This policy explains how Projenator ("we", "Service") collects, uses, and protects your personal data. By using the Service, you agree to this policy.
If you are in Türkiye, our KVKK notice (KVKK Aydınlatma Metni) explains how ZincirX A.Ş., as data controller, processes your personal data.
1. Data We Collect
Data you provide directly
- Account information: Name, email address, password (encrypted)
- Project content: Ideas, descriptions, tags, chat messages, questionnaire answers, score data, plan phases and tasks
- Deliverable contact details: Presenter name, title, organization, email, phone, website, logo URL, and call-to-action text that you enter when generating presentations or infographics
- Team information: Team name, member emails, roles
- Payment and invoice information: Required for billing: invoice type, name or company name, tax number or national ID number, tax office, address and billing country (payments are processed via the payment provider — we do not store card data)
Automatically collected data
- Usage data: Pages visited, features used
- Technical data: IP address, browser type, device information
- AI usage logs: Request count, token consumption (for billing and quota purposes)
Data from third parties
- Social login: When you sign in with Google or Facebook, we receive your name, email, and profile photo.
2. How We Use Data
- Provide the Service, manage your account, and offer support
- Run AI models (Google Gemini and Anthropic Claude) on your behalf
- Generate deliverables such as presentations and infographics, and expose them via shareable links
- Process payments and generate invoices
- Security, fraud detection, and abuse prevention
- Measure how the website is used (Google Analytics; only with your cookie consent, section 8)
- Measure the results of our Google ads and show our ads again to people who visited the site (Google Ads; only with your consent to advertising cookies, section 8)
- Meet legal obligations
3. AI and Third-Party Services
Projenator uses the Google Gemini API and the Anthropic Claude API for AI operations. Your chat messages, questionnaire answers, project content, and score/plan data are sent to either Google or Anthropic's API servers — depending on the engine you select — to generate AI responses. You choose the engine per deliverable via the "AI Engine" toggle on the Attachments screen. Providers process this data under their own privacy policies.
- Google Gemini: ai.google.dev/terms
- Anthropic Claude: anthropic.com/privacy
Payments use Stripe and (for mobile subscriptions) Google Play Billing; card data is sent directly to the provider's PCI-DSS compliant infrastructure — we do not store card data.
For web purchases by customers whose billing country is Türkiye, the seller is ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. and payment is taken through iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.) on zincirx.com. For these purchases your name, email and invoice details (invoice type, name or company name, tax number or national ID number, tax office, address) are passed to ZincirX A.Ş. to issue the invoice, and your payment details to iyzico to process the payment. Web payments by customers everywhere else are processed by Stripe for ZincirX Inc.
On the web UI, downloading the Gantt chart as PNG/PDF pulls the html2canvas and jsPDF libraries from jsDelivr CDN into your browser. The export runs entirely client-side; content is not sent outside Projenator.
3.1 Public Share Links
Each presentation and infographic you generate is reachable through a publicly accessible URL (/d/{token}) containing a random share token. Anyone who knows the URL can view and download the deliverable. Securing the URL is your responsibility.
The contact details you enter in Deliverable Settings (presenter name, title, organization, email, phone, website) are embedded in the generated presentation and infographic and will be visible to anyone who opens the share link. This is by design so you can send pitches to investors, grant committees, or customers. Do not include information you do not intend to share. To revoke access, delete the corresponding deliverable.
4. Data Sharing
We do not sell or rent your personal data. We share it for advertising purposes only with Google, and only if you accept advertising cookies in the cookie banner (section 8). Data is shared with third parties only in these cases:
- Our service providers (Google Gemini, Anthropic Claude, Stripe, iyzico, Google Play Billing, email service, jsDelivr CDN) — only to operate the Service
- Google LLC (Google Analytics) — only if you accept analytics cookies, to measure how the website is used (section 8)
- Google Ireland Limited (Ireland) and Google LLC (USA) (Google Ads) — only if you accept advertising cookies, to measure the results of our Google ads and for remarketing (section 8)
- For web purchases from Türkiye: ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş., the seller, which issues the invoice, and the payment institution iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (iyzico) — payment and invoice data
- Anyone you send a share link (
/d/{token}) to — content you have chosen to disclose - Legal requirements (court order, official request)
- Team members — people you add to your team can see your projects within the Service
5. Data Security
- All data is transmitted encrypted over HTTPS
- Passwords are stored hashed with bcrypt — no plaintext passwords
- Database backups are stored encrypted
- Two-factor authentication (2FA) is available
6. Data Retention
- Your account data is retained as long as your account is active
- Generated presentations and infographics remain stored alongside their project until you delete them; deleting a project cascades to its deliverables
- When you delete your account, all projects, deliverables, and contact details are immediately permanently deleted
- Invoice records are kept anonymously for 5 years as required by Turkish tax law
- System logs are retained for 30 days for security purposes
7. Your Rights (KVKK / GDPR)
Under the Turkish Personal Data Protection Law (KVKK) and applicable regulations, you have the right to:
- Learn whether your data is being processed
- Access your data and obtain a copy
- Request correction of inaccurate data
- Request deletion of your data
- Object to processing
To exercise your rights: privacy@projenator.com · Data deletion page
8. Cookies
The website uses the cookies and browser storage below. The ones that are not strictly necessary (analytics and advertising) run only if you accept each of them in the site's cookie banner; until you do, no request is sent to Google. Advertising cookies are off by default, and accepting analytics does not turn them on.
- Session cookie (projenator-session, strictly necessary): keeps you signed in and remembers your language; expires after a period of inactivity.
- XSRF-TOKEN (strictly necessary): protects forms against cross-site request forgery; expires with the session.
- Remember-me cookie (strictly necessary; only if you tick “Remember me” when signing in): keeps you signed in on that browser until you sign out.
- Your cookie choice (strictly necessary;
zx_consentin the browser's local storage): your accept or reject and its date; you are asked again after 6 months. - Google Analytics 4 (analytics; Google LLC, USA; only with your consent): the
_gaand_ga_<ID>cookies, kept for up to 2 years. It measures the pages you visit (with secret parts of the address removed), when, your browser and device, and an approximate location derived from your IP address, plus the sign-up, checkout and purchase steps (amount, currency and order number). - Google Ads (advertising; Google Ireland Limited, Ireland, and Google LLC, USA; only with your consent): cookies whose names start with
_gcl_, such as_gcl_auand_gcl_aw, kept for up to 90 days. The purpose is to measure the results of our Google ads (whether a visitor who came from an ad signs up or buys) and to show our ads again, on Google and Google's ad network, to people who visited the site (remarketing). No separate advertising script is loaded: advertising consent lets the Google Analytics tag use advertising cookies, so it only takes effect if you also accept analytics. Google receives the ad click ID (gclid) if you came from a Google ad, the pages you visit (with secret parts of the address removed), your browser and device, your IP address, and the sign-up, checkout and purchase steps (amount, currency and order number); never your name, e-mail address or phone number (plain or hashed) or your project content. Google may also use cookies on its own domains (such as google.com and doubleclick.net) for measurement and remarketing, and processes this data under its own terms (how Google uses information from sites that use its services).
The legal basis for advertising cookies is your explicit consent (KVKK Art. 5(1); GDPR Art. 6(1)(a) for visitors in the European Union). The data is transferred abroad (to Ireland, the USA and other countries where Google processes data); this transfer relies not on a standard contract but on the explicit consent you give by accepting advertising in the cookie banner. Before you consent, please note the risks: your data may be processed in countries that do not guarantee the level of protection you have in Türkiye, and may be accessed by those countries' public authorities; and exercising your rights against Google may be harder than in Türkiye.
You can change your choice or withdraw consent at any time from the “Cookie settings” link at the bottom of the page: withdrawing analytics stops Google Analytics and deletes the _ga cookies the site can delete; withdrawing advertising tells the Google tag at once that advertising consent is withdrawn and deletes the _gcl_ cookies the site can delete. Withdrawal does not affect processing based on your consent before it.
9. Children's Privacy
The Service is not designed for children under 16. We do not knowingly collect data from children under 16.
10. Policy Changes
This policy may be updated. Significant changes will be communicated via email.
11. Contact
For privacy questions: privacy@projenator.com