Privacy Notice

Data controller

This notice is issued by Ramazan Uzunkavak as data controller under Turkish Personal Data Protection Law no. 6698 (KVKK).

Address: Soganlik Yeni Mah., Kartal / Istanbul · Contact: info@pdfgine.com

Data we process

Identity and contact: full name, e-mail address, workspace name.

Customer transactions: the plan purchased, invoice records, payment status. Card details are never stored by us; they are handled by the payment provider.

Security data: sign-in records, a hash of the IP address, a hash of the user agent, audit records.

Usage data: pages generated, template names and versions, API call records.

Document content: the data you post through the API and the files produced. This content is yours; we process it only to deliver the service.

Purposes and legal grounds

Performance of a contract: opening your account, generating documents, tracking quota, billing.

Legal obligation: retaining invoice and accounting records, responding to lawful requests from authorities.

Legitimate interest: service security, abuse detection, debugging, measuring service quality.

Explicit consent: marketing communication only, and only where you separately opted in.

Transfers

To the payment provider: name, e-mail and billing details needed to take payment.

To the hosting and infrastructure provider: the data technically required to run the service.

To the e-mail delivery provider: your e-mail address, to send account and notification mail.

To public authorities: where legislation requires it, and only to the extent required.

Our servers are in Türkiye (Denizli) and customer data is kept in the country. Only two items leave Türkiye, and the legal basis for both is that the transfer is necessary for the performance of the contract. (1) Paddle — name, e-mail and billing details, so that the payment can be taken. (2) Google Workspace — e-mail address and message content, so that e-mail can be delivered. No other personal data is transferred abroad.

Retention

Account and identity data: kept while the account is open. A closure request takes effect at the end of the paid period; at that point the name, e-mail address and contact details are anonymised. Invoice, subscription and consent records remain attached to the anonymised identity for as long as the law requires.

Invoice and accounting records: 10 years, as required by law.

Document content and generated files: for the period you choose when producing the document — 24 hours, 7 days or 30 days (7 and 30 days on Starter and above). When the period ends the PDF, Word and source HTML files are deleted from the servers within 24 hours; the document's date, page count and template stay in the record for usage metering. PDFgine does not keep your documents on your behalf; store any document you want to keep in your own system right after producing it.

Shared preview links: they close after 24 hours, 7 days or 30 days, depending on the duration chosen when the link was created. Their files are deleted from the servers 24 hours after the link closes.

Audit and security logs: 12 months. Within these records the IP address and browser details are stored only as an irreversible hash.

Once the period ends, data is deleted, destroyed or anonymised. The periods can be shortened by configuration; any extension is announced separately.

Your rights

Under article 11 of the KVKK you may learn whether your data is processed, request information, learn the purpose, know the third parties it was transferred to, request correction or deletion, object to an adverse result produced solely by automated analysis, and claim compensation for damage.

Send requests to info@pdfgine.com. We respond within 30 days at the latest.