Privacy Notice (KVKK / GDPR)

Controller. Tetracta — a Türkiye-based team operating in stealth during this pre-launch period. The formal registered entity name and full postal details will be published at launch. For any data request or privacy question, email [email protected].

What we store. If you apply for access: the details you enter on the application form — name, work email, organization, website, role, model family/size, deployment status, use-case note, country and referral — kept solely to review your request and reply, and forwarded to our own inbox by email (see Subprocessors). If you hold an account: account email + scrypt-hashed password; job metadata (model repo IDs, timestamps, status); generated reports. We do not store your model weights — they live only on the scan worker for the duration of the job and are wiped (signed deletion attestation per job). Private HF tokens are used once and permanently deleted from the job record on completion. No raw IP address is stored; IP is used transiently for rate-limiting only.

Legal bases. Account & scan processing: GDPR Art. 6(1)(b) — steps taken at your request to provide the service (and, before any contract, pre-contractual steps); plus Art. 6(1)(f) legitimate interest in operating and securing the service. Access applications: Art. 6(1)(b) pre-contractual + Art. 6(1)(f) reviewing your request. KVKK equivalents (m.5) apply. No sensitive-category data is processed.

What we never do. No training on your models. No telemetry from your artifacts. No sale/sharing of your data. No tracking cookies — only a security-only signed session cookie.

Report retention & self-serve deletion. Reports stay in your account until you delete them: every scan has a Delete action on your dashboard with a two-step confirmation. Deletion is immediate and irreversible — the report file, measured metrics, images and the job record are erased and no copy, backup or content log is kept. Share links stop working the same moment. Account/application data is kept up to 12 months after our last contact, then deleted.

Your rights. You may request access, rectification, erasure, restriction, objection, and data portability for anything you submitted (GDPR Art. 15–22; KVKK m.11). Email [email protected] — we log every request and act within 30 days. You also have the right to lodge a complaint. As Tetracta is established in Türkiye, our supervisory authority is the KVKK (Kişisel Verileri Koruma Kurumu); if you are in the EU/UK you may also complain to your own national data-protection authority.

Subprocessors. Hetzner (EU hosting) · RunPod (GPU, large-model jobs; US/EU) · Hugging Face (model registry, fetch-only; US) · Google Workspace (email — application and invite correspondence; EU/US) · payment provider (merchant-of-record; upon payment launch). Cross-border transfers rely on the providers' standard safeguards; an EU-region storage option is available for enterprise on request.