SyncSite Privacy Policy and Notice

This notice explains which personal data SyncSite (published earlier as Projex), OstlerTech’s construction-site tracking app (Android and Windows apps and the cloud sync service), processes, why and how. It is our information notice under Article 10 of Türkiye’s Personal Data Protection Law No. 6698 (KVKK). The short notice below is also shown on the sign-in screen. If the Turkish and English texts differ, the Turkish text prevails.

1. Data controller

Business

Yasin Beygirci · Ostler Tech Yazılım (OstlerTech), sole proprietorship

Tax office / no

Fevzipaşa · 1670324378

Trade registry

Erzincan Registry of Tradesmen and Craftsmen, no. 25537

Chamber

Erzincan Elektrikçiler Esnaf ve Sanatkarlar Odası (Erzincan Chamber of Electricians, Tradesmen and Craftsmen)

Address

Hancı Mah. Akasya_1 Sk. No: 7 İç Kapı No: 1, Merkez / Erzincan, Türkiye

Registered email (KEP)

yasin.beygirci@hs01.kep.tr

Phone

+90 850 242 62 10

Email

destek@ostlertech.com

For accounts you open for your own use, OstlerTech is the controller of your account data. If a business uses SyncSite with its staff, see section 5.

2. What data we process

If you create an account

• Email address and password. We never hold your password in readable form; our sign-in service stores it as a one-way hash.
• Account ID and the date the account was created. This date is recorded as the start of the beta and of the trial period (section 4).
• Session data: a session key stored on your device to keep you signed in.
• Project membership: your role in each project (owner, editor, viewer) and team. A project owner invites you using your email address; you are not added to any project, and cannot see its records, until you accept the invitation.
• Invitation record: the invited email address, the proposed role (editor or viewer), the account that created the invitation and the date. This record is kept even if the invited address has no account with us. We do not send the invited person an email: the invitation appears in the app for the person who creates an account with that address, verifies the address and signs in. The invited person sees the project name and the email address of the person who created the invitation. If they accept, they become a member, and if they decline, the invitation is deleted. An invitation is valid for 14 days; an expired invitation gives no access. The project owner who created it cannot find out whether the address belongs to a registered account.
• Who entered a record: stored with each daily record so the team can see who entered it.
• Server logs: technical logs kept by our hosting provider when you connect (IP address, time, request type), used only for security and troubleshooting.

Site records (entered by you or your team)

• Project name, description, dates; place names such as block, floor or flat (not geographic locations); team and work item names; target quantities.
• Daily records: date, quantity of work done, the number of people on that job, notes and blocker information.
• Photos. Photos are resized and re-saved; this removes the location and device data (EXIF) inside them. Photos may show people’s faces.

SyncSite does not keep per-person timesheets and does not ask for workers’ names. However, whatever you type in notes and team names, or capture in photos, is stored. Do not enter unnecessary personal data such as ID numbers or health information.

On your device

Whether or not you have an account, the app keeps your data in a database and app folder on your device. If you have an account and the connection drops, records you enter wait on your device and sync once the connection is back. This local database is not separately encrypted; we recommend using a screen lock. Excel, PDF and JSON files you export stay on your device (Documents/Projex); sharing and deleting them is up to you.

In the current version, SyncSite data is excluded from Android Auto Backup and device-to-device transfer; you make copies yourself with Back up / export in the app. Versions 1.2.0 and earlier allowed backup: if you used them, Android may have backed up app data (including the session key) to your own Google account. That backup is between you and Google; we cannot access it.

If you write to us

Your name, email address and message in support or request emails.

What we do not process

GPS location, contacts, advertising ID, device identifiers, usage analytics, crash reports. Payment card data does not reach us.

3. How we collect it

You type your email and password on the sign-in screen; you or your team enter site records and photos in the app; the account creation date and technical logs are created automatically on the server while you use the service. Collection is electronic, through the app.

4. Why, legal grounds and the trial period

• Creating your account, signing in and password reset; syncing your records across your devices and team and sharing photos; managing the beta and trial period; sending necessary beta notices (end of the beta, an important change, verification codes): performance of a contract (KVKK Art. 5(2)(c)).
• Security, abuse prevention and troubleshooting; showing your team who entered a record: legitimate interest (Art. 5(2)(f)).
• Recording a project invitation and showing it to the invited person: for the person who created the invitation, performance of a contract (Art. 5(2)(c)); for the invited person, legitimate interest (Art. 5(2)(f)).
• Answering support and data requests: performance of a contract and legal obligation (Art. 5(2)(c), 5(2)(ç), Art. 13).
• Invoicing and accounting (if paid plans are introduced later): legal obligation (Art. 5(2)(ç)).

Beta and trial period. The date your account is created is recorded as the start of a 1-month trial period that may apply later. During the beta, no feature is restricted because of this period. The date is used only for this purpose and is deleted with your account. After you delete your account, apart from the invitation record described in section 7, we do not keep your email address or a hash of it.

We do not ask for explicit consent for these activities; this text is information, not a consent form. We send no marketing emails; if we ever want to, we will ask for your permission separately, in a separate text.

5. For businesses: who is the controller

When a business (for example a contractor or subcontractor) uses SyncSite with its staff and team, that business is the data controller for personal data in the site records (staff records, people in photos), and OstlerTech is a processor acting on its instructions. Informing its staff is the business’s responsibility. During the open beta we do not sign individual agreements with businesses; instead, standard data processing terms for businesses are prepared as an addition to the beta terms, and where a business has signed a written pilot agreement earlier, that agreement applies. OstlerTech is the controller for account data (email, sign-in) and support correspondence.

6. Recipients and transfers abroad

We share your data only with these service providers, only to run the service:

• Supabase Pte. Ltd. (Singapore; parent company Supabase, Inc., USA): database, sign-in, photo storage. Data is stored in the European Union, Ireland (Amazon Web Services infrastructure).
• Brevo (Sendinblue SAS, France): sending account emails (verification code, password reset).

Some of Supabase’s own service providers (support and infrastructure) are in the United States and other countries; data may be accessed from there during support or maintenance. Current list: supabase.com/legal/subprocessors.

Current status of the transfer abroad. Because the servers are outside Türkiye, your data is transferred abroad when you create an account (KVKK Art. 9). Such a transfer must rely on an adequacy decision of the Turkish Board, or on the Board’s standard contract, signed unchanged by the parties and notified to the Authority. As of today:

• We are not aware of any adequacy decision of the Board for the European Union or Ireland.
• We have Supabase’s standard data processing agreement, which is based on the EU Standard Contractual Clauses. It is not the standard contract recognized under KVKK. The transfer therefore does not currently rely on one of the appropriate safeguards listed in KVKK Art. 9, and this carries a risk of non-compliance.
• We asked Supabase on 18.10.2026 to sign the Board’s standard contract; there has been no reply. If it is signed we will notify the Authority and update this notice. If it is not, we will consider moving the data to a server in Türkiye.

If you do not want to accept this, use the app without a SyncSite account (the button on the sign-in screen for continuing without creating an account): your data then never leaves your device. You can delete your account at any time (section 7). Apart from this, we disclose personal data only to authorities and courts on a lawful request, and only to the minimum extent required.

7. Retention and deletion

• Account (email, sign-in data, account creation/trial start date): while your account exists; deleted immediately when you delete it.
• Project invitations: an invitation is kept until it is accepted or declined, and is deleted when it is accepted or declined. An invitation not answered within 14 days becomes invalid and gives no access, but its record is not deleted automatically: an expired invitation is cleared only when a new invitation is left in the same project. An invitation record is also deleted when the account that created it is deleted and when the project is permanently deleted (for example when the project owner’s account is deleted).
• Projects you own and their photos: until you delete them or your account.
• Records you delete one by one: the row stays in the cloud with a “deleted” mark so other devices learn of the deletion. The record’s content (quantity, number of people, note, photo) and the photo file are erased; only the deleted mark remains.
• Records you entered in someone else’s project: that project belongs to its owner; when you delete your account the records stay but the link to you (who entered them) is removed.
• Server logs (IP address etc.): a short period set by the hosting plan (currently 1 day).
• Server backups: no automatic backups are kept at present; deleted data cannot be restored. Keep your own copies of important records using the app’s export.
• If the beta ends: we give you time after the notice to export your data; unless you move to a paid plan, beta data is then deleted from the live system (periods are in the beta terms).
• Support emails: 1 year after the request is closed. Invoices and accounting records (if any): the statutory period (10 years).
• Logs or screenshots you send us: at most 30 days; deletion is recorded.
• Data on your device and exported files: until you delete them. Deleting your account also deletes the app’s local database; you delete exported files yourself.

How to delete your account and what is deleted or kept: account deletion page.

8. Security

The connection to the server is encrypted (HTTPS). In the database each user can see only the projects they belong to; photos are kept in a non-public area with access based on project role. Two-step verification is on for our service accounts and secret keys are kept out of our code repository. We do not put your data into AI services or test or demo environments. No system is free of risk; if a data breach occurs we will notify the Board and affected people as KVKK requires.

9. Your rights and how to apply (KVKK Art. 11)

You may ask us: whether your data is processed; for information about it; the purpose of processing and whether it is used accordingly; the recipients in Türkiye and abroad; to correct incomplete or wrong data, to erase or destroy it under Art. 7 and to notify recipients of this; to object to an adverse outcome resulting solely from automated analysis; and for compensation if you suffer damage from unlawful processing.

How to apply: email destek@ostlertech.com from the address registered to your account; or in writing to Hancı Mah. Akasya_1 Sk. No: 7 İç Kapı No: 1, Merkez / Erzincan, Türkiye, or via KEP to yasin.beygirci@hs01.kep.tr. State your name, contact details and request; we may ask for more information to verify your identity. We reply free of charge within 30 days at the latest. Requests about site records in a SyncSite used by a business should go to that business; if they reach us, we forward them and let you know. If you are not satisfied with our reply, you may complain to the Turkish Personal Data Protection Board.

10. Children

SyncSite is a work app for businesses and their staff and is not directed at people under 18.

11. Changes

We update this notice as the product changes; the date is shown at the top. For important changes (a new service provider, a change of server location, a change in the status of the transfer abroad) we will notify you in the app or by email.

Google Play™ and Android™ are trademarks of Google LLC.