Privacy Policy

This Privacy Policy explains how Macenta Publishing & Digital Solutions (“we”, “us”) processes personal data when you use KreaCAD (the “Service”). It is written to meet the EU/UK General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK).

• For account holders (teachers, authors, administrators) and visitors of our website, we are the data controller.
• For learner data that schools and teachers collect through the Service (classrooms, assignment links, submissions), the school or teacher is the controller and we act as a processor on their instructions. See section 7.

Account data. Name, email address, password (stored only as a one-way hash), profile picture, role and plan, workspace and classroom memberships. If you sign in with Google, we receive your name, email address, whether Google has verified it, and your profile picture from Google. We never receive your Google password.

Content. Projects, pages, questions, media files you upload, templates, comments, classroom channels and messages, and settings — everything you create or upload.

Learner and submission data. When learners open assignment links or classroom work: the details requested by the teacher’s form (for example name, class or student number), answers, scores, results by page and module, timestamps and time spent.

AI tool inputs and records. The prompts, text, images or PDF files you submit to AI tools, the generated output, and a usage record (feature used, model, token counts, date) for quota purposes.

Usage data. Which projects, pages and features you open and how long you work on them (session and daily activity time), plus share-link view counts. We use this for your reports, quotas and to improve the product.

Technical data. IP address, browser and device information, and server logs created when you use the Service (for security, troubleshooting and abuse prevention).

Communications. Messages you send us, for example support or privacy requests.

We do not intentionally collect special categories of personal data (such as health or religious data). Please do not upload such data into the Service.

We do not sell personal data, use it for advertising, or use your content or learners’ data to train our own AI models.

We share personal data only as needed to run the Service:

• Infrastructure providers that host our servers, database, file storage and backups on our behalf.
• OpenAI — only when you use an AI tool, the content you submit to that tool is sent to OpenAI’s API to generate the result. According to OpenAI’s published API policies, data sent through the API is not used to train its models by default and is retained only for a limited period for abuse monitoring.
• Google — only if you choose “Sign in with Google”, to verify your identity. Google’s own privacy policy applies to your Google account.
• Amazon Web Services — images from our built-in image library are delivered from AWS storage, so your browser contacts AWS when it loads those images (AWS receives your IP address as part of the request). We do not store your personal data there.
• People you share with. Workspace members, classroom members and anyone with a share or assignment link you create can see the content you share with them. Teachers can see the submissions made to their own activities.
• Authorities and advisers where required by law or to protect rights, safety and the Service; and a successor company in a merger or acquisition, subject to this Policy.

Some of our providers (such as OpenAI, Google and Amazon Web Services) process data outside Türkiye and outside the European Economic Area, including in the United States. Where required, we rely on appropriate safeguards for these transfers, such as the European Commission’s Standard Contractual Clauses, and on the transfer mechanisms provided by KVKK (including standard contracts notified to the Turkish Personal Data Protection Authority, or your explicit consent where the law requires it).

• Account data and content: for as long as your account is active. When you ask us to delete your account, we delete or anonymise it within 30 days, except where we must keep certain records by law.
• Deleted projects: kept in the “Deleted” area for 7 days so they can be restored, then removed permanently.
• Learner submissions: kept for as long as the teacher’s account and the related activity exist, or until the school or teacher asks us to delete them.
• AI usage records and activity time records: for as long as the account exists, for quotas and reports.
• Server logs and backups: for a limited time and then overwritten on a rolling basis.

KreaCAD is designed for educators. When a school or teacher uses the Service with learners:

• the school or teacher is the controller of learners’ data and decides what information the assignment form asks for and how results are used;
• the school or teacher is responsible for informing learners and parents and for obtaining any consent required by law, including parental consent for children;
• we process learners’ data only to provide the Service to that school or teacher, never for advertising or profiling, and we do not sell it;
• we recommend that teachers collect the minimum information needed (for example a first name or student number instead of full details).

Children under 13 may have a student account only through a class invitation and only where their school or teacher has obtained verifiable parental consent; they may not open teacher accounts. If you believe a child has provided personal data to us without appropriate consent, contact destek@macenta.com.tr and we will delete it. Learners and parents who want to access or delete learner data should first contact their school or teacher; we will help the school fulfil the request.

Depending on where you live, you have the right to:

• find out whether we process your personal data and get a copy of it;
• have inaccurate data corrected and incomplete data completed;
• have your data deleted or anonymised;
• restrict or object to certain processing, including processing based on legitimate interests;
• receive your data in a portable format (you can also export your projects yourself);
• withdraw consent at any time, without affecting earlier processing;
• learn the third parties to whom your data is transferred, in Türkiye or abroad, and ask that they be notified of corrections or deletions;
• object to a result against you that arises solely from automated analysis, and claim compensation for damage caused by unlawful processing (KVKK art. 11).

To exercise your rights, email destek@macenta.com.tr from the address linked to your account. We answer within 30 days. You also have the right to complain to a data protection authority — in Türkiye the Personal Data Protection Authority (KVKK), or the supervisory authority in your EU/UK country of residence.

We use technical and organisational measures to protect personal data, including encrypted connections (HTTPS), hashed passwords, access controls based on workspace and classroom roles, signed sign-in tokens, and restricted administrative access. No online service is completely secure, so please use a strong, unique password and tell us right away if you notice anything suspicious.

We use only the cookies and browser storage needed to run the Service and remember your choices. Details are in our Cookie Policy.

We may update this Privacy Policy. We will post the new version here with a new “Last updated” date and, if the changes are significant, notify you by email or in the Service.

Questions or requests about privacy:

Macenta Publishing & Digital Solutions (operator of KreaCAD)
Dikilitaş Mah. Barış Sok. Fulya Sitesi A Blok 9/A, Beşiktaş, İstanbul, Türkiye
Email: destek@macenta.com.tr
Website: kreacad.com