1. Controller
Controller: Santix. Contact: destek@santix.app.
The construction company (organisation) using Santix is the controller for content uploaded to its projects (drawings, notes, photos, documents, budget and payment records, staff and subcontractor details); Santix processes that data on the organisation’s behalf and instructions as a processor.
2. Personal data processed
| Category | Data |
|---|---|
| Identity | name, job title |
| Contact | email, phone; the organisation’s address and billing email |
| Customer transactions | organisation name, tax number and office, plan, seats, purchase records |
| Security | password hash, session data, audit log, push token and device name |
| Images and audio | photos, videos and voice notes uploaded from site |
| Professional and project data | users’ project roles, assigned items, comments, documents; supplier and subcontractor contacts and bank (IBAN) details |
| Requests | contact form and support emails |
No location data, special categories of personal data or advertising identifiers are collected. Documents uploaded by organisations (e.g. safety training records) may contain staff data; they are kept on the organisation’s instructions.
3. Purposes
Account creation and authentication; organisation, project and role management; providing the site and project management service; subscriptions, seat limits and invoicing; notifications and reminders; generating AI suggestions; information security, permission checks and legal obligations; answering requests and support.
4. Transfers
Data is transferred, limited to these purposes, to our service providers: Supabase (database, auth, files; EU, Frankfurt), Google Cloud Run (drawing processing; EU, Frankfurt), Cloudflare (website, web panel, relay), OpenAI (only when AI features are used; USA), RevenueCat and Apple (subscriptions and payments; USA), Expo (push delivery; USA). Because some providers are abroad, transfers fall under KVKK art. 9 and rely on standard contracts as the appropriate safeguard. Data may also be disclosed to authorities where the law requires. Project content is visible to other users of the same organisation according to the roles the organisation sets.
5. Collection method and legal bases
Data is collected electronically through the mobile app, the web panel and the santix.app contact form, entered by you or your organisation or generated automatically while using the service. Legal bases: performance of a contract (art. 5/2-c), legal obligation (5/2-ç), establishing, exercising or defending a right (5/2-e) and legitimate interest (5/2-f). Marketing messages are sent only with explicit consent.
6. Your rights
Under KVKK art. 11 you can learn whether your data is processed, request information, learn the purpose and whether it is used accordingly, know the recipients in Turkey or abroad, request correction, deletion or destruction, request that recipients be notified, object to an adverse result arising solely from automated analysis, and claim compensation for unlawful processing. Send requests to destek@santix.app with enough information to verify your identity; we respond free of charge within 30 days. See also the privacy policy.