Privacy Policy

This is a convenience translation. The Turkish text (Gizlilik Politikası) is the binding version and prevails in case of any difference.

1. About this policy#

This policy explains in plain language how data is handled in SignFlow (https://signflow.me and https://app.signflow.me), provided by Erelsis Yazılım Teknolojileri Limited Şirketi (the “Company”, “we”). Our statutory notice is the KVKK Privacy Notice; the two documents complement each other.

SignFlow is business software for sign and signage manufacturers that manages orders, design approval, production, installation, stock and purchasing. We call the business that buys the service the “Customer” and the employees it invites “Users”.

2. Whose data we are responsible for#

We are the data controller for account, security, subscription, payment and billing data.

For the business data a Customer enters into the service (its own customers, orders, installation details, photos, files, stock, suppliers and the like), the Customer is the data controller; we process that data only on the Customer’s behalf and to provide the service. We do not use it for our own purposes, sell it or use it for advertising.

3. What we collect#

• Signup details: full name, email, mobile phone, company name and password. The phone is verified by a one-time SMS code and the email by a link.
• Consent records: the version of the document you accepted, the time, IP address and browser details.
• Account and session details: language preference, sign-in times, failed sign-in counters, session records (IP address, browser details, time).
• Audit records: who did what in the app, and when.
• Billing details: legal name or full name, tax number and tax office or, for individuals, national ID number, address, billing email, phone; subscription, payment and invoice records.
• Card details: your card number never reaches us. We keep the token PayTR issues plus only the last 4 digits, expiry month/year, bank, brand and card type.
• Support correspondence: emails you send us.
• Business data: any records the Customer and its Users enter and any files they upload.
• Mobile app: to send notifications, your device's notification token, the device platform (iOS or Android) and the app version. The camera and the photo library are accessed only when you add a photo to an order or an installation, with your permission; the photo you choose is stored as a file of the order. The app collects no location, uses no advertising or analytics tools and does not track you across other apps or sites.

Our marketing site uses no analytics, no advertising or tracking cookies and no third-party trackers.

4. How we use data#

• To open your account, verify your identity and provide the service.
• To manage the subscription, take payments and issue invoices.
• To protect the service and accounts from unauthorised access and abuse.
• To answer support requests and send necessary service notices.
• To meet legal obligations and protect our rights.

Service emails are email verification, password reset, invitations, notifications, trial reminders 3 days and 1 day before the trial ends, payment and billing notices, and export-ready notices. You can turn notification emails on or off for each kind of notification. Commercial electronic messages may only be sent with separate consent; we collect no such consent today and send no commercial messages.

5. How we protect data#

• Separation between Customers is not left to the application: it is enforced in the database with row-level security rules.
• Passwords are stored only as Argon2 hashes; one-time codes and email tokens only as keyed hashes.
• National ID numbers and PayTR card and user tokens are encrypted with AES-GCM.
• Card details are sent straight to PayTR and never reach our servers.
• Sessions are held on the server and expire after 7 days of inactivity and after 30 days at the latest. Repeated failed sign-ins lock the account temporarily. Forms are protected against CSRF.
• Access depends on roles and permissions; nobody can grant a permission they do not hold.
• Important actions are written to an audit log that cannot be altered.
• The content type of uploaded files is checked; mismatching files are quarantined and never served. Files are reachable only through signed links valid for 5 minutes.
• Company staff have no screen for browsing Customers’ business data; the admin sign-in requires two steps (password and an authenticator app code).
• The database is backed up nightly.

No system can guarantee complete security. If we learn of a personal data breach, we make the notifications required by KVKK.

6. Where data is held#

The database, files and job queues run on servers operated by the Company and provided by DigitalOcean, LLC in a data centre in the United States (New Jersey). This means personal data is transferred abroad; the legal basis and safeguards are described in the KVKK Privacy Notice. Backups are held in the same provider’s data centre in the United States, in a directory with restricted access. Mobile app notifications are delivered through Google LLC’s Firebase Cloud Messaging; a notification carries only the order number, a material code and the stage name. Before we work with a new provider abroad, we update this policy and the privacy notice.

7. Our service providers#

Invoices are shared with the Revenue Administration (GİB) as required by the Tax Procedure Law. Lawful requests from competent public authorities are met.

8. Retention#

• Account and Customer data is kept while the account and subscription exist, including read-only periods.
• Session records are kept until the session ends or is revoked, then deleted on schedule.
• Invoices and payment records are kept for 5 years under the Tax Procedure Law and 10 years under the Commercial Code.
• Audit and consent records are kept after closure as well.
• Deleted data leaves the backups within 30 days.
• Application logs are short-lived, size-limited rotating logs; no web access logs are kept.

9. Export and closing an account#

A Customer can export all of its data at any time, including in read-only mode. The export is prepared in the background as a ZIP archive with one CSV file per entity and a manifest. The archive is downloaded through the app and kept for 7 days.

The Customer’s owner can request closure in the app. After the request the data stays available for 30 days; exports remain possible and the request can be withdrawn during that time. Within a reasonable time after the 30 days end, our authorised staff delete the Customer’s business data, files, memberships, sessions, billing profile and card tokens (also at PayTR). Invoices, payment records, audit and consent records are kept to meet legal obligations; User accounts that belong to no other Customer are anonymised.

10. Your rights#

Your rights under KVKK Article 11 and how to apply are described in the KVKK Privacy Notice. If your data was entered by a SignFlow Customer, please apply to that business first; we forward such requests that reach us to the Customer concerned.

11. Children#

SignFlow is a service for businesses and is not intended for anyone under 18. We do not knowingly collect data from people under 18.

12. Cookies#

We use only cookies that are strictly necessary for the service to work. See the Cookie Policy for details.

13. Changes and contact#

We update this policy when needed and announce material changes by email or in the app. The current version is always on this page.

For questions, write to destek@signflow.me or to Zafer Mah. 152 Cad. No: 35 Efeler / Aydın.