15 item(s) on this page are marked [PLACEHOLDER] and still need to be confirmed by the operator.
1. Who is responsible
- The controller of your personal data is [PLACEHOLDER — confirm: company legal name], [PLACEHOLDER — confirm: registered address], [PLACEHOLDER — confirm: country of registration] ("we").
- Privacy contact: [PLACEHOLDER — confirm: privacy / data-protection contact e-mail]. EU representative: [PLACEHOLDER — confirm: EU representative under GDPR Art. 27, if required].
- This policy follows the Turkish Law on the Protection of Personal Data No. 6698 (KVKK) and, for users in the European Union or the European Economic Area, the General Data Protection Regulation (EU) 2016/679 (GDPR).
2. What this policy covers
It covers this website and the two tools on it: MADETOOL (aircraft preliminary design) and MASETOOL (AI model training).
3. What we collect
| Kind of data | What it includes | Where it comes from |
|---|---|---|
| Account | Name, e-mail address, password (stored only as a scrypt hash), the identifier of the sign-in provider you chose (Google, Microsoft, Apple or Facebook), your role | You, or the sign-in provider |
| Sign-in sessions | A session record with its creation time, expiry and your browser's user-agent text; a session cookie | Your browser |
| Student applications | Institution, country, programme, level, expected graduation, school e-mail and, only when needed, a proof document | You |
| MADETOOL projects | Requirements text and form values, PRD versions, the data files you attach, run records, solver logs and output files (report, CSV and MAT files) | You and the Service |
| MASETOOL training | Training requests (PRD), uploaded images and label files, upload check reports, job records (state, times, failure reasons), trained models, reports, metrics and download events | You and the Service |
| Billing | Plan, subscription status, the payment provider's customer and subscription references, checkout records | You and Stripe |
| Contact messages | What you send through the contact form | You |
| Consent records | Your cookie choices and your acceptance of the Terms and Refund Policy at checkout, with the time and document version | You |
| Security and technical data | IP address (used for rate limiting), structured event logs without passwords, tokens or document contents (e-mail addresses are masked), an audit log of security, billing and administrative actions | Your browser and the Service |
We never receive or store card numbers. If iyzico is used for payment, the identity number and phone number iyzico requires are sent to iyzico and are not stored by us.
4. Images that may contain personal data
- Images you upload to MASETOOL may show people, vehicles or property. You are responsible for collecting them lawfully and for having a legal basis and the rights needed to use them for training.
- We process uploaded images only to train and evaluate your own model, as instructed by you. For this data we act on your behalf. [PLACEHOLDER — lawyer to confirm: controller/processor roles and a data processing agreement for business customers]
- MASETOOL is not used to identify people. Classes for people, faces and licence plates are refused.
5. Why we use your data and on what legal basis
| Purpose | GDPR legal basis | KVKK basis |
|---|---|---|
| Running your account and the Service: designs, training, delivering results, service e-mails | Contract (Art. 6(1)(b)) | Art. 5(2)(c), performance of a contract |
| Checking student eligibility | Contract (Art. 6(1)(b)) | Art. 5(2)(c) |
| Billing, invoices and tax records | Legal obligation (Art. 6(1)(c)) and contract | Art. 5(2)(ç) legal obligation and 5(2)(c) |
| Security, rate limiting, abuse prevention and audit logs | Legitimate interests (Art. 6(1)(f)) | Art. 5(2)(f), legitimate interest |
| Drafting requirements with AI, when you choose that option | Contract (Art. 6(1)(b)) | Art. 5(2)(c) |
| Recording cookie choices and acceptance of our terms | Legal obligation (Art. 6(1)(c)) | Art. 5(2)(ç) |
We do not sell personal data, we show no advertising and we make no decisions with legal effects based only on automated processing.
6. Who receives your data
| Recipient | Why | Data |
|---|---|---|
| Hosting: [PLACEHOLDER — confirm: hosting provider of the website and of MASETOOL] | Runs the website and the training server | All data in section 3 |
| E-mail delivery: [PLACEHOLDER — confirm: e-mail delivery provider] | Sends sign-in, verification and service e-mails | Name, e-mail address, message content |
| Stripe | Takes payments and manages subscriptions | E-mail address, plan, payment and subscription data |
| Google, Microsoft, Apple, Facebook | Only if you choose to sign in with them | Sign-in data exchanged with that provider |
| Anthropic (AI provider) | Only when AI drafting is enabled and you choose it | The requirements text you submit for drafting |
| Public authorities | Only when the law requires it | What the request lawfully covers |
Locations and transfer safeguards: [PLACEHOLDER — confirm: countries of the e-mail provider, Stripe, the sign-in providers and the AI provider; transfer safeguards].
7. Where your data is stored
[PLACEHOLDER — confirm: country / region where data is stored]
8. How long we keep it
Website
| Data | Kept for |
|---|---|
| Sign-in sessions | 30 days, or until you sign out |
| E-mail confirmation and reset links | Deleted 7 days after they expire |
| Student proof documents | Deleted 30 days after the review decision |
| Rejected or withdrawn student applications | Personal fields removed after 365 days |
| Rate-limit records (contain IP addresses) | 24 hours |
| Accounts, MADETOOL projects, runs and output files, billing records, website audit log, consent records | [PLACEHOLDER — confirm: retention of accounts, MADETOOL projects, runs and output files, billing records and the website audit log after account closure] |
MASETOOL training server
| Data | Kept for |
|---|---|
| Training intermediates of a finished job | 7 days |
| Resume points | 14 days |
| Partial files of failed or cancelled jobs | 14 days |
| Training logs and training settings | 30 days |
| Model package, report and metrics | 180 days after the job finished, or less if you delete the run |
| Raw upload folder after a successful check | 1 day |
| Rejected uploads | 7 days |
| Uploads that failed on our side | 7 days |
| Your checked uploads | Until you delete them, or 30 days after your training account is closed |
| Training server audit log | 730 days |
Billing records are kept as long as tax and commercial law require.
9. How we protect your data
- Passwords are stored only as scrypt hashes. Session tokens are stored only as hashes.
- Your training-server access token is encrypted (AES-256-GCM) on the website and stored only as a hash on the training server.
- Download links are signed and expire after 10 minutes; files are streamed through our server and are never public.
- Each customer's files are kept in a separate storage area. Your uploads are never used for another customer. Uploaded files are never executed.
- Cross-site form submissions are refused, sign-in and sign-up are rate limited, and administrator actions are logged. The training server's audit log cannot be edited.
- No system is perfectly secure. If a breach affects your data, we tell you and the authorities as the law requires.
10. Your rights
- You can ask us to: give you access to your data, correct it, delete it, restrict or object to its use, send it to you or another provider in a portable format, and withdraw any consent you gave.
- Under KVKK (Article 11) you can also learn whether and why your data is processed, who receives it, and ask for compensation for unlawful processing.
- Write to [PLACEHOLDER — confirm: privacy / data-protection contact e-mail]. We may ask you to prove your identity. We answer within [PLACEHOLDER — confirm: e.g. 30 days].
- You can change your name and password in your account and delete finished MASETOOL runs yourself. Account closure and data export are handled by e-mail.
- We may have to keep some data (for example billing records) when the law requires it.
11. Children
The Service is not for anyone under 18. We do not knowingly collect their data.
12. Complaints
Please contact us first. You can also complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu). Users in the EU/EEA may also complain to the data-protection authority of their country.
13. Changes to this policy
Each version shows its number and date. We tell you about important changes by e-mail or in your account before they apply.