What does this policy cover?
This policy covers the Santix mobile app (iPhone and iPad), the santix.app website and the Santix web panel where organisations register and see their subscription. Santix is a construction site and project management service sold to organisations, not to individual consumers. The app interface is in Turkish.
Who is responsible for your data?
- Account and subscription data (your name, email, your organisation’s billing details, subscription status): Santix is the data controller.
- Project content (drawings, notes, photos, documents, budget and payment records): the organisation that invited you is the controller. Santix processes this data on its behalf and on its instructions (as a processor).
You can reach us at destek@santix.app. The notice required by Turkish data protection law (KVKK) is on the KVKK notice page.
What data do we collect?
| Data | Examples | Source | Purpose |
|---|---|---|---|
| Account | name, email, password (stored only as a hash), phone and job title (optional) | You | Signing in and letting your team recognise you |
| Organisation | name, tax number, tax office, address, city, phone, billing email | Organisation admin (web panel) | Organisation account and invoicing |
| Project content | drawings (DWG, DXF, PDF), pins and notes, photos, videos, voice notes, comments, scanned documents and the text read from them, contracts, bids, budget and payment records, supplier and subcontractor contact and bank (IBAN) details | You and your team | The site and project management service |
| Invitations | invitee’s name, phone or email, company name | The inviting admin | Joining a team; codes expire after 14 days |
| Notifications | push token, platform, device name | Your device, once you allow notifications | Notifying you about assignments, approvals and reminders |
| Subscription | plan, seat count, status, store transaction details | Apple and RevenueCat | Applying the organisation’s plan and seat limit |
| Usage records | who changed which record and when (audit log); a usage counter for AI features (organisation, user, feature, model, units processed; never content) | Automatic | Accountability, permission checks and a monthly usage limit per organisation |
| Contact form | name, company, email, phone, topic, message | The santix.app contact form | Answering your request |
To let you work without a connection, the app keeps a copy of your projects’ data and any unsent files on your device. Signing out deletes this local copy.
What do we not collect?
- Location. The app does not ask for location access. A pin’s position is a coordinate on the drawing, not GPS. Videos and some photos you pick from your library may contain location metadata added by your device; Santix does not read or use it, but the file is stored as uploaded.
- Advertising and tracking. No advertising identifier, no cross-app tracking, no sharing for advertising, no selling of data.
- Analytics and crash reporting. The app contains no analytics, advertising or crash-reporting SDKs.
- Contacts and card details. Your address book is never accessed. Card details stay with Apple.
Which permissions does the app ask for?
| Permission | Why |
|---|---|
| Camera | Taking photos, videos and document scans on site |
| Microphone | Voice notes and videos on pins |
| Photo library | Adding photos and videos from the library; saving exported reports |
| Notifications | Assignments, approvals and document reminders |
You can turn any permission off in your device settings. The related feature stops working; everything else keeps working.
On what legal basis do we process data?
We process data to enter into and perform the service contract (KVKK art. 5/2-c), to meet legal obligations such as invoicing (art. 5/2-ç), and for legitimate interests such as service security and the audit log (art. 5/2-f). We ask separately before sending marketing messages; saying no does not affect the service.
What data do the AI features use?
AI in Santix makes suggestions; you approve them. When you use an AI feature, only the content that operation needs is sent to OpenAI through Santix’s server on Cloudflare: a document image for document reading; contract variables and your answers (which may include party names, tax numbers and addresses) for contract questions; vendor names, bid totals, duration, payment terms, score and bid notes for the bid comparison summary; column headers, sample rows, room codes and schedule text for Excel and room-schedule matching; layer names for drawing classification.
Your user ID is not sent, and OpenAI is told not to store responses (store: false). OpenAI states that it does not train models on API data; it may keep it for a limited period to monitor abuse. Our servers keep only the usage counter, never the content.
Who do we share data with?
| Provider | What it does | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | EU, Frankfurt |
| Google Cloud Run | Processing DWG, DXF and PDF drawings; files are downloaded temporarily for the job and deleted afterwards | EU, Frankfurt (europe-west3) |
| Cloudflare | santix.app website, web panel and the AI relay (Workers); contact form records; cookieless page-view statistics on the site (Web Analytics) | Global network |
| OpenAI | Only when AI features are used, the content listed above | USA |
| RevenueCat | Subscription status; receives the organisation ID, not your personal ID | USA |
| Apple | App Store, in-app purchase and push delivery (APNs) | USA and other |
| Expo | Delivering notifications: push token, notification title and text | USA |
If phone sign-in is turned on, verification codes are sent by SMS through Netgsm; this feature is currently off. We do not share data with authorities unless the law requires it.
Is data transferred abroad?
The main database and files are kept in the EU (Frankfurt). Under Turkish law (KVKK art. 9) both the EU storage and the US providers above count as transfers abroad; these transfers rely on the safeguards the law provides (standard contracts). See the KVKK notice for details.
How long do we keep data and how can you delete it?
Account data is kept while your account is open. You can delete your account in the app under Ayarlar › Hesabımı sil. Deletion removes your sign-in and account, anonymises your profile and removes your push tokens; closes the organisation if you are its only member; and asks the owner of an organisation with other members to transfer ownership first.
Project records you created belong to the organisation and stay with it; the organisation admin can ask us to delete them. When an organisation leaves the service we export its data on the admin’s request and then delete it. Billing records are kept for the legally required periods. Deleting your account does not cancel an Apple subscription; cancel it in your App Store account settings.
How do we protect data?
Connections are encrypted (HTTPS/TLS). Files are kept in private storage. Each user sees only what their role allows, and this rule is enforced in the database at row level, not only in the app. Budget and payment records are visible only to people the organisation authorises. More on the security page.
What are your rights?
Under KVKK art. 11 (and comparable laws such as the GDPR where they apply) you can ask whether we process your data, request access, correction, deletion or restriction, learn who it was shared with, object to decisions made solely by automated means, and claim compensation for unlawful processing. Write to destek@santix.app; we answer within 30 days. For project content, where your organisation is the controller, we also forward your request to the organisation.
Children
Santix is meant for construction companies and their staff. It is not intended for people under 18 and we do not knowingly collect children’s data.
Changes to this policy
We publish changes on this page with a new date and announce important ones in the app or by email. This version is dated 13 November 2026.