Privacy Policy
Last updated:
This is a translation; in case of any discrepancy the Turkish version prevails.
Üretimo is a web application that businesses making to order use to track their production. We process your account details and the production data you enter in the application solely to provide the service. Your data is visible only to your own company’s users; it is not sold and not used for advertising. Application data is stored in the European Union (Frankfurt); some of our service providers are outside the EU (sections 5 and 7). Whenever you ask, we will delete your account and all of your data. On the marketing website, Google Analytics, Google Ads and Meta pixel measurement runs only if you consent.
1. Data controller and our role
This policy applies to the Üretimo service provided at uretimo.com, app.uretimo.com and demo.uretimo.com. For accounts, billing, the marketing website and forms, the data controller is Üretimo. For any questions or requests: info@uretimo.com.
For the customer, order, workshop and file data your company enters in the application, your company is the controller; Üretimo is the processor that processes this data only on your company’s instructions and to provide the service. The rules are set out in the Data Processing Agreement.
2. What data we process
| Data | Source | Purpose |
|---|---|---|
| Full name, email address, password (stored only in hashed form) | Sign-up form (with email and password or with Google); invited team members | Opening the account, signing in, password reset, account-related emails. The account opens once payment for the plan chosen at sign-up is confirmed by Stripe. |
| Name, email address and profile photo link from your Google account | The “Continue with Google” option at sign-in | Signing in and matching accounts. Only email and basic profile permissions are requested from Google; Google Drive, Calendar and Gmail content is not accessed. |
| Company name, industry template, production site, team members and their roles, invited email addresses | Setup and Settings | Setting up the workspace, authorisation, invitation emails |
| Billing details (company name, address, tax number), subscription and payment records | Stripe checkout and customer portal | Paying for the subscription and add-on packs, invoicing, legal retention obligations. Card details are held only by Stripe; Üretimo never sees or stores card numbers. |
| Orders, customers and their contact details, workshops, stages, notes, reminders, price and invoice information, uploaded files and photos | Content entered by users | The service itself: production tracking. This data belongs to your company; for it we act as your processor (section 1). |
| Customer tracking link visits: time opened, how long the page stayed open, broad device type (phone / tablet / computer) and browser language | Public tracking page | Showing you when, how many times and for how long the link was used. No IP address, cookie or any information identifying the person is recorded; records are no longer listed after 90 days. |
| Customer order form: the sender’s full name, email address and phone number; order details (style, product, colour, quantity, size breakdown, requested due date, fabric, PO / reference, delivery address and method, notes, selected language); attached files (tech pack, images) | Public order page (/s/…); the order link a supplier sends to its customer | Letting the supplier see the incoming order and approve it or reject it with a reason; once approved, it is transferred to the order record and its files. It is visible only to users of the company that created the link who have order permissions; the customer sees the status of what they have sent on the same page. Records and attachments are kept for as long as the company’s account is open and are deleted when the company is deleted. |
| Anonymous usage measurement (page views, country, device type) | Vercel Web Analytics | Understanding how much the service is used. Uses no cookies and does not identify individuals. |
| Visit and conversion measurement: pages visited, referring site or ad, approximate location, device and browser information, cookie identifiers; application, account opening and payment steps (including the payment amount) | Google Analytics, Google Ads and the Meta pixel (only if you give cookie consent) | Improving the site and our ads: seeing which pages and ads lead to applications. Details: section 6. |
| Server logs (IP address, time, page requested) | Hosting infrastructure | Security and debugging; kept for a short time. |
| Information you give in the request form (business, industry, contact person, contact details) | The /basvur page | Replying to your request, arranging the call and carrying out the setup (KVKK Art. 5/2-c, entering into a contract; Art. 5/2-f, legitimate interest). Not used for marketing emails. |
| Excel template form: email address, the notice shown, time of submission, IP address; optionally your consent to marketing messages and its wording | The /en/production-tracking-excel-template page | Sending you the template you asked for (KVKK Art. 5/2-c, performing the service you requested). If you ticked the separate box, occasionally sending product and usage tips (your consent); you can opt out from any email or by writing to info@uretimo.com. |
3. Legal basis
We process data under the Turkish Personal Data Protection Law No. 6698 (KVKK) on the basis of the establishment and performance of the service contract (Art. 5/2-c), our legal obligations (Art. 5/2-ç, e.g. keeping invoice records) and our legitimate interests (security, improving the service; Art. 5/2-f). The legal bases for users in the European Union are in section 11.
Optional Google Analytics, Google Ads and Meta pixel measurement and marketing messages rely solely on your consent: KVKK Art. 5(1), GDPR Art. 6(1)(a) and the EU rules on storing information on your device (Directive 2002/58/EC, Art. 5(3)). You can withdraw consent at any time (section 6).
4. Who can see your data
- The data you enter in the application is visible only to users of your own company. Database-level Row Level Security rules prevent access to other companies’ data.
- There are role-based restrictions: for example, an external workshop user sees only the stage, notes and files of the orders given to their workshop; they cannot see prices, the CMT fee, the customer name, invoice details or other workshops.
- A customer tracking link you create is open to anyone who has the link and shows only the stages you have marked “customer sees”, plus product and quantity information; prices, workshop names and internal notes are not shown. The link contains a long code that cannot be guessed; you can close it at any time.
- A customer order link you create is also open to anyone who has the link: your customer uses this page to send you orders and sees only the status of what they have sent; none of your other customers, orders, prices or internal information is visible. A submitted order does not enter production until you approve it. You can close the link at any time.
- We do not sell or rent the data you enter in the application, use it for advertising or share it with third parties. The only exceptions are the service providers below and legal obligations. Visit and conversion measurement on the marketing website goes to Google and Meta only if you consent (section 6).
5. Service providers (data processors)
| Provider | Role | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | EU: Frankfurt, Germany (eu-central-1) |
| Vercel | Web hosting, server functions, anonymous usage measurement | Server functions in the EU: Frankfurt (fra1); pages are served from the nearest point of a global content delivery network (CDN) |
| Stripe | Payments, subscription and invoice management, customer portal | EU and US (under Stripe’s own safeguards) |
| Google (Gmail / Google Workspace) | Email provider: sending invitation, notification, account and form-reply emails; correspondence with info@uretimo.com | Outside Türkiye, including the US (Google data centres) |
| Google (sign-in with Google) | Optional “Continue with Google” sign-in | Outside Türkiye, including the US |
| Google (Gemini API) | Image generation when fabric try-on, the swatch book or the render studio is used (paid tier: images and prompts sent are not used to train Google’s models) | Outside Türkiye, including the US |
| Google Ireland Limited | Google Analytics and Google Ads: visit and conversion measurement, only with cookie consent | EU (Ireland); may be transferred to Google LLC and the United States (EU-US Data Privacy Framework, standard contractual clauses) |
| Meta Platforms Ireland Ltd. | Meta pixel (Facebook, Instagram ads): ad measurement and conversion measurement, only on the marketing website and with cookie consent | EU (Ireland); may be transferred to Meta Platforms, Inc. and the United States (EU-US Data Privacy Framework, standard contractual clauses) |
These providers process data only to provide the service and under their own contractual terms. When we change this list, we update this page; we give advance notice of any new sub-processor that handles customer data, as described in the Data Processing Agreement.
6. Cookies and browser storage
Üretimo uses advertising or tracking cookies only if you give your consent. If you decline or do not answer the cookie box, no Google Analytics, Google Ads or Meta pixel cookies are set and the page sends no requests to Google or Meta (facebook.com); the site works the same.
Strictly necessary (no consent needed):
| Name | Purpose | Duration |
|---|---|---|
| Session key (local storage, app.uretimo.com) | Keeping you signed in | Deleted when you sign out |
| Preferences (local storage: language, reminders box, demo data) | Remembering your language and small screen preferences. All data in the demo environment (demo.uretimo.com) stays only in your browser and is not sent to the server. | Until you delete them |
| uretimo_onay_2 (cookie, .uretimo.com; in local storage under the same name if the cookie cannot be set) | Remembering your cookie choice (accept / decline), so the same choice applies on uretimo.com, app.uretimo.com and demo.uretimo.com | 180 days |
| uretimo-ik (local storage, uretimo.com) | Remembering the line of business you chose on the site (apparel, brand, fabric warehouse, architecture), so links and pages open for it | Until you delete it |
| uretimo-ref (local storage, uretimo.com and app.uretimo.com) | If you arrived through a referral or partner link (?ref=, ?ortak=), remembering the code so it is linked to your first payment when you open an account. Contains no personal data. | 30 days |
Optional (only with your consent):
| Name | Provider and purpose | Duration |
|---|---|---|
| _ga, _ga_<ID> | Google Analytics: counting visits and steps such as application, account opening and payment; seeing which pages and ads work | 2 years (browsers keep it for at most 400 days) |
| _gcl_au | Google Ads: matching an application, account opening or payment after an ad click to that ad (conversion measurement) | 90 days |
| _gcl_aw | Google Ads: if you arrived by clicking an ad, storing the click ID so a later application, account opening or payment can be matched to that click | 90 days |
| _gcl_ls (local storage) | Google Ads: a copy of the same click ID in browser storage | 90 days |
| Cookies on Google domains (doubleclick.net, googleadservices.com) | Google Ads: advertising and conversion cookies that Google keeps on its own domains. Google sets them; Üretimo cannot read or delete them. | As set by Google (policies.google.com/technologies/cookies) |
| _fbp | Meta pixel: recognising your browser as a visitor; matching an application, account opening or payment after one of our Facebook or Instagram ads to that ad (ad measurement) | 90 days |
| _fbc | Meta pixel: if you came by clicking a Facebook or Instagram ad, storing the click ID (set only in that case) | 90 days |
| Cookies on Meta domains (facebook.com) | Meta: cookies that Meta keeps on its own domains. Meta sets them; Üretimo cannot read or delete them. | As set by Meta (facebook.com/privacy/policies/cookies) |
| uretimo_olcum_islem (local storage) | Üretimo: IDs of recent payment sessions (Stripe), so each payment is counted only once in measurement | Until you withdraw consent or delete it |
With these cookies, the pages you visit, the site or ad you came from, approximate location (country, city), device and browser information, and the application, account opening and payment steps (including the payment amount) are sent to Google. Your name, email address and the production data you enter in the application are not sent. This measurement is processed by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland); data may be transferred to Google LLC and to the United States. This transfer relies on the EU-US Data Privacy Framework and the European Commission’s standard contractual clauses.
If you consent, the Meta pixel also sends Meta the page you visit, views of the pricing and industry pages, the application, account opening and payment steps (including the payment amount), browser information, your IP address and the _fbp ID. Your name, email address, phone number and the production data you enter in the application are not sent (advanced matching is off). This measurement is processed by Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, D04 X2K5, Ireland); data may be transferred to Meta Platforms, Inc. and to the United States. This transfer also relies on the EU-US Data Privacy Framework and standard contractual clauses.
Withdrawing consent: you can change your choice at any time with the Cookie settings link at the bottom of every page; when you choose “Decline”, measurement stops and the Google and Meta cookies and local records of this site (_ga, _gcl, _fbp, _fbc, uretimo_olcum_islem) are deleted from your browser. Cookies on Google’s and Meta’s own domains can be deleted in your browser’s site data settings or in Google’s cookie settings. Withdrawal does not affect processing carried out on the basis of consent before it.
Vercel Web Analytics (anonymous usage measurement) uses no cookies and does not identify individuals; it is independent of the cookie box.
7. Transfers abroad (KVKK Art. 9)
Some of our service providers are outside Türkiye (in the EU and the US; section 5), so your personal data is transferred to them in order to provide the service. We make these transfers with the safeguards provided for in KVKK Art. 9 or, where those safeguards are not available, with your explicit consent. For data sent to Google and Meta through the optional measurement cookies, the basis is your consent (section 6). For details of the transfer basis and recipients, write to info@uretimo.com.
8. Retention period
Your data is kept for as long as your account is open. When the account is closed you can download your data for 30 days; after that, or after you ask for deletion, all orders, customers, files and user records are permanently deleted, and deletion from backups takes no more than 90 days. Invoice and payment records are kept for the statutory retention period. Request and template form records are kept for no more than 2 years; we delete them sooner if you ask. Server logs are kept for no more than 30 days. Measurement data in Google Analytics is deleted after 14 months.
9. Security
All connections are encrypted with TLS. Passwords are stored irreversibly hashed. Row-level access rules, role restrictions and change-protection triggers are applied in the database. Files are accessed only through short-lived signed links. The database is backed up regularly.
10. Your rights under the KVKK
Under Article 11 of the KVKK you have the right to learn whether your personal data is processed and, if so, to request information about it; to learn the purpose of processing and whether the data is used accordingly; to know the third parties in Türkiye or abroad to whom it is transferred; to request correction of incomplete or inaccurate data and, where the conditions are met, its deletion or destruction, and to have these actions notified to the third parties it was transferred to; to object to a result against you arising solely from automated analysis; and to claim compensation for damage caused by unlawful processing.
You can change most information yourself in the Settings section of the application and download all your data in one click (CSV files that open in Excel). For other requests, simply write to info@uretimo.com; we will reply within 30 days at the latest. If you are not satisfied with our reply, you can complain to the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu). Requests about data a company has entered in the application are passed to that company, and we help it respond.
11. Users in the European Union (GDPR)
For users in the EU (and the European Economic Area) the General Data Protection Regulation (GDPR) also applies. Legal bases: entering into and performing the contract for accounts, the service, payments and form requests (Art. 6(1)(b)); legal obligations such as keeping invoices (Art. 6(1)(c)); legitimate interests in security and improving the service (Art. 6(1)(f)); consent for the optional measurement cookies and marketing messages (Art. 6(1)(a)). For customer data, Üretimo is a processor within the meaning of GDPR Art. 28 (Data Processing Agreement).
Under the GDPR you have the rights of access, rectification, erasure, restriction of processing, data portability and objection, and you can withdraw consent at any time where processing is based on consent. You can reach the controller at info@uretimo.com. You also have the right to lodge a complaint with the data protection supervisory authority of your country (in Poland, the President of the Personal Data Protection Office, Prezes Urzędu Ochrony Danych Osobowych). Transfers outside the EU (to the US) rely on safeguards such as the providers’ certification under the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.
12. Children
Üretimo is intended for businesses; it is not designed for use by anyone under 18, and we do not knowingly collect data from them.
13. Changes
When we update this policy, we change the date on this page; we also notify you of significant changes at your account email address.