Starter template — pending legal review. This text is a placeholder created to enable testing and must be reviewed and approved by counsel / your DPO before production use.
_Last updated: 12 July 2026 → v2 (draft)
1. Who we are
Forganise (the "Service") is operated by SAPCON ("we", "us"), established in the Republic of Türkiye. For your account data we act as the data controller (KVKK: veri sorumlusu). For the content you and your workspace store in the Service, we act as a data processor on behalf of your workspace.
Contact for privacy matters: privacy@sapcon.com.tr / kvkk@sapcon.com.tr.
2. Data we process
- Account data: name, email, phone (optional), avatar, timezone, language.
- Authentication & security: login events, session device, IP address and approximate location (only if you enable it).
- Billing: plan, currency and billing identifiers (card data is handled by our payment processor, not stored by us).
- Content: the data you enter into modules (projects, CRM, tickets, files). Vault secrets are end-to-end encrypted — we cannot read them.
- Usage & logs: audit records of actions taken in your account.
3. Purposes & legal bases
| Purpose | Legal basis (GDPR) | Legal basis (KVKK) |
|---|---|---|
| Provide and operate the Service | Contract (Art. 6/1-b) | Sözleşmenin kurulması/ifası |
| Security, fraud & abuse prevention | Legitimate interests (Art. 6/1-f) | Meşru menfaat |
| Billing & legal/tax obligations | Legal obligation (Art. 6/1-c) | Hukuki yükümlülük |
| Optional features (e.g. session location) | Consent (Art. 6/1-a) | Açık rıza |
4. Your rights
Depending on where you are, you may have the right to access, correct, delete, restrict or object to processing, and to data portability. You can exercise most of these in-app (Account settings), or contact privacy@sapcon.com.tr. We respond within 30 days (KVKK) / one month (GDPR).
4.1 Türkiye (KVKK — Aydınlatma / rights under Art. 11)
If you are in Türkiye, the data controller is SAPCON. You may apply to us in writing or via registered electronic means (KEP) to learn whether your data is processed, request correction or erasure, and object to results produced solely by automated analysis.
4.2 EEA / UK (GDPR)
If you are in the EEA or UK, you have the rights in this section and may lodge a complaint with your local supervisory authority.
4.3 California (CCPA/CPRA)
If you are a California resident, you may request access to and deletion of your personal information and opt out of any "sale" or "sharing". We do not sell personal information.
5. Sub-processors
We use vetted service providers to run the Service, including: Supabase (database & auth, EU), Vercel (hosting, EU region), Cloudflare R2 (file storage), Resend (transactional email), Stripe (payments), and Upstash (rate limiting). A current list is available on request.
6. International transfers
Our primary data stores are hosted in the EU (Frankfurt). Some providers (e.g. email, payments) may process data outside Türkiye/the EEA under appropriate safeguards (KVKK Art. 9 mechanisms / GDPR standard contractual clauses).
7. Retention
We keep personal data for as long as your account is active and as required for the purposes above or by law. When you delete your account, we anonymize or delete your personal data, subject to limited records we must keep for legal reasons.
8. Security
We use encryption in transit and at rest, zero-knowledge encryption for Vault secrets, access controls and audit logging. No system is perfectly secure, but we work to protect your data.
9. Children
The Service is not directed at children under 16 and we do not knowingly collect their data.
10. Changes
We may update this notice. When a change is material, we will ask you to re-acknowledge it.
11. Contact
SAPCON — privacy@sapcon.com.tr / kvkk@sapcon.com.tr
What changed in this version (v2)
This version refines the data-retention and contact sections. Draft — pending legal review.