Last updated: 2026-10-30
This Policy explains how Craft handles personal data. It is our information notice under Art. 10 of Turkish Law No. 6698 ("KVKK") and, where the EU or UK GDPR applies, under Art. 13 GDPR. It is published in Turkish and English; for users in Türkiye the Turkish text prevails in case of conflict, for everyone else the English text prevails.
1. Data controller
Ali Ravza Barlak, sole proprietorship, trading as Craft ("Craft", "we"), is the data controller for the Craft AI workspace ("Service").
| Field | Information |
|---|---|
| Controller | Ali Ravza Barlak (sole proprietorship) |
| Tax ID (VKN) | 1421541880 — Karadeniz Tax Office |
| Address | Üniversite Mah. Eskimezarlık Sok. No: 16/16, Ortahisar, Trabzon, Türkiye |
| KEP (registered e-mail) | aliravza.barlak@hs01.kep.tr |
| Data protection requests | gdpr@usecraft.app |
| General contact | info@usecraft.app |
2. Personal data we process
| Category | What |
|---|---|
| Identity and contact | First name, last name, email address; age declaration (18+) |
| Sign-in | Password (stored only as a hash); if you sign in with Google: your Google account ID, name, email and language; if you sign in with Apple: your Apple account ID, email (this may be an Apple relay address that forwards to you) and, on your first Apple sign-in only, your name |
| Account and consents | Account ID, profile image (if you upload one), preferences, the version of the Terms you accepted and of the Privacy Policy you were shown at sign-up, and the date, language and method of acceptance (for example email, or continuing with Google or Apple) |
| Workspaces | Your personal workspace |
| Content | Canvases, chats with the AI, vault items (pasted text and uploaded files), projects, support tickets and feedback reports |
| Usage | Per AI request: model, token counts, number of searches, estimated cost, time and status (not the text of your prompt) |
| Billing | Plan, subscription status and Paddle customer reference. Card and payment details are handled by Paddle; we never see them |
| Security | IP address and browser (user agent) of your sessions; sign-in, sign-up, password and account-change events with time and IP |
| Error diagnostics | When an error occurs: the error message and technical details (browser, operating system, app version, request URL) and user ID, sent to Sentry (§5) |
| Web analytics | The page you visit, the referring site and campaign (utm) tags, country, region and city estimated from your IP address, device type, browser, operating system, screen size, language and a few actions (clicking sign-up, choosing a plan and billing period, opening checkout). Your name, email address, user ID and IP address are not recorded (§8) |
Required data. First name, last name, email address, a password or Google or Apple sign-in, and the 18+ declaration are needed to create an account. Without them we cannot provide the Service.
3. Why we process it, and on what legal basis
| Purpose | KVKK (Art. 5) | GDPR (Art. 6) |
|---|---|---|
| Creating your account and providing the Service (canvases, chat, AI features, vaults, workspaces) | Necessary to conclude or perform the contract (5(2)(c)) | Contract (6(1)(b)) |
| Measuring usage against plan quotas, fair use and rate limits | Contract (5(2)(c)); legitimate interest (5(2)(f)) | Contract; legitimate interests (6(1)(f)) |
| Security, session management, preventing abuse and fraud | Legitimate interest (5(2)(f)); legal obligation (5(2)(ç)) where applicable | Legitimate interests; legal obligation (6(1)(c)) |
| Error tracking to keep the Service reliable and secure (Sentry) | Legitimate interest (5(2)(f)) | Legitimate interests (6(1)(f)) |
| Measuring, as aggregate statistics, how many people visit and how pages and the sign-up and checkout steps are used, to improve the site and the Service (Umami) | Legitimate interest (5(2)(f)) | Legitimate interests (6(1)(f)) |
| Service emails (verification codes, password reset, invitations, account and billing notices) and support | Contract; legitimate interest | Contract; legitimate interests |
| Billing and subscriptions through Paddle | Contract; legal obligation | Contract; legal obligation |
| Recording that you accepted the Terms and were shown this Policy | Legal obligation; establishing a right (5(2)(e)) | Legal obligation; legitimate interests |
| Legal requests and disputes | Legal obligation; establishing, exercising or defending a right (5(2)(e)) | Legal obligation; legitimate interests |
We do not send newsletters or marketing messages, and we use no advertising tools. For web analytics we use only Umami, which runs on our own server and sets no cookies (§8). We do not use this data for advertising, profiling or identifying you, and we do not share it with anyone. Sentry (§5) is used only for error tracking.
Automated decisions. We do not make decisions with legal or similarly significant effects about you solely by automated means. Automatic quota and rate limits only control how much of the Service can be used.
4. AI features and your data
4.1. When you use an AI feature, the text you write and the context the feature needs (for example the open canvas, the chat so far, or vault items the AI reads) are sent to the AI provider that runs the selected model: OpenAI, Google, Anthropic or xAI.
4.2. Some AI features run in the background: chat titles are generated from the start of a chat, and home-screen suggestions are generated from the headings of your recent canvases.
4.3. Web search and research. When the AI searches the web, the search query it writes is sent to Serper; for deep research, the research question is sent to Parallel. These queries may contain words from your request. The AI may also open public web pages from its search results; those websites see a request from Craft's servers, not from you.
4.4. No training. Craft does not use your data to train AI models, and model training on your data is turned off with all four AI providers. Providers may keep request data for a limited period under their own terms, for example to detect abuse.
4.5. AI results are stored in your workspace like any other Content.
5. Service providers and international transfers
We share personal data only with the following providers and only as far as needed to run the Service:
| Provider | What they do | Location |
|---|---|---|
| Contabo | Server hosting | Germany |
| MongoDB Atlas | Database: account data and all Content, including uploaded vault files | Germany (Frankfurt) |
| Resend (Plus Five Five, Inc.) | Transactional email (verification codes, password resets, invitations, notices) | Sending in the EU (Ireland); account data, email metadata and logs in the US |
| Sentry (Functional Software, Inc.) | Error tracking: error reports, technical data (browser, operating system, app version, request URL) and user ID; email, cookies, passwords/tokens and Content are stripped before sending, IP addresses are not stored | Germany (Frankfurt) |
| Cloudflare | DNS, network security; image storage (R2) | EU storage; global network (Cloudflare, Inc., US) |
| Paddle (Paddle.com Market Limited) | Seller of paid plans: payment, tax, invoices, refunds | United Kingdom |
| Google sign-in (if you use it); AI models (Gemini) | US | |
| Apple | Sign in with Apple (if you use it) | US |
| OpenAI | AI models | US |
| Anthropic | AI models | US |
| xAI | AI models | US |
| Serper | Web search (search query only) | Not stated by the provider |
| Parallel Web Systems | Deep research (research question only) | US |
| Competent authorities | Only where the law requires | Türkiye |
"Image storage" means profile images, project images and screenshots attached to feedback reports.
Web analytics (Umami) runs on our own server at Contabo; analytics data is not sent to any other provider.
Transfers abroad. All providers above except the authorities are outside Türkiye, and several are outside the EU. Data is transferred to them only as far as needed to provide the Service you asked for.
Paddle processes payment and invoicing data as an independent controller under its own privacy policy.
Changes to this list. We update this list when we add or replace a provider and, where possible, announce material changes in the Service or by email before they take effect.
6. How we collect data
Through the sign-up form and Google or Apple sign-in, your use of the Service, cookies, browser storage and web analytics (§8), emails and support requests, and the Paddle checkout.
7. How long we keep data
| Data | How long |
|---|---|
| Account, profile, consents, security records | While your account exists |
| Content in your personal workspace | Until you delete it or close your account |
| Usage records | Kept without your user ID after your account is deleted |
| Accounts whose email was never verified | Deleted after 24 hours |
| Unsent message drafts in your browser | 3 days |
| Traffic records (IP address, time, browser and user ID and email of sign-in, sign-up and sign-out events) | 1 year; kept until then even if you delete your account, then deleted automatically (Turkish Law No. 5651, Art. 5) |
| Server and application logs; Sentry error reports | Short-lived and deleted on a rolling basis; at most 90 days in Sentry |
| Web analytics data | 12 months, then deleted automatically. Aggregate figures that identify no one (for example monthly visitor counts) may be kept longer |
| Billing and invoice records | Statutory periods, mainly kept by Paddle as the seller |
Deleting your account. Close your account in Settings → Security, or email gdpr@usecraft.app from your registered address. Sign-in stops immediately. 30 days later we permanently delete your personal data: your profile, sessions, security records, personal workspace and its Content, and stored images. During those 30 days you can ask us to restore the account. Statutory retention obligations remain.
8. Cookies and browser storage
We use only cookies and browser storage that the Service needs to work. We use no analytics or advertising cookies, so we do not show a cookie banner.
| Name | Purpose | Lifetime |
|---|---|---|
craft_auth_token | Keeps you signed in | 30 days |
craft_session_user | Your user ID for the signed-in session | 7 days |
craft_shell | Your layout settings | 30 days |
craft_last_workspace | Opens the workspace you used last | 30 days |
The Service also keeps unsent message drafts and display preferences in your browser's local storage.
Web analytics (Umami). We use Umami, running on our own server, to count visits to our site and the Service. Umami uses no cookies or browser storage and does not track you on other sites. Your country, region and city are estimated from your IP address using a location database on our server; your IP address is used momentarily for this but is not stored or sent anywhere. To tell visits apart, a one-way code (hash) is made from your IP address and browser details with a secret value that changes every month. This means visits from the same device and browser within one calendar month can be linked to each other; when the month changes, a new code is made that cannot be linked to your visits in earlier months. The code does not reveal who you are; your name, email address and user ID are not sent to Umami. If "Do Not Track" is turned on in your browser, nothing is measured; you can also stop measurement with a content blocker.
The Google and Apple sign-in buttons (on the sign-in and sign-up pages) and the Paddle checkout are loaded from Google, Apple (appleid.cdn-apple.com) and Paddle and may set their own cookies under their own policies.
9. Content about other people
If your Content contains personal data about other people, you are responsible for having the right to use it and for informing them where required. For that data we act on your instructions to provide the Service.
10. Your rights
Under KVKK Art. 11 you may: learn whether your data is processed and request information about it; learn the purpose and whether data is used accordingly; know the third parties in Türkiye or abroad to whom data is transferred; ask for correction; ask for deletion or destruction under Art. 7; ask that correction or deletion be notified to those third parties; object to a result against you arising solely from automated analysis; and claim compensation for unlawful processing.
Under the GDPR (where it applies): access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and complaint to a supervisory authority.
How to apply: email gdpr@usecraft.app from your registered address, or write to us by KEP (aliravza.barlak@hs01.kep.tr) or by post to the address in §1. We answer within 30 days at the latest (KVKK Art. 13). You may also complain to the Turkish Personal Data Protection Board.
11. Changes to this Policy
We may update this Policy. We announce material changes in the Service or by email; the current version is always on this page.