Privacy Policy

Last updated: 7 October 2026

This text explains which data is processed, and for which purposes, when you use the Ahşapmetrik app and the services under the ahsapmetrik.com domain (the "Service"). The Service is operated in line with the obligations of Turkish Personal Data Protection Law no. 6698 (KVKK).

Data controller: X Ahşap Limited Şirketi — Fabrikayanı Mevkii, Fabrikayanı Küme Evler No: 142, Zafer Köyü, Ulus / Bartın. Contact: destek@ahsapmetrik.com, contact page.

Data collected

• Account information: first and last name, e-mail address and password (passwords are stored as irreversible hashes).
• Sign in with Google: if you choose it, the name and e-mail address of your Google account are received; your Google password is never sent to the Service.
• Sign in with Apple: if you choose it, the e-mail address of your Apple Account (and your name, if you choose to share it) is received; your Apple password is never sent to the Service. If you choose "Hide My Email", the relay address generated by Apple is used and your real address never reaches us.
• Company data: the business records your company enters into the Service (stock, auctions, shipments, customers, quotes and the like). This data belongs to your company and is seen only by your company's authorised users.
• Technical records: error and access logs (including IP address) are kept for a limited time for the security of the service and for fault diagnosis.
• In-app usage records: which screens are opened in the app, taps on certain buttons, form error codes, and which step of sign-up and payment was reached. These records are kept under a randomly generated installation identifier specific to your device; once you sign in they are associated with your company and your user account. This also covers records created on the same device before you signed in. When you first open the web app, only the domain name of the site that brought you here, the campaign tags in the link, and the country code from your device's region setting are also written to these records; the full address of the page you came from is not. The content you type into the app (name, e-mail, measurements, amounts and the like) and your IP address are not included in these records; the country is not derived from your IP address.
• Site visit records: which pages of this site are opened, which links and buttons are clicked (and in which part of the page), how long a page is viewed, how far it is scrolled, and whether a form was submitted. They are kept on our own servers under a randomly generated identifier specific to your browser. Only the domain name of the site that brought you here, the campaign tags in the link, and the country code from your browser's language setting are also written. The content you type into forms and your IP address are not included in these records. If your browser sends a "Global Privacy Control" signal, no such record is kept.
• "Request a call" form: if you fill in the form on the site, your full name, phone number and (if given) company name and note. They are used only to call you, are forwarded to our team by e-mail, and are deleted whenever you ask.

Purposes of processing

• Creating the account, authentication and session management
• Providing the Service: storing and processing company data
• Mandatory notifications (e.g. invitations, password reset, subscription reminders) — no marketing e-mail is sent
• Security: preventing abuse and diagnosing faults
• Improving the product: reviewing in-app usage records to see at which step of the app people struggle — these records are not used for advertising
• Promoting the site: reviewing site visit records and aggregate visit statistics to see which pages draw interest and which channels visitors come from

Protection of data

• All traffic is encrypted with TLS.
• Fields containing personal data are stored encrypted in the database; company data is isolated per tenant.
• Data is hosted on servers in the European Union region.

Third parties

Data is not sold and is not shared for advertising. The infrastructure providers with which limited sharing takes place so that the Service can run:

• Google Firebase — authentication (Sign in with Google and Sign in with Apple) and mobile notifications
• Hosting provider — operation of the servers (EU region)
• E-mail provider — delivery of mandatory notification e-mails
• Cloudflare Web Analytics — aggregate visit statistics for this site (page views, country, referring site, browser and device type). It uses no cookies and keeps no identifier that recognises you; it processes the connection's IP address to determine the country. It runs only on this site, not in the app.

In-app usage records and site visit records are kept only on our own servers; they are not sent to any analytics or advertising service and are not shared with third parties.

Cookies and local storage

There are no advertising or tracking cookies. Only the technical records needed to keep your session, and the random installation identifier described above, are stored on your device; this identifier is not shared with other apps or sites and is not used to track you there.

The measurement list you build on the m³ calculator page stays in your own browser (local storage); it is not sent to us and we cannot see it. Clearing your browser data clears the list too.

For site visit records, a random identifier and the visit's sequence information are kept in your browser's local storage; this is not a cookie and is not shared with other sites. Clearing your browser data removes it too.

Retention and deletion

Account data is kept for as long as the account remains open. When you choose "Delete my account" inside the app the account is DELETED: your name, e-mail address and other personal fields are irreversibly anonymised, your session is closed on every device, and that account can no longer sign in. Records subject to a statutory retention obligation are kept without information identifying you. Technical records, in-app usage records and site visit records are kept for at most 90 days; a record is deleted once that period ends.

Your rights

Under article 11 of the KVKK you have the right to access your data, to request its correction or deletion, and to object to processing. For such requests you can write to the contact address below.

Contact

For privacy questions and requests: destek@ahsapmetrik.com