1. Information We May Collect
- Your email address and session information when you create an account or sign in.
- Your confirmation that you are at least 18, the accepted versions of the Terms of Use and Privacy Policy, and the confirmation time.
- Technical records needed for password resets, sign-in, and security checks.
- Name, email address, subject, and message content in emails sent to support@texric.com.
- Project data you create or save in Texric Studio Web.
- Prompts entered into AI-assisted design, generated design data, and success, error, credit, token, and approximate cost records.
- Paddle customer, transaction, and subscription identifiers and plan/access status for Texric Pro.
- Language and interface preferences and technical data such as browser, device, IP address, event time, and security records.
2. Why We Use This Information
We use data to record age eligibility and acceptance of current legal texts, operate your account and subscription, provide application features, manage saved projects, process AI usage and credits, resolve technical issues, protect security, comply with legal obligations, and respond to requests.
3. How We Collect Information
Information is obtained directly from you during account and subscription actions; automatically when you use the application and AI feature; from technical browser storage; and from verified transaction statuses sent to Texric by subscription providers such as Paddle or Google Play. Support and legal-request information is received by email.
4. Project and Design Data
The application works with design data such as patterns, weave drafts, threading, color formulas, project names, and output settings. Local records may be stored in your browser. When account-linked or cloud saving is active, data may be stored through the relevant infrastructure.
Account-linked cloud records and Pro access status may be held on Supabase. AI-assisted design runs only when expressly initiated by the user; the user's design prompt is sent to OpenAI and the generated result is applied to the Texric project.
Ownership and intellectual-property rights in user designs remain with the user. Texric stores, backs up, technically reproduces, renders, transforms, and displays designs only to provide the requested service; designs are not used for advertising, sale to third parties, independent commercial use, or model training.
Design data is not sent to OpenAI for this purpose unless the user expressly starts an AI operation. Data sharing for OpenAI API model training is not enabled. The KVKK/GDPR requirements for transfers containing personal data and the Article 9 KVKK compliance blocker below continue to apply separately.
5. Cookies and Analytics
Technical cookies or browser storage such as localStorage may be used for language preferences, sessions, and local project functions. Texric currently does not use Google Analytics or another separate user-behavior analytics service.
6. Third-Party Services
Texric Studio Web uses the following third-party services:
- Supabase: account authentication, database, cloud project records, and subscription-access status.
- Vercel: web hosting, content delivery, and security/access records.
- Paddle: payment, invoicing, subscription management, customer portal, and related transaction records.
- OpenAI: processing only the written design request and data needed when the user expressly starts AI-assisted design. API requests use
store: false, and data sharing for model training is not enabled; Texric may keep usage and error records in Supabase. - Google Play: verifying Android subscriptions and merging access status.
- Google Fonts: externally serving fonts used by the pages.
- jsDelivr: externally delivering the Supabase frontend library.
- GoDaddy: transmission of support, subscription, refund, cancellation, and legal-request emails and provision of email infrastructure.
Technical requests to external resources such as Google Fonts and jsDelivr may allow those providers to process connection data such as IP address, browser information, and request time.
Technical service providers may access user designs only to the extent necessary to provide the service and under applicable data-protection obligations.
Texric's own Resend-based transactional-email infrastructure is not active, and Resend does not process personal data for Texric as of the date of this policy. Before such infrastructure is activated, this policy, the applicable processing roles, and the Article 9 KVKK transfer mechanism will be updated. Paddle may send its own payment-recovery and transaction emails under Paddle's infrastructure and policies.
7. Retention and Security
When Texric Pro ends, existing cloud projects, saved weave drafts, and saved colors are not deleted and are retained for at least 12 months. They are not automatically deleted when that period ends; a longer-term retention or deletion policy will be established separately.
A user returned to Free may view existing work and export it in supported formats. If existing data exceeds a Free limit, the data is not deleted; only creation of new cloud records is restricted. Pro access to the existing work is restored if the user subscribes to Pro again.
If deletion after the post-subscription retention period is introduced later, no automatic deletion will occur without advance notice and an opportunity to export the data. This post-subscription protection does not prevent the user from requesting deletion or Texric from complying with applicable data-protection duties.
After a verified account-deletion request, the Supabase account, age/legal-text acceptance record, and active cloud project data are deleted or irreversibly anonymized within 30 days. Copies remaining in backups are deleted within the normal backup cycle and no later than 90 days.
AI design prompts and user-linked usage and error records are retained for no more than 12 months. On account deletion, records still linkable to the user are deleted or irreversibly anonymized within 30 days; raw AI prompts are not retained in a user-linkable form after deletion. Aggregated statistics that cannot be linked back to a user may be kept longer.
Ordinary application access, security, and technical error logs other than AI records and directly controlled by Texric are retained for no more than 90 days from the date each record is created. When an account-deletion request is verified, these records that can be linked to the user are also deleted or irreversibly anonymized within no more than 30 days; the ordinary 90-day period does not delay account deletion. If an ongoing security incident, legal obligation, or dispute requires longer retention, only the relevant records may be retained for the necessary process; when the exception ends, the records are deleted or irreversibly anonymized.
When the technical account-deletion verification flow is activated, rate-limit records directly controlled by Texric will contain only an HMAC-derived technical key, scope, counter, and timestamps; they will not contain a raw IP address, email address, or verification token. They will be deleted by the first periodic server-side cleanup after 24 hours have elapsed from their last use. This period applies only to rate-limit records directly controlled by Texric and does not describe retention in a service provider's own infrastructure.
When the technical account-deletion verification flow is activated, records kept to create or withdraw a request will be limited to the purpose, user/request link, timestamps, failure count, and HMAC-protected verification material instead of raw values. Raw verification tokens and email bodies will not be stored. These technical records will be deleted no later than 30 days after consumption, lockout, or expiry; linked records will be removed earlier if the Auth account is deleted.
Access, security, or operational logs created within the infrastructure of Supabase, Vercel, or another service provider are subject to that provider's contract, plan, and configurable retention settings. Texric does not guarantee deletion within 90 days for provider records it cannot directly control; available retention settings are configured with data minimization in mind and provider terms are reviewed separately.
Payment, invoice, tax, and accounting records that Texric must keep in its own systems are retained for 10 years from the end of the calendar year in which the record or document was created. These records are separate from account and project deletion. Paddle's own legal retention duties are governed by Paddle's policies.
On an account-deletion request, the user identifier, name, email address, and unnecessary personal fields in Texric's Paddle customer, subscription, and transaction mirrors are deleted or irreversibly anonymized within 30 days. Full Paddle event and entity payloads are not retained permanently; raw content is removed after the necessary status, product, price, amount, currency, and date fields have been extracted from a verified event. Provider identifiers and minimum records genuinely needed to cancel an active subscription, process a pending refund or chargeback, meet accounting duties, or handle an ongoing dispute may be retained until that process or mandatory retention period ends. Only the necessary transaction identifier, amount, currency, and date information is subject to the 10-year financial-record period. When an exception ends, user links and unnecessary fields are deleted or anonymized. Records in Paddle's own systems remain subject to Paddle's policies.
After the Texric user link in Paddle has been verifiably removed, temporary copies of raw Paddle customer, subscription, and transaction IDs in the replay-protection record may be kept for 90 days. At the end of that period, raw IDs are not removed until it has also been verified that old or manually replayed webhooks cannot recreate a deleted account or relink it to a user and that no continuing financial or legal retention requirement applies. After those checks, only a SHA-256 fingerprint derived from the environment, entity type, and Paddle ID is kept while the Paddle integration remains in use, solely to prevent old webhooks from remapping an account. The fingerprint contains no Texric user UUID, email address, custom_data, or financial content; however, because it may remain linkable to Paddle records, Texric does not automatically treat it as anonymous data and does not use it for another purpose. If the Paddle integration is permanently retired, these replay fingerprints are deleted after financial and legal obligations and retention exceptions have been checked. Deleting replay-protection records does not change the 10-year retention period for transaction identifiers required in financial records.
Designs or related records retained after a deletion request because of a legal obligation are not processed for new production, advertising, model training, or independent commercial use.
Ordinary support, subscription, refund, and cancellation correspondence is retained for 2 years after the request is closed. Privacy/KVKK applications, responses, and related action records are retained for 3 years after completion. Records may be retained longer where required by law or an ongoing dispute.
When Texric's own automated subscription-email infrastructure is activated, the technical notification records it creates will be retained for 2 years from the sending date or the final failed delivery attempt. The records will be limited to fields such as notification type, sending time, delivery/sending status, attempt count, and, only while technically necessary, the provider message identifier; email bodies, Paddle payment links, and sensitive payment information will not be stored in the notification ledger or application logs. Once an account deletion request is verified, links to the user and Paddle subscription in notification records will be removed or irreversibly anonymized within 30 days. A provider message identifier or any other field will also be removed if it can be used to reconnect the record to a user, email address, or Paddle subscription. Only de-identified notification type, sending time, status, and attempt count may remain until the end of the two-year period. At the end of two years, remaining records will be deleted or irreversibly anonymized. Where a legal obligation or ongoing dispute requires longer retention, only the necessary records may be retained for the applicable exception period; linked fields will be removed or anonymized when that exception ends.
Reasonable technical and organizational measures are used to protect data against unauthorized access. Because absolute security cannot be guaranteed for an internet service, security practices are reviewed periodically.
8. Age Requirement
Texric accounts and Texric Pro are available only to persons aged 18 or older. There is no separate use or purchase flow based on parental or guardian consent for persons under 18.
If you believe data relating to a person under 18 is being processed through the account system, notify support@texric.com. A verified record will enter the deletion process, except where applicable law requires retention.
9. International Data Transfers
Personal data may be transferred outside Türkiye because Supabase operates in its Germany region and Vercel, Paddle, OpenAI, Google Play, Google Fonts, jsDelivr, and GoDaddy may process data using infrastructure outside Türkiye.
Current compliance status: As of 23.09.2026, no standard contract notified to the Turkish Data Protection Authority, binding corporate rules, or other appropriate safeguard under Article 9 of the KVKK has been implemented for these regular transfers. Existing data flows using infrastructure outside Türkiye must therefore be restricted before live sales on a provider-by-provider basis, or a valid Article 9 KVKK transfer condition must be completed for each flow.
10. Your Rights and Contact
For requests to access, correct, delete, or object to the use of personal data, contact the official privacy and KVKK application address at support@texric.com. Automated deletion from account settings and one-time-link verification for support requests are not yet active in production. Until those flows are activated, deletion requests are received at this email address; a request is not acted on until account ownership is verified with sufficient confidence, and the 30-day period starts when the verified request is received. Texric does not ask for a password, identity document, national identification number, or full payment-card information in ordinary email correspondence. When the technical one-time-link flow is activated, the link will be short-lived and single-use, will verify identity only, and a consequential action such as withdrawal will require separate explicit confirmation. If the registered email changed or account ownership is in doubt, no automatic alternative verification will be offered; manual review will be limited to reliable account and security records. If ownership cannot be established with sufficient confidence, withdrawal will not be completed. Requests are resolved as soon as possible and no later than 30 days.
If the technical flow is activated: A withdrawal link verifies identity only, and the request is not withdrawn until separate explicit confirmation is given. If the registered email changed or account ownership is in doubt, no automatic alternative verification is offered; manual review is limited to reliable account records, verified email-change history, and trusted security records. If ownership cannot be established with sufficient confidence, withdrawal is not completed. Texric does not request a national identification number, identity-document image, password, or payment-card data by default. Only irreversible deletion work that has not started may be held for no more than 48 hours and never beyond the original 30-day deadline; expiry of the hold does not automatically approve withdrawal.
The data controller is Sedat Erbek; Texric is the brand and product name. Business address: İsmet Paşa Mah. Bülent Ecevit Cad. Palmiye 1 No: 8 C İç Kapı No: 14, Kapaklı / Tekirdağ, Türkiye.
11. Policy and Data Processing Changes
Material changes to the Privacy Policy or personal-data processing practices will be notified to active users by email at least 30 days in advance. The notice will include a summary of the change, its effective date, links to the current Turkish and English texts, and any applicable objection or account/subscription cancellation rights.
The 30-day advance notice is not required for editorial corrections or technical updates that do not affect user rights. Urgent changes required for security or legal compliance may be implemented earlier to the extent permitted by law, with users informed as soon as reasonably possible.
If the purpose or legal basis of personal-data processing changes, the applicable KVKK and GDPR information duties will be fulfilled separately and valid consent or explicit consent will be obtained where required. A change notice does not replace any consent or explicit consent required by law.
If mandatory law in the user's country requires a longer notice period, separate consent, or additional rights, those requirements will apply.
12. Language Versions
The Turkish text is maintained as the primary reference, while this English text is provided to international users as an equivalent privacy text. If an inconsistency arises, the versions will be harmonized so that they convey the same meaning.
This language arrangement does not remove or limit mandatory data-protection or consumer rights in the user's country or binding terms presented to the user at purchase.