Privacy Policy

We collect the following data when you use the platform:

• Account data: name, email address, company name, password (stored as a one-way hash, never as plain text), language preference, notification preference, time of last sign-in, the date and version of the Terms of Use you accepted, and the site and page you signed up from; if you turn on two-step sign-in, also the secret key shared with your authenticator app (stored encrypted).
• Content you create on the platform: furnace design projects, calculation inputs and results, plant plans, messages, incident and maintenance records, and files you upload. These are stored in our database and file storage.
• Usage records: a record of actions such as signing in, running a calculation and creating a project; failed sign-in attempts are recorded together with the IP address they came from.
• Page-visit statistics: the path of the page visited, the time spent on it, which of our sites (its domain) was visited and, if you came from another site, that site’s domain only (not the full address). See our Cookie Policy for details.
• Contact and quote forms: name, email, phone, company and your message. The contact form can be sent without an account.
• Data protection requests: full name, Turkish ID number or passport number (stored encrypted), postal address, registered e-mail (KEP) address, phone, email and the IP address the application was sent from.
• Supplier accounts additionally provide a company name and contact details.

Error and speed records: when an error occurs on the platform — in your browser or on our server — we record the error message and where in the code it occurred, the address of the open page (without its query part), the last steps before the error (pages opened, buttons clicked, addresses of the requests made), the browser and operating system type and — if you are signed in — your account's internal ID. On roughly one visit in ten, how long the page took to load and to respond is also measured. Your name, email address, IP address, cookies and anything you type into forms are not part of these records. They are kept in error-tracking software (GlitchTip) running on our own server in Germany, are not shared with third parties, and are used only to find and fix errors and to make the platform faster.

We use your data to manage your account, provide the calculation and design services you request, run supplier quote workflows, and send you service-related notifications. We do not send marketing emails.

The site uses the cookies strictly necessary to keep you signed in and one cookie that remembers your language; some preferences and temporary data are also kept in your browser’s storage. See our Cookie Policy for the full list.

Your data is stored in the database and file storage systems we operate ourselves, on servers we rent in Germany (European Union); the server infrastructure is provided by netcup GmbH (Germany). Email notifications are sent through our SMTP email provider. We do not share your data with advertising or analytics networks.

The AI assistant “Vacuo” is available where it has been enabled. To produce its answers, the assistant sends the messages you type and the data it looks up to answer them (calculation results, part information, the status of your projects and requests, the offers you have received, your maintenance plans; for supplier accounts, the requests passed on to the supplier; when you ask about a document you uploaded, that document) to Anthropic (Claude API). Conversations are not stored on our servers; only usage information (message count, the model used, token counts and ratings) is kept. Numeric results come from the platform’s calculation engines. Plant cost data is never sent to the assistant.

Your password is stored as a one-way hash, never as plain text, and session cookies are set as httpOnly (not accessible via browser JavaScript). All accounts, including suppliers, sign in with the same session system; a supplier profile is a role added to a normal account and approved by our team. To recognise the browsers your account signs in from, a random device-id cookie is written to your browser; with your account we keep only a one-way hash of that id, the browser and system name, and the first and last sign-in time (no IP address; at most 20 browsers per account). If a browser not used before signs in, you get an e-mail and an in-app notification; its link signs out every device.

Your data is retained for as long as your account remains active. The following records are deleted or limited automatically:

• In-app notifications: deleted after 90 days.
• Page-visit statistics: deleted after 13 months.
• Password-reset links: valid for 1 hour.
• Design and plan version history: the last 20 versions of each design or plan are kept.
• Error and speed records: deleted after 90 days.

You can request closure of your account or a copy of your data from the Settings page or via the Data Subject Request Form; requests are handled by our team.

For the full list of your rights under Turkish data protection law (Law No. 6698), see our GDPR Notice page; to exercise those rights, use our Data Subject Request Form.

If you are based in the European Union, your data is also protected under the GDPR in addition to Law No. 6698. See the GDPR section of our GDPR Notice page for details.

For questions about this policy, reach us via our Contact page. This policy may be updated from time to time; the current version is always available on this page.