Privacy notice

01Data controller

• Company: [Company legal name]
• Address: [Address]
• MERSIS no.: [MERSIS no.]
• Registered e-mail (KEP): [KEP address]
• E-mail: [email protected]

02Our role

Quadrat processes personal data in two capacities:

• As data controller: for visitors to usequadrat.com, people who contact us or request a demo, and users of customer accounts (account, session and security records).
• As data processor: for data from the cameras of our customers, the businesses that use Quadrat. The business decides whether to monitor with cameras, which cameras to connect, which commands to write and how long records are kept. The business is the data controller for this data, and Quadrat processes it on the business’s instructions and under its contract with us.

If you are in view of a business’s camera, please contact that business first for information and to exercise your rights. We forward any such requests we receive to the business concerned.

03Personal data we process

Website visitors. usequadrat.com uses no cookies, analytics or advertising trackers, and serves all files, including fonts, from our own servers. The infrastructure providers hosting the site (Railway and Cloudflare) may process technical connection data such as your IP address, browser details and the page requested, in order to deliver it.

Contact and demo requests. When you write to [email protected]: your name, e-mail address, business details and the content of your message.

Customer users (app.usequadrat.com):

• Identity and account data: name, e-mail address, role, language preference, time of last activity.
• Sign-in data: a one-way hash of the password only; the two-factor secret (encrypted) and hashes of recovery codes.
• Session records: IP address and browser details.
• Security and audit records: IP address, the action performed, and the e-mail address typed in failed sign-in attempts.
• Notification channel details: e-mail address, Telegram chat ID or webhook URL (stored encrypted), and Telegram account links.

Camera data processed on behalf of businesses (as processor):

• Live video: Quadrat Box analyzes the cameras on the business’s premises. Only the last few frames are held briefly in the box’s memory, are never written to disk, and no continuous video stream is sent to the cloud.
• Semantic traces: for each camera, the box turns segments of up to 30 seconds into numerical feature vectors and sends them to the cloud. They are linked to a camera and a time and make it possible to search by appearance, so they are not anonymous; we treat them as personal data.
• Event records: time, camera, the command that triggered the event, the AI’s short description of the scene, a confidence score and the user who acknowledged the event.
• Verification frames: when a command matches, up to 8 frames are sent to our server and from there to a vision AI provider abroad for verification (see Transfers). In the default mode Quadrat does not store these frames; they are cleared from our server’s memory once the check is done.
• Image recording (optional): for businesses that turn on image recording under their contract, up to 4 frames from the alarm moment are stored, encrypted with AES-256-GCM using a key specific to that business.
• Commands and searches: the command and search text users write, and camera names. This text may contain people’s names or details of the premises.
• Device records: the box’s health and error logs.

04Purposes

• Providing the service: analyzing cameras, detecting and verifying events, sending notifications and searching past records.
• Creating and managing accounts, authentication, and sending invitation, password reset and verification code e-mails.
• Information security: preventing unauthorized access and misuse, session management, audit records and rate limits.
• Responding to contact, demo and support requests.
• Meeting contractual and legal obligations, and protecting our rights in the event of a dispute.

05How we collect data and legal grounds

Personal data is collected partly or fully by automated means: through the fields you fill in on the site and dashboard, e-mail correspondence, the cameras via Quadrat Box, and records our systems keep automatically.

For the data we process as controller, we rely on the following grounds in Article 5(2) KVKK:

• It is directly necessary for entering into or performing a contract (point c): managing accounts and providing the service.
• It is necessary to comply with a legal obligation (point ç).
• It is necessary to establish, exercise or defend a right (point e).
• Our legitimate interests, provided they do not harm your fundamental rights and freedoms (point f): security records and replying to contact requests.

For camera data, determining the legal ground and informing people in view of the cameras is the responsibility of the business as data controller.

06Recipients and transfers abroad

We work with the service providers below to run the service. Many of them are outside Türkiye, so your personal data is transferred abroad:

• Railway (USA): application servers and database. Account data, event records, semantic traces, commands and security records are stored on servers in the USA.
• Cloudflare: DNS and content delivery; storage of encrypted frames for businesses with image recording turned on (R2, storage region: [R2 storage region]).
• OpenRouter (USA) and the vision AI provider OpenRouter routes the request to: verification frames. Requests are sent with a setting that requires the provider not to retain the data or use it for training. The provider’s country may vary with routing.
• Google (Gemini API): command and search text and camera names, to turn commands into rules and to run searches.
• Resend (US-based): invitation, password reset, verification code and alarm e-mails. If the business chooses, photos are attached to alarm e-mails.
• Telegram: alarm notifications and, if the business chooses, photos, only if the business selects this channel.
• Webhook URLs set by the business: event notifications are delivered to systems the business specifies.
• Competent public authorities: only where a legal obligation applies.

Transfers abroad are made under Article 9 KVKK on the basis of [Transfer safeguard under Article 9].

Notifications and attached photos sent to Telegram or by e-mail remain in the recipient’s account or mailbox; Quadrat cannot delete them afterwards.

07Retention

• Event records, semantic traces, device records and, if image recording is on, encrypted frames: deleted automatically after the period the business chooses (30, 90, 180 or 365 days; 90 days by default).
• Verification frames: not stored by Quadrat; cleared once the check is done.
• Commands, camera details and notification channels: until the business deletes them.
• User accounts: until the account is removed.
• Session records: when the session expires; rate-limit records are deleted after 2 days.
• Security and audit records: [Audit log retention period].
• A business’s data after its contract ends: deleted within [Post-termination deletion period].
• Database backups and server logs: [Backup retention period].

08Security measures

• Passwords are stored only as one-way hashes; two-factor authentication is supported.
• Notification channel details and two-factor secrets are encrypted.
• Camera connection details are encrypted in the browser with the box’s key; our servers never see them in the clear.
• The link between the box and the cloud is encrypted with TLS, and every box has its own identity.
• Quadrat staff access to customer data is read-only, requires a stated reason and is logged.

09Your rights

Under Article 11 KVKK, you may apply to the data controller to:

• find out whether your personal data is processed,
• request information if it has been processed,
• find out the purpose of processing and whether the data is used for that purpose,
• know the third parties in Türkiye or abroad to whom it has been transferred,
• have it corrected if it is incomplete or inaccurate,
• have it erased or destroyed under the conditions in Article 7 KVKK,
• have third parties to whom it was transferred notified of any correction, erasure or destruction,
• object to a result against you that arises solely from automated analysis of the data,
• claim compensation if you suffer damage from unlawful processing.

10How to apply

Send your request in writing, in Turkish, to [Address], to our KEP address [KEP address], or from an e-mail address registered in our system to [email protected]. Please state your full name, contact details and what you are asking for.

We reply within 30 days at the latest, free of charge. If handling the request involves a separate cost, a fee may be charged according to the tariff set by the Personal Data Protection Board.

For requests about a business’s camera records, please contact that business; we forward any such requests we receive to it.

11Cookies

usequadrat.com does not use cookies and contains no analytics, advertising or tracking tools.

The customer dashboard (app.usequadrat.com) uses only these cookies, which are strictly necessary for the service to work:

• quadrat-session: keeps you signed in. It cannot be read by scripts in the browser and is only sent over secure connections. It lasts 14 days if “Remember me” is selected, otherwise until you close the browser.
• quadrat-locale: remembers the dashboard language; kept for 1 year.

You can delete or block these cookies in your browser, but you will then be unable to sign in to the dashboard.

12Changes

We may update this notice as the service or the law changes. The current version is always on this page, with the date of the last update at the top.