Privacy Policy

1. Who is responsible? (Controller and processor)

ProdTrack
Address: Sakarya / TÜRKİYE
E-mail: [email protected]

• In ProdTrack Standards you create your own account; ProdTrack is the controller.
• In ProdTrack UTP, Logistics and SKDM your account is created by the company you work for (our customer), which decides why your data is processed. Your company is the controller; ProdTrack is the processor that provides the service on the company's behalf and instructions (KVKK Art. 12, GDPR Art. 28). Please send requests about your UTP data to your company first; if you cannot reach them, write to us and we will forward your request.

2. Data processed in Standards

• Identity and contact: first and last name, e-mail address, phone (optional).
• Professional details: job title, company name, personnel certification details (optional). These appear as "inspector" on the inspection reports you prepare.
• Account and security: your password (only a one-way hash is stored, never the password itself), e-mail verification and password reset codes, the dates of your privacy consent and marketing permission.
• Sign in with Google or Apple: the account identifier, e-mail address and name provided by that provider. If you use Apple's "Hide My Email", the relay address created by Apple is stored. Your Google or Apple password never reaches us.
• Session and device: IP address, browser details, session start and last access times; in the mobile app, device model, operating system, app version and push notification token.
• Content: assessments, measurements, inspection reports, finding photos and descriptions, report templates, company logo and details you save.
• Membership: your plan, plan requests and usage (number of reports, storage). Payments are made by bank transfer; card or bank account details are not processed by the service. There are no in-app purchases.

Face ID / fingerprint sign-in is handled entirely by your device's operating system; biometric data is never sent to or processed by us.

3. Purposes and legal bases in Standards

• Creating your account, authentication, sign-in and sessions; providing assessments, reports, photos and QR verification; managing plans and usage limits — performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
• Security, preventing abuse and unauthorised access (e.g. limiting failed sign-in attempts), fixing errors — legitimate interest (Art. 5/2-f; GDPR Art. 6(1)(f)).
• Service e-mails and app notifications about your account, plan and reports — performance of a contract. You can turn notifications off in the app's Account screen.
• Legal retention and reporting duties, requests from competent authorities — legal obligation (Art. 5/2-ç; GDPR Art. 6(1)(c)).
• Campaign and product news — only with the explicit consent you give at sign-up (Art. 5/1; GDPR Art. 6(1)(a)). You can withdraw consent at any time.

4. Sharing and QR verification in Standards

If you join a company workspace, reports created in that workspace and your name are visible to other users of the same company. The QR verification page shows people who have the code only the summary needed to verify a finalised report: report number, revision, date, issuing company, part and drawing number, inspector name, acceptance level, number of findings and result.

5. Data processed in UTP

UTP is business software used by steel construction and manufacturing companies to manage production, quality, shipping and warehouse processes. Accounts are created only by the company administrator; you cannot sign up yourself in the app.

• User and staff details: name, work e-mail, phone (optional), department, position and role, staff (registry) number, profile photo (optional), language and notification preferences.
• Work records: production operations you perform or approve, QR scans, quality inspections, non-conformance (NCR) records, goods receipt, shipments, consumable hand-overs, shift handovers; each with date, time and the user who created it. For EN 1090 traceability, who processed a part and when is kept.
• Staff management (if your company uses it): attendance and man-hours, shifts, work plans, welder certificates and expiry dates, equipment assignments and staff card details.
• Files and photos: photos, documents, drawings and certificates attached to records.
• Connect (messaging): your messages, attachments and read receipts. Messages are shown only to the members of the conversation. Customer and subcontractor users cannot see Connect.
• Security and sessions: password (one-way hash only), two-factor authentication for manager accounts (Google / Microsoft Authenticator), session records, IP address, approved mobile devices and the audit log.
• Device details (mobile and desktop): device ID, model, operating system, app version, push token and device time (so records show when they were really made).
• Customer and subcontractor portal users: name, e-mail, company; only the projects, orders, shipments and work orders shared with them.

6. Mobile app permissions

ProdTrack Mobile (UTP) and ProdTrack Standards ask for device permissions only when you use the related feature. If you decline, the app keeps working; only that feature is unavailable. You can revoke permissions at any time in your device settings.

Camera

• Why: to scan QR codes on parts, packages, materials and staff cards, and to attach photos to quality inspections, non-conformances (NCR), goods receipts, shipments and Standards inspection reports.
• How: the camera runs only while you have a scan or photo screen open. QR scan images are processed on the device and are neither stored nor sent anywhere. A photo you take is uploaded only to the record you attach it to, in your own company's portal.
• Location in photos: before upload, photos are resized and their location metadata (EXIF/GPS) is removed.
• If you decline: you can type the code or use a handheld / barcode scanner.

Photo library

• Only photos you choose are read; the app has no access to the rest of your library.
• When you save a photo received in Connect, permission is asked only to write that photo to your library.

Location

• Why: only for two things: (1) digital proof of delivery — your location at the moment you confirm a delivery is written to the delivery record; (2) trip recording (ProdTrack Logistics) — recording the route while you are out on an approved trip in a company vehicle.
• How trip recording works: recording starts only after the gate has checked you out and you tap "I'm leaving", and lasts until the vehicle's return is checked in. During that time recording continues while the screen is locked; your phone shows the location indicator (iOS) or a persistent notification (Android). No location is collected after the trip ends or the permit is closed; the server rejects location data for a permit that is not out.
• The app never asks for "Always" (background) location permission and does not collect your location unless you start a trip. Location is never used for advertising or profiling.
• Who can see it: the trip route is visible only to the permit holder, the people in your company authorised to approve vehicle permits, and the portal administrator; gate security cannot see it. The location on a proof of delivery is emailed to the customer as a PDF together with the record itself (signature, photos, notes on missing / damaged items).
• Retention: trip route points are deleted automatically after 90 days; the permit record and total distance stay in your company's records.
• If you do not grant permission, the proof of delivery is saved without location; the rest of the app keeps working.

Microphone

• The microphone is used only while you press the record button; the app does not listen in the background.
• Connect voice messages: a voice message you record is uploaded to your company's server and can be played by the participants of the conversation you send it to. Like other chat messages it is kept for your company's retention period. When you delete a message it is removed from the conversation; for audit and traceability the record may be kept on the server, flagged as deleted, for your company's retention period.
• Voice questions to the assistant and dictation: your speech is converted to text by your device's speech recognition service (Apple or Google); only that text is sent to ProdTrack. This audio is neither sent to nor stored by ProdTrack.

Face ID / Touch ID / fingerprint

Optional, for quick sign-in. Biometric checks are done entirely by your device's operating system; the app only receives "verified / not verified". Your biometric data never leaves your device.

Notifications

Push notifications are sent for assignments, approvals, messages and critical alerts, using a device-specific token via Apple Push Notification Service and Google Firebase Cloud Messaging (through Expo). You can turn them off in your device settings or in the app under Profile › Notifications, and set quiet hours.

Data stored on the device

• To work offline, records related to your work are stored on the device in a per-user, encrypted database whose key is kept in the device's secure storage (iOS Keychain / Android Keystore).
• Confidential data such as quotations and costs is never downloaded to the device.
• Local data is deleted when you sign out or when your company administrator disables the device from the portal.
• On shared workshop tablets each user's data is kept separate.

Device information and error reports

• Device information: device ID, model, operating system and app version, push token and device clock; used to approve your account and device, deliver notifications and timestamp records correctly.
• Error reports: when an error occurs in the app, the error type and a short description, the screen / action name, app and OS version, the device ID and a reference number (e.g. H-XXXXXX) are sent to your company's server. Request contents, passwords, session keys and QR contents are never sent; email addresses and key-like values in messages are masked.
• Error reports are visible to your company's authorised administrator; if you ask for support with the reference number, the ProdTrack support team may review it only to solve the problem. Error records are deleted automatically after 30 days.
• No data is collected for advertising, analytics or tracking, and data is not shared with third-party advertisers or data brokers.

7. Purposes and legal bases in UTP

• Running your company's production, quality, shipping, warehouse and staff processes and keeping work records — your employment relationship and the company's legal obligations (KVKK Art. 5/2-c, 5/2-ç; GDPR Art. 6(1)(b), (c)).
• Traceability and record keeping required by EN 1090, ISO 3834 and similar quality standards — legal obligation and legitimate interest (Art. 5/2-ç, 5/2-f; GDPR Art. 6(1)(c), (f)).
• Account security, device approval, two-factor authentication, preventing abuse, fixing errors — legitimate interest.
• Sending notifications and e-mails (assignments, approvals, reports) — performance of a contract.
• Checking the company's licence and usage limits — performance of a contract.

8. AI (assistant) features

If included in your company's plan, UTP offers AI features such as the assistant, NCR drafts from photos and summaries.

• When you make a request, your request and the record details needed to answer it are sent to the provider chosen by your company: Anthropic (Claude) or OpenAI (GPT).
• Under these providers' business API terms, submitted data is not used to train their models.
• AI answers are suggestions only. Approvals, rejections and quality decisions are always made by an authorised person; no automated decision with legal or similar effect is made about you.
• Your company can turn AI features off.

9. What company systems send to the central service

Each company's portal runs on its own subdomain and database; one company's data is never visible to another. A portal sends getprodtrack.com only:

• Licence verification: installation ID, domain and usage counts that contain no personal data (e.g. number of users and projects).
• File integrity check: hash values (SHA-256) of software files. These are not personal data.
• Sign-in directory: so you can sign in to the mobile app without typing a company address, only a one-way hash (SHA-256) of your e-mail address and the company it belongs to. Your e-mail address itself is not stored centrally.

ProdTrack staff access company data only when the company requests support, in a security incident or where required by law, and only as far as necessary.

10. How data is collected

Through sign-up and profile forms, accounts created by your company administrator, use of the web portals and the mobile and desktop apps, QR scans, files you upload, Google / Apple sign-in (Standards only) and technical information sent automatically by your device.

11. Transfers and service providers

Your personal data is not sold, not used for advertising and not shared with third parties for marketing. It is transferred only to the following providers, only as needed to run the service:

• Servers, storage and backups: Hetzner Online GmbH (data centres in the European Union).
• App notifications: Expo (650 Industries, Inc.), Google Firebase Cloud Messaging, Apple Push Notification Service.
• Sign-in (Standards only): Google LLC and Apple Inc., only if you choose these methods.
• AI (UTP only, if enabled by your company): Anthropic PBC and OpenAI, L.L.C.
• E-mail: ProdTrack's own mail server or the SMTP server configured by your company.

Some providers are located abroad; transfers are made with the safeguards required by KVKK Art. 9 and the GDPR (e.g. standard contractual clauses). In UTP, your work records and name are visible to authorised users in your company and, to the extent your company chooses to share, in the customer and subcontractor portals. Information may be provided to competent public authorities on request.

12. Retention

• Standards: data is kept while your account is open. When you delete your account, your profile is anonymised and your personal reports, assessments and photos are deleted. Reports created in a company workspace belong to the company and remain there.
• UTP: data is kept for as long as your company's contract with ProdTrack runs and its retention policy requires. Production and quality records may be kept for years under EN 1090 and related laws; after your account is deleted, your name in those records is anonymised. When the contract ends, company data is handed over to the company and deleted within a reasonable time.
• Session and security logs are kept for a limited period for security.
• Trip route points (Logistics): deleted automatically after 90 days.
• Mobile app error records: deleted automatically after 30 days.
• Backups are encrypted with AES-256 and kept in separate storage (Hetzner Object Storage). In UTP the last 3 days are kept by default (the company can choose 1–30 days); expired backups are deleted automatically.
• Records that the law requires us to keep longer are kept for that period.

13. Deleting your account

ProdTrack Standards

• In the mobile app: Account › Delete account. Your account is deleted immediately.
• On the web: send an e-mail with the subject "Account deletion request" from your registered address to [email protected].

ProdTrack UTP and its mobile app

• In the mobile app: start a deletion request under Profile › Account › Delete my account. The request goes to your company's portal administrator.
• Without the app: contact your company administrator, or e-mail [email protected] from your work address with the subject "UTP account deletion request", naming your company.
• Timeline: your request is completed within 30 days at the latest and you are informed.
• Deleted: your account, sign-in details, profile photo, push tokens, device records and notification preferences, and local data on your device.
• Anonymised, not deleted: production, quality, shipping and traceability records the company is legally required to keep. Your name in these records is replaced with "deleted user".
• When you leave your company, your administrator can also close or delete your account.

14. Cookies and local storage

• The web portals use only strictly necessary cookies that keep you signed in (e.g. pts_sid in Standards, WordPress session cookies in UTP).
• Language, theme and display preferences are kept in your browser's local storage.
• No advertising, analytics or tracking cookies are used.
• In the mobile apps, session keys are stored in the device's secure key store (iOS Keychain / Android Keystore).

15. Security

• All connections are encrypted with HTTPS (TLS).
• Passwords and session keys are stored only as one-way hashes; manager accounts use two-factor authentication.
• Mobile devices are used with administrator approval; a lost device can be disabled from the portal and its local data wiped.
• Offline data in the mobile app is stored encrypted.
• Each company's data is kept in a separate database; permissions are role-based, so users see only the screens and records they are authorised for.
• Failed sign-in attempts are limited; important actions are written to an audit log.
• Backups are transferred to separate storage over encrypted connections.

16. Children

The services are intended for professionals in welding, quality and manufacturing. They are not directed at anyone under 18, and we do not knowingly collect data from anyone under 18.

17. Your rights

Under KVKK Art. 11 you may learn whether your data is processed and request information about it; learn the purpose and whether it is used accordingly; know the third parties it is transferred to in Türkiye or abroad; ask for incomplete or incorrect data to be corrected, for deletion or destruction under KVKK Art. 7 and for these actions to be notified to recipients; object to a result against you arising solely from automated analysis; and claim compensation for damage caused by unlawful processing. If you are in the EU, you also have the GDPR rights of access, rectification, erasure, restriction, data portability and objection, and you may complain to your local data protection authority.

Send requests from your registered e-mail address to [email protected] or in writing to the address above. Requests about UTP are handled together with your company as controller. Requests are answered free of charge within 30 days at the latest.

18. Changes

This policy may be updated. We will inform you of significant changes by e-mail or in the app. The current version is always published on this page; the date at the top shows the last update.