Privacy

This notice has been prepared in accordance with Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) to inform you about your personal data processed when you use İskeleAI.

The data controller is YAC Yazılım (Istanbul). For any question or request about this notice: info@ccyazilimmedya.com.

You sign in to the application with your email address and password. Your account holds your name, your email address and the company you belong to. Your password is not stored anywhere in plain text: only a one-way hash of it is kept. The password itself cannot be recovered from this hash; we cannot see your password either. When sign-in with a Google account is enabled, only three items of information are received from Google: your name, email address and profile photo URL.

Every sign-in attempt, successful or not, leaves a sign-in record: the time, the account’s email address, the sign-in method, the result, the IP address the connection came from, the approximate location derived from that address (country and city), the browser and operating system, and your browser’s device identifier.

In addition, the work data you create while using the application is stored: the drawing files you upload, the building outlines you draw, projects and client names, scaffold designs, structural calculations, quotation parameters and your company details. Actions such as downloading a report, creating a share link, importing a drawing and using the assistant are also recorded with their date. Your drawing files may also carry information written on them, such as names and addresses.

Someone who receives a report you have shared can send a response to it: suggested quantities, a note and, optionally, contact information. This response is passed on to the company that created the link.

• From you: the sign-in form, the account and company pages, the files you upload and anything you type into the application.
• Automatically: the IP address our server sees when you sign in and the information your browser sends to identify itself; the device cookie.
• From Google: the three items of information above, only when you sign in with a Google account.
• From your company: if your account was opened by our product team, your name and email address are information your company has provided to us.

Your name and email address are used only to verify your identity and to show your work as belonging to you. They are not used for marketing, not sold to third parties and not shared with advertising networks. The application has no tracking (analytics) cookies.

The sign-in record is kept for the security of your account: it allows us to notice an unauthorised sign-in or an account being shared between several people, to limit the number of places in which an account can be signed in at the same time, and to show you on which devices you are signed in. You can see your connected devices on your account page and end any sign-in you do not want from there.

Your work data is processed to produce the scaffold design, the structural calculation, the report and the quotation, that is, for the service itself.

We process this data on the legal grounds of the establishment and performance of the service relationship with you or your company (KVKK Art. 5(2)(c)) and our legitimate interest in ensuring the security of the service and of accounts (KVKK Art. 5(2)(f)).

The application uses only two cookies; both are used for the application to work and for security:

• Sign-in cookie: remembers that you are signed in. It is deleted when you choose “Sign out”.
• Device cookie (iskeleai_cihaz): recognises this browser between sign-ins, so that signing in again from the same browser does not count as a new device and your list of connected devices stays accurate. Its purpose is security, not tracking: it is not used for advertising or analytics and is not shared with other sites. The database stores a one-way hash of the identifier, not the identifier itself. A private window or a different browser counts as a new device.

The IP address is the address from which your connection reaches our server; our server sees it directly. The approximate location is derived from this address using an offline database on our own server: your IP address is not sent to any external service to determine a location. If no location can be derived, it is left empty. The location is approximate; it does not show your address or the place where you are.

IP Geolocation by DB-IP (CC BY 4.0)

Your work data is visible only to the users of your own company. We do not sell your data to anyone. Apart from this, others can access your data only in the following cases:

• Share links you create: the person you send the link to sees a snapshot of the report taken at that moment. The link is closed to search engines and can be revoked.
• Authorised members of our product team: they see sign-in records and usage figures per company in order to manage accounts and ensure security. To resolve a problem for you, they can look at your projects through support view. Support view is read-only: it cannot change, save or delete anything in your projects. A support view stays open for at most one hour, and each opening is recorded, together with who opened it and when.
• AI service providers: within the limits described in the section below.
• Google: when you sign in with a Google account, identity verification is carried out through Google; Google’s own privacy policy applies to that step.
• Competent authorities: only where required by law and to the extent requested.

Some features of the application use AI services located abroad. Your name, email address and company information are not sent to these services. Structural calculations and quantities of materials are not produced by AI; the engine calculates them.

• Assistant (Anthropic, USA): the geometry of the design you are working on and the messages you write to the assistant are sent.
• Drawing reading and outline assistance: Jev (via Vercel AI Gateway) or Claude (Anthropic, USA), whichever is selected in your settings. If Jev is selected, only short pieces of text from the drawing are sent: drawing titles and layer names. If Claude is selected, an image of the drawing may also be sent. If a name or address is written on your drawing, it may appear in this text or image.

If these features are switched off or you do not use them, the transfer described in this section does not take place.

• Sign-in information: your sign-in expires 30 days after it was last used, and at the latest 90 days after you first signed in. It ends immediately when you choose “Sign out”; the record of ended sign-ins is deleted after 30 days.
• Sign-in records and activity records: 12 months. Older records are deleted automatically. Even if your account is deleted, these records remain, together with your email address, until their own retention period expires.
• Account record: kept for as long as your account is open; deleted when your access is removed.
• Projects: kept until your company deletes them or the company’s account is closed.
• Drawing and design files: working files not saved to a project are deleted automatically after 7 days.
• Share links and their responses: for the period you choose when creating the link, up to 30 days. When a link expires, its copy of the report is deleted together with the responses received; you can revoke a link at any time.

Under Article 11 of the KVKK, you can exercise the following rights by applying to the data controller:

• to learn whether your personal data is processed and, if it is, to request information about it;
• to learn the purpose of the processing and whether the data is used in line with that purpose;
• to know the third parties to whom it is transferred, domestically or abroad;
• to request its rectification if it has been processed incompletely or incorrectly;
• to request its erasure or destruction under the conditions set out in Article 7 of the KVKK;
• to request that rectification, erasure and destruction be notified to the third parties to whom the data has been transferred;
• to object to a result to your detriment arising from the analysis of the data exclusively by automated systems;
• to request compensation for damage you suffer as a result of the unlawful processing of the data.

You can send your request to info@ccyazilimmedya.com from the email address registered to your account. Your request will be concluded within 30 days at the latest.