Privacy Notice
Applies to users in the EU/EEA and outside Türkiye. Users in Türkiye: see the KVKK Aydınlatma Metni.
This notice explains how Adacraft processes personal data when you create an account and use the Adacraft workspace (Article 13 of the EU General Data Protection Regulation, "GDPR").
1. Who is responsible
- Controller: [Adacraft legal entity name, registered address and company number — TBD]
- Contact for privacy questions: privacy@adacraft.io [Draft — pending legal approval]
- EU representative (GDPR Art. 27): [to be appointed or exemption documented — TBD]
- We have not appointed a data protection officer.
Adacraft is the controller for your account, sign-in, consent, security and billing data. For the content you and your team put into a workspace (app information, texts, screenshots, videos), Adacraft acts as a processor on behalf of the business that owns the workspace, under our Data Processing Agreement (see the DPA page). If you use Adacraft for yourself, you are that business.
2. What we process
| Category | Examples |
|---|---|
| Account data | name, e-mail address, password hash, Google account identifier if you sign in with Google |
| Security and session data | IP address, browser (user agent), session times |
| Consent records | which notice or consent you accepted, its version, your jurisdiction (TR / EU / other), when you gave or withdrew it, IP and browser at that moment |
| Workspace content | app names, store links, descriptions, briefs, keywords, store texts, screenshots, screen recordings, generated images and videos |
| AI requests and results | the inputs sent to our AI providers for a feature you start, and the generated drafts |
| Usage and billing data | plan, credit balance and history, jobs you started |
We do not ask for special categories of data (Art. 9 GDPR). Please do not upload such data into the workspace.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and run your account, provide the workspace and its features, including AI generation you request | Performance of a contract, Art. 6(1)(b) |
| Send your inputs to AI providers to generate drafts (see section 7 and the AI Transparency page) | Performance of a contract, Art. 6(1)(b); you acknowledge the AI processing notice before the first AI feature |
| Keep the service secure, prevent abuse, debug errors | Legitimate interests, Art. 6(1)(f) (secure and reliable service) |
| Record which notices and consents you accepted | Legal obligation / accountability, Art. 6(1)(c) and Art. 7(1) |
| Plans, credits and, later, payments and invoices | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) for accounting records |
| Product news by e-mail (only if you opt in) | Consent, Art. 6(1)(a) — withdraw at any time in Settings |
Providing account data is necessary to conclude the contract; without it we cannot open an account.
4. Automated decisions
Adacraft does not make decisions about you that produce legal or similarly significant effects based solely on automated processing (Art. 22 GDPR). The AI features generate marketing drafts for your app; you decide what to use.
5. Recipients
- Sub-processors that host the service or perform AI processing for us — see the Sub-processors page for names, purposes and locations.
- Google, only if you choose "Continue with Google" (Google acts as an independent controller for the sign-in).
- Apple App Store and Google Play public pages are read when you import your app; we do not send your personal data to them.
- Authorities, where we are legally required to disclose data.
We do not sell personal data and do not use your workspace content for advertising.
6. International transfers
Our AI providers (Anthropic PBC, United States; fal.ai, United States, for AI video when available) process data outside the EU/EEA. Transfers rely on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) and, where the recipient is certified, the EU–US Data Privacy Framework. [Verify each provider's DPA, SCC module and DPF certification status — TBD.] You can request a copy of the safeguards using the contact above.
7. AI processing
When you start an AI feature (brief, keyword research, store texts, SEO/GEO kit, GEO visibility check, screenshot captions, video script, full launch kit), the app information, texts and images you selected for that feature are sent to the AI provider and the result is stored in your workspace. Our providers' commercial terms do not allow them to train their models on this data [verify against current provider terms — TBD]. Details: AI Transparency page.
8. How long we keep data
- Account, consent records and workspace content: until you delete the account or the workspace is deleted.
- Session records: sessions expire after 7 days of inactivity; records are deleted with the account.
- Temporary download links: 15 minutes (upload) and 60 minutes (download).
- Payment and accounting records (when payments start): as long as tax and accounting law requires [period — TBD].
The full retention schedule, including periods we still have to shorten, is maintained by Adacraft and available on request.
9. Your rights
You have the right to access (Art. 15), rectify (Art. 16), erase (Art. 17) and port (Art. 20) your data, to restrict processing (Art. 18), to object to processing based on legitimate interests (Art. 21) and to withdraw consent at any time without affecting earlier processing (Art. 7(3)).
- Copy of your data: Settings → "Download my personal data" (machine-readable JSON in a ZIP).
- Delete your account: Settings → "Delete account permanently".
- Withdraw consents / AI acknowledgement: Settings → Consents. If you withdraw the AI processing acknowledgement, AI features stop until you acknowledge it again; other features keep working.
- Any other request: write to the contact in section 1. We answer within one month (Art. 12(3)).
You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state where you live or work.
10. Cookies and local storage
Adacraft uses only strictly necessary storage: a sign-in session cookie and browser local storage for your theme choice and the list of jobs you are following. We use no analytics or advertising cookies, so no cookie consent banner is shown. If this changes, we will ask for consent first.
11. Changes
When this notice changes in a way that matters, we publish a new version and, where required, ask you to acknowledge it again.