upload.
  • Website forms: the name, company, email, phone number, industry, team size and message you enter in the pilot application and contact forms, plus your IP address.
  • Billing details: when you move to a paid plan, the company name, tax number and address needed for invoicing. Card details are processed by the payment provider and are not stored by Teklif Atölyesi.
  • Connection credentials: API keys and passwords for services your company connects; stored encrypted, and only the last four characters are ever shown.

Your customers' data

When you enter your own customers' personal data (such as names, phone numbers, email addresses and street addresses) into Teklif Atölyesi, you are the data controller for that data; Teklif Atölyesi acts as a data processor and processes it only on your instructions and to provide the service.

We don't sell this data, use it for advertising, or combine it with other companies' data. The rules for this processing are set out in the Data Processing Agreement accepted when the account is created; the service providers we use are listed on the Sub-processors page.

Purposes of processing

  • Opening your account, providing the service and performing the contract.
  • Keeping accounts and data secure, preventing misuse and keeping audit logs.
  • Responding to support requests, pilot applications and contact messages.
  • Issuing invoices and meeting legal obligations.
  • Producing aggregated, de-identified usage statistics to improve the service.

Legal bases

  • Necessity for entering into and performing a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)). Website forms fall under this as pre-contract steps taken at your request.
  • Compliance with a legal obligation (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)).
  • Our legitimate interests, provided they don't override your fundamental rights and freedoms: security, preventing misuse and improving the service (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
  • Your explicit consent, only where needed, for example for marketing emails (KVKK Art. 5(1); GDPR Art. 6(1)(a)). You can withdraw your consent at any time.

Recipients and service providers

Your data is shared only as far as needed to provide the service, with the following groups of recipients:

  • Hosting: the app and database run in Hetzner Online GmbH data centers in Germany (EU).
  • AI: when you use message parsing, the assistant or text suggestions, the relevant text is sent, for that request only, to the AI provider your company has chosen (for example Anthropic PBC, OpenAI, Google, Mistral AI or a provider your company configures). When your company connects its own API key, its own agreement with that provider applies; when the platform's key is used, the data goes to Anthropic PBC or OpenAI (USA) and is not used to train models. Admins can switch AI off entirely, choose which users may use it, and have phone numbers and email addresses masked before sending.
  • Services your company connects: when your company connects a service such as WhatsApp Business (Meta Platforms Ireland Ltd.), an e-invoicing provider (e.g. Paraşüt) or its own mail server, the relevant quote, order and customer data is sent to that service only for the task at hand; your company's own agreement with that service applies.
  • Push notifications: when you turn on notifications on a device, they are delivered through your browser's push service (e.g. Google, Apple, Mozilla); the content is end-to-end encrypted.
  • Email delivery: an email service provider for password resets and notification emails.
  • Payments: a licensed payment institution for card payments on paid plans; card details are entered on its page and never reach Teklif Atölyesi.
  • Authorities: only where required by law.

International transfers

Because the servers are in Germany and the AI and some connected services (e.g. WhatsApp, push notifications) run in the USA or the EU, your data may be transferred abroad. These transfers rely on the appropriate safeguards provided for in KVKK Art. 9 (standard contracts) and on the standard contractual clauses provided for by the GDPR.

Retention periods

  • Account and content data are kept while your account is open. When you close your account, they are deleted or anonymized within 30 days at the latest; deleted data may remain in backups for up to 30 more days.
  • Invoicing and accounting records are kept for the period required by law (up to 10 years).
  • Security and access logs are kept for up to 2 years.
  • Website form submissions are deleted after 2 years.
  • Demo accounts opened without registration are deleted, with all their data, after 24 hours.

Your rights

Under KVKK Art. 11 and GDPR Arts. 15–22, you have the right to:

  • Find out whether your personal data is processed and, if so, request information about it.
  • Learn the purpose of the processing and whether the data is used for that purpose, and know the recipients it is transferred to.
  • Have incomplete or inaccurate data corrected, and have data deleted when the conditions are met.
  • Ask for processing to be restricted and object to processing.
  • Receive your data in a commonly used format (data portability).
  • Withdraw your consent where processing is based on consent.
  • Claim compensation if you suffer damage from unlawful processing, and lodge a complaint with the Turkish Personal Data Protection Board or a supervisory authority in the EU.

How to make a request

Send your request to merhaba@teklifatolyesi.com with enough information for us to verify your identity. We'll respond free of charge within 30 days at the latest; if handling the request involves an additional cost, a fee may be charged according to the tariff set by the Board.

Security

Company data is isolated, connections are encrypted, passwords are hashed with Argon2, and cost and margin data is never sent from the server to users without permission. Details are on the Security page.

Cookies

We use cookies that are strictly necessary for the service to work. On the marketing site, Google Analytics cookies are additionally set only if you consent. Details are in the cookie policy.

Changes

If we make a material change to this notice, we'll let you know by email or in the app. The current version is always on this page.

Questions about this document? Write to merhaba@teklifatolyesi.com.