Privacy Policy and KVKK Disclosure Notice

1. Data controller

Data controller: Strufy (Bursa, Türkiye); e-mail: info@strufy.com. This notice is for platform users who create a Strufy account. For visitors and members of sites built with Strufy, see section 8.

2. What data we process

Account: e-mail address, an irreversible hash of your password (argon2id), the time your e-mail was verified.

Session: signed session token, creation and last-seen time, the IP address and browser the session was opened from.

Two-factor authentication (if enabled): encrypted authentication key and encrypted backup codes.

Explicit consent record: when you gave consent to transfer abroad and the version of the consent text.

Activity records: action, time and IP address for critical operations such as publishing, rollback, project deletion, API key creation and domain connection.

Chat and projects: messages you write to the AI, the model's replies, your site's source files, your tables and their records, and the images you upload.

Payments: for plan and credit purchases, the order ID, product, amount and payment status sent by Creem; your card details never reach Strufy.

Credit movements, support requests (e-mail, subject, text) and the domains you connect.

Server logs: IP address, request path and time (30 days).

3. Purposes and legal grounds

Creating your account, building and publishing your site, calculating your credit balance and providing support: formation and performance of the contract (KVKK Art. 5/2-c).

Preventing account takeover, abuse and attacks; enforcing rate limits; keeping an activity trail: legitimate interest (Art. 5/2-f) and legal obligation (Art. 5/2-ç).

We do not send marketing communications; if we ever do, it will be only with your explicit consent (Art. 5/1).

4. AI processing

Your chat messages, the project files the model reads through its tools and the content of your public tables are sent to Google Cloud Vertex AI (Google LLC) to generate the site. The model can read data in tables you mark as private, but a server-side gate prevents that data from being copied into public files or tables.

This service processes data abroad; the transfer relies on the explicit consent you give separately at sign-up under KVKK Art. 9. Under its contract terms, Google Cloud does not use customer data sent to Vertex AI to train models without your permission.

5. Who we share data with

AI: Google Cloud Vertex AI (Google LLC, USA) — see section 4.

Server hosting: the platform's server is in OVH's data centre in Germany (Frankfurt).

Image storage: the images you upload are kept in Hetzner's object storage in Finland (Helsinki).

Backups: kept encrypted on Google Drive (Google LLC); the encryption key is not stored with that service.

Network and domains: the platform and sites are served through Cloudflare (USA, global network); the domains you connect and their verification records are also passed to Cloudflare's infrastructure.

E-mail delivery: verification, password reset, build failure and support e-mails are sent through Resend (USA); the recipient address and message content are passed to that provider.

Payments: plan and credit purchases are made through Creem; as Merchant of Record, Creem processes your payment and billing details under its own privacy policy.

Password breach check: at sign-up, only the first 5 characters of the SHA-1 hash of your password are sent to the Have I Been Pwned service; neither your password nor its full hash is sent.

Image search: search queries generated by the AI are sent to the Pexels service.

Competent judicial and administrative authorities: only upon a legal request and to the extent the law permits.

Your data is never shared with anyone or sold for advertising or marketing.

6. How long we keep data

Panel session: at most 14 days; a session unused for 7 days expires.

Server logs: 30 days.

Chat history, project sources, tables and images: until the project or account is deleted; everything is removed on deletion.

Activity records (publishing, deletion, keys, domains): kept in a form that cannot be altered and retained for 2 years after the account is deleted (legal defence and audit).

Credit and payment records: 10 years, as required by tax and commercial law.

Backups: deleted after 90 days at the latest; a deleted project or account is removed from the backups within that period.

Account deletion: immediate, from the panel.

7. How we protect data

Passwords are stored with argon2id. Session cookies are signed; the session record in the database is not enough on its own to sign in. Two-factor authentication keys are stored encrypted. Each project's data lives in a separate database schema and is processed by a restricted role that can see only that schema. Site code is built in an environment isolated from the network that contains no secret keys; published sites are restricted so they cannot send visitor data to outside addresses. Provider keys are stored encrypted. Backups are encrypted and restores are tested regularly.

8. Visitors and members of sites

If you visit or sign up to a site built with Strufy, the site's owner is the controller of your data; Strufy acts as a data processor and only on the site owner's instructions.

Data processed in this context: your form submissions (the fields defined by the site owner), your membership e-mail, a hash of your password and your session token (30 days), your IP address for rate limiting (at most 1 hour) and server logs (30 days).

To exercise your rights, contact the site owner first; Strufy does not read, change or pass this data to third parties without the site owner's request. The site owner is responsible for informing visitors and obtaining any required consent.

9. Cookies

Only cookies strictly necessary for the service to work are used; there are no analytics or advertising cookies. Details are on the Cookie Policy page.

10. Your rights and how to apply

Under KVKK Art. 11 you have the right to learn whether your data is processed, to request information if it is, to learn whether it is used for its intended purpose, to know the third parties it is transferred to, to request correction if it is incomplete or inaccurate, to request its deletion or destruction where the conditions are met, to request that these actions be notified to the third parties it was transferred to, to object to a result against you arising from analysis by automated systems, and to claim compensation for your damages. You can withdraw your explicit consent to transfer abroad at any time; however, because the AI service cannot be provided without that transfer, withdrawing consent means closing the account.

Send your requests to info@strufy.com; they are answered free of charge within 30 days at the latest. If you are not satisfied with the outcome, you can complain to the Turkish Personal Data Protection Board.

11. Changes

This notice is updated when the data we process or the parties we share it with change; the current version is published on this page and significant changes are notified to your registered e-mail address.

Service Provider

Strufy · Bursa, Türkiye · info@strufy.com