1. Data Controller
The data controller under Law No. 6698 is Sedat Erbek. Texric is the brand and product name.
2. Personal Data That May Be Processed
Depending on how you use Texric Studio Web, the following categories may be processed:
- Account data: email address, sign-in status, and technical password-reset records.
- Eligibility and contract records: confirmation that you are at least 18, accepted Terms of Use and Privacy Policy versions, and confirmation time.
- Communication data: name, email address, subject, and message content.
- Usage and security data: session information, error records, device/browser information, event time, and security logs.
- Project data: project names, patterns, weave drafts, threading, colors, and output settings saved locally or in an account.
- AI usage data: design prompt, generated project data, credit usage, token quantity, approximate cost, success, and error records.
- Subscription and transaction data: Paddle customer, transaction, and subscription identifiers; product, price, subscription status, and access information. Texric does not store full card details.
- Preference data: language and interface preferences and browser storage needed for sessions.
3. Purposes of Processing
- Providing the website and Texric Studio Web securely.
- Operating account, sign-in, registration, and password-reset flows.
- Recording account-age eligibility and acceptance of current legal texts.
- Operating local records, cloud projects, saved weave drafts, saved colors, and exports.
- Storing, backing up, technically reproducing, rendering, transforming, and displaying designs to provide the service requested by the user.
- Verifying and managing Texric Pro subscription, payment status, and access entitlement.
- Performing user-initiated AI design, managing AI credits, and securing the transaction.
- Assessing and responding to communications.
- Monitoring errors, abuse, and unauthorized access risks.
- Resolving technical errors and performance issues without user-behavior analytics.
4. Collection Methods and Legal Bases
Personal data is obtained directly from users through electronic forms and the application interface during account, subscription, project, and AI actions; automatically during web and application use; through email correspondence; and from verified subscription or transaction statuses sent by Paddle or Google Play.
- Account, subscription, and requested application features are processed because processing is necessary to establish or perform a contract under Article 5/2(c) of the KVKK.
- Payment, invoice, tax, accounting records, and competent-authority requests are processed to comply with legal obligations under Article 5/2(ç).
- Support, refund, cancellation, KVKK application, and dispute records are processed where necessary to establish, exercise, or protect a right under Article 5/2(e).
- Service security, abuse prevention, and technical error management are carried out for the data controller's legitimate interests under Article 5/2(f), provided fundamental rights and freedoms are not harmed.
5. Data Transfers
Personal data may be shared, limited to the relevant purpose, with Supabase for accounts and cloud projects; Vercel for web hosting; Paddle for payments and subscriptions; OpenAI for user-initiated AI design; Google Play for Android subscription verification; Google Fonts and jsDelivr for external font and frontend-library delivery; and GoDaddy for support and legal-request email infrastructure.
When the user expressly starts an AI operation, only the design request and data needed for the operation may be sent to the OpenAI API; data sharing for model training is not enabled. Technical service providers may access user designs only to the extent necessary to provide the service and under applicable data-protection obligations.
Resend-based transactional-email infrastructure is not active, and Resend does not process personal data for Texric as of the date of this notice. Before activation, this notice, the applicable processing roles, and the Article 9 KVKK transfer mechanism will be updated.
The Supabase project operates in its Germany region. Other listed providers may also process data using infrastructure outside Türkiye, so personal data may be transferred outside Türkiye.
Current compliance status: As of 23.09.2026, no standard contract notified to the Turkish Data Protection Authority, binding corporate rules, or other appropriate safeguard under Article 9 of the KVKK has been implemented for these regular transfers. Existing data flows using infrastructure outside Türkiye must therefore be restricted before live sales on a provider-by-provider basis, or a valid Article 9 KVKK transfer condition must be completed for each flow.
6. Retention Periods
When Texric Pro ends, existing cloud projects, saved weave drafts, and saved colors are not deleted and are retained for at least 12 months. They are not automatically deleted when that period ends; a longer-term retention or deletion policy will be established separately.
A user returned to Free may view existing work and export it in supported formats. If existing data exceeds a Free limit, the data is not deleted; only creation of new cloud records is restricted. Pro access to the existing work is restored if the user subscribes to Pro again.
If deletion after the post-subscription retention period is introduced later, no automatic deletion will occur without advance notice and an opportunity to export the data. The data subject's deletion request and applicable data-protection duties remain separately protected.
After a verified account-deletion request, the Supabase account, age/legal-text acceptance record, and active cloud project data are deleted or irreversibly anonymized within 30 days. Copies in backups are deleted within the normal backup cycle and no later than 90 days.
AI design prompts and user-linked usage and error records are kept for no more than 12 months. On account deletion, records linkable to the user are deleted or irreversibly anonymized within 30 days; raw AI prompts are not retained in a user-linkable form afterward. Aggregated statistics that cannot be linked back to a user may be retained longer.
Ordinary application access, security, and technical error logs other than AI records and directly controlled by Texric are retained for no more than 90 days from the date each record is created. When an account-deletion request is verified, these records that can be linked to the user are also deleted or irreversibly anonymized within no more than 30 days; the ordinary 90-day period does not delay account deletion. If an ongoing security incident, legal obligation, or dispute requires longer retention, only the relevant records may be retained for the necessary process; when the exception ends, the records are deleted or irreversibly anonymized.
When the technical account-deletion verification flow is activated, rate-limit records directly controlled by Texric will contain only an HMAC-derived technical key, scope, counter, and timestamps; they will not contain a raw IP address, email address, or verification token. They will be deleted by the first periodic server-side cleanup after 24 hours have elapsed from their last use. This period applies only to rate-limit records directly controlled by Texric and does not describe retention in a service provider's own infrastructure.
When the technical account-deletion verification flow is activated, records kept to create or withdraw a request will be limited to the purpose, user/request link, timestamps, failure count, and HMAC-protected verification material instead of raw values. Raw verification tokens and email bodies will not be stored. These technical records will be deleted no later than 30 days after consumption, lockout, or expiry; linked records will be removed earlier if the Auth account is deleted.
Access, security, or operational logs created within the infrastructure of Supabase, Vercel, or another service provider are subject to that provider's contract, plan, and configurable retention settings. Texric does not guarantee deletion within 90 days for provider records it cannot directly control; available retention settings are configured with data minimization in mind and provider terms are reviewed separately.
Payment, invoice, tax, and accounting records that Texric must retain are kept for 10 years from the end of the calendar year in which the record or document was created. They are separate from account and project deletion. Paddle's legal retention duties are governed by Paddle's policies. Other data is kept only for the processing purpose and periods required by law.
On an account-deletion request, the user identifier, name, email address, and unnecessary personal fields in Texric's Paddle customer, subscription, and transaction mirrors are deleted or irreversibly anonymized within 30 days. Full Paddle event and entity payloads are not retained permanently; raw content is removed after the necessary status, product, price, amount, currency, and date fields have been extracted from a verified event. Provider identifiers and minimum records genuinely needed to cancel an active subscription, process a pending refund or chargeback, meet accounting duties, or handle an ongoing dispute may be retained until that process or mandatory retention period ends. Only the necessary transaction identifier, amount, currency, and date information is subject to the 10-year financial-record period. When an exception ends, user links and unnecessary fields are deleted or anonymized. Records in Paddle's own systems remain subject to Paddle's policies.
After the Texric user link in Paddle has been verifiably removed, temporary copies of raw Paddle customer, subscription, and transaction IDs in the replay-protection record may be kept for 90 days. At the end of that period, raw IDs are not removed until it has also been verified that old or manually replayed webhooks cannot recreate a deleted account or relink it to a user and that no continuing financial or legal retention requirement applies. After those checks, only a SHA-256 fingerprint derived from the environment, entity type, and Paddle ID is kept while the Paddle integration remains in use, solely to prevent old webhooks from remapping an account. The fingerprint contains no Texric user UUID, email address, custom_data, or financial content; however, because it may remain linkable to Paddle records, Texric does not automatically treat it as anonymous data and does not use it for another purpose. If the Paddle integration is permanently retired, these replay fingerprints are deleted after financial and legal obligations and retention exceptions have been checked. Deleting replay-protection records does not change the 10-year retention period for transaction identifiers required in financial records.
Designs or related records retained after a deletion request because of a legal obligation are not processed for new production, advertising, model training, or independent commercial use.
Ordinary support, subscription, refund, and cancellation correspondence is retained for 2 years after closure. KVKK/privacy applications, responses, and related action records are retained for 3 years after completion. Longer retention may apply where required by law or an ongoing dispute.
When Texric's own automated subscription-email infrastructure is activated, the technical notification records it creates will be retained for 2 years from the sending date or the final failed delivery attempt. The records will be limited to fields such as notification type, sending time, delivery/sending status, attempt count, and, only while technically necessary, the provider message identifier; email bodies, Paddle payment links, and sensitive payment information will not be stored in the notification ledger or application logs. Once an account deletion request is verified, links to the user and Paddle subscription in notification records will be removed or irreversibly anonymized within 30 days. A provider message identifier or any other field will also be removed if it can be used to reconnect the record to a user, email address, or Paddle subscription. Only de-identified notification type, sending time, status, and attempt count may remain until the end of the two-year period. At the end of two years, remaining records will be deleted or irreversibly anonymized. Where a legal obligation or ongoing dispute requires longer retention, only the necessary records may be retained for the applicable exception period; linked fields will be removed or anonymized when that exception ends.
7. Age Requirement
Creating a Texric account and purchasing Texric Pro are available only to persons aged 18 or older. There is no separate registration or purchase flow based on parental or guardian consent for persons under 18.
If you believe an account or personal data belongs to a person under 18, notify support@texric.com. A verified record will enter the deletion process, except where applicable legal retention duties apply.
8. Rights of the Data Subject
Under Article 11 of the KVKK, you may ask whether personal data is processed, request information if it is, ask for correction, deletion or destruction, request notice to third parties to whom it was transferred, object, and claim compensation where damage occurs.
Send applications to the official privacy and KVKK application address at support@texric.com. Automated deletion from account settings and one-time-link verification for support requests are not yet active in production. Until those flows are activated, deletion requests are received at the address above; a request is not acted on until account ownership is verified with sufficient confidence, and the 30-day period starts when the verified request is received. Texric does not ask for a password, identity document, national identification number, or full payment-card information in ordinary email correspondence. When the technical one-time-link flow is activated, the link will be short-lived and single-use, will verify identity only, and a consequential action such as withdrawal will require separate explicit confirmation. If the registered email changed or account ownership is in doubt, no automatic alternative verification will be offered; manual review will be limited to reliable account and security records. If ownership cannot be established with sufficient confidence, withdrawal will not be completed.
If the technical flow is activated: A withdrawal link verifies identity only, and the request is not withdrawn until separate explicit confirmation is given. If the registered email changed or account ownership is in doubt, no automatic alternative verification is offered; manual review is limited to reliable account records, verified email-change history, and trusted security records. If ownership cannot be established with sufficient confidence, withdrawal is not completed. Texric does not request a national identification number, identity-document image, password, or payment-card data by default. Only irreversible deletion work that has not started may be held for no more than 48 hours and never beyond the original 30-day deadline; expiry of the hold does not automatically approve withdrawal.
Applications are resolved free of charge as soon as possible and no later than 30 days; fees permitted by applicable law may apply if the process creates an additional cost.
9. Notice and Processing Changes
Material changes to this notice or personal-data processing activities will be notified to active users by email at least 30 days in advance. The notice will include a summary of the change, its effective date, links to the current Turkish and English texts, and any applicable objection or account/subscription cancellation rights.
The 30-day advance notice is not required for editorial corrections or technical updates that do not affect data-subject rights. Urgent changes required for security or legal compliance may be implemented earlier to the extent permitted by law, with users informed as soon as reasonably possible.
If the purpose or legal basis of personal-data processing changes, information duties under the KVKK and, where applicable, the GDPR will be fulfilled separately; valid consent or explicit consent will be obtained where legally required. A notice does not replace required explicit consent.
If mandatory law in the user's country requires a longer notice period, separate consent, or additional rights, those requirements will apply.
10. Language Versions
The Turkish text is maintained as the primary reference, while this English text is provided to international users as an equivalent information notice. If an inconsistency arises, the versions will be harmonized so that they convey the same meaning.
This language arrangement does not remove or limit data-subject rights under the KVKK, mandatory rights in the user's country, or binding terms presented to the user at purchase.