Privacy notice

Last updated: 29 September 2026

This notice explains how your personal data is processed when you use OpenCAD (this site). It is the information notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”); the Turkish version is authoritative.

1. Data controller

The data controller is Erdem Canaz. For any privacy question or request: erdemcanaz@virtue24.tech.

2. What we process

• Identity and contact: your e-mail address and (if you entered one) your name.
• Account security: a one-way hash of your password (never the password itself), hashes of session and access tokens, when the account was created and last seen, its role and status.
• Security of the service: your IP address — only a hash of it, kept 24 hours, for abuse limits; the reverse proxy in front of the server logs IP address, time, requested address and browser.
• Your content: your designs and their names, chat messages and attached images, app settings and the AI API keys you enter (stored for your account only, never sent back to the browser).
• Cookies: only the strictly necessary session cookie (opencad_session). No analytics, advertising or tracking cookies. Interface preferences (language, theme) stay in your browser’s local storage.

3. Purposes and legal bases

To create your account and authenticate you, to provide the service (store, edit and export your designs, and let you work with AI tools if you choose), to enforce the storage quota, to keep the service secure and prevent abuse, and to answer your requests and meet legal obligations — based on the performance of our contract with you, legal obligations, the establishment or protection of rights, and our legitimate interest in a secure service (KVKK Art. 5/2 c, ç, e, f). The data is collected electronically from you when you sign up and use the site.

4. Transfers

• Hosting and transfer abroad: all account and content data is stored on servers of Hostinger International Ltd., Frankfurt (Almanya). The server is outside Turkey, so this is a transfer of personal data abroad (KVKK Art. 9). The provider processes the data only to host the service.
• AI providers: if you use the built-in assistant with your own API key, your messages, attached images and information about your design are sent, at your request and through your own account there, to the provider you chose (e.g. Anthropic or OpenAI, usually in the USA); their terms apply. If you connect your own AI agent (MCP), it reaches your designs with your access token; how it processes them depends on that agent’s provider.
• Authorities: only where the law requires it.

We do not sell your personal data, use it for advertising, or share it for marketing.

5. Retention

• Account and content data is kept while your account exists. Deleting your account (My account → Delete account) removes the account, designs, chats and access tokens at once.
• Deleted designs stay in the trash for 30 days; exported files are removed after 7 days.
• Sessions end after 30 days without use. IP hashes: 24 hours; reverse-proxy access logs: up to 5 weeks; error logs: up to 10 weeks.

6. Your rights (KVKK Art. 11)

You may ask whether your data is processed and for information about it, its purpose and the third parties it is transferred to; ask for correction or deletion; ask that third parties be informed of corrections or deletions; object to outcomes against you from solely automated analysis; and claim compensation for damage from unlawful processing. Send requests to erdemcanaz@virtue24.tech, preferably from your account’s e-mail address so we can verify you; they are answered free of charge within 30 days. You may complain to the Turkish Personal Data Protection Board (KVKK Kurulu). You can also act yourself: File → Download all designs exports everything, and My account lets you revoke access tokens and delete the account.

7. Security

Connections use HTTPS. Passwords are stored as one-way hashes (scrypt). Each account’s data is kept apart from other accounts. Only hashes of session and access tokens are stored.

8. Changes

We may update this notice; the current version is always on this page, with its date above.