Privacy Policy

ItemDraft (itemdraft.com, the "Service") is operated by Özgür IŞIKOĞLU, an individual in Türkiye, not a company ("we", "us"). We are the controller of the personal data described in this policy. Contact: privacy@itemdraft.com. A postal address is available on written request during this free beta.

During the beta the Service is intended for users in the United States only and is not offered in the European Economic Area or the United Kingdom.

[If you offer the Service to people in the EU or UK and are established outside them, an EU/UK representative under GDPR Art. 27 may be required. Ask your lawyer and add the details here, or delete this paragraph.]

• Account data: your email address and a password (stored only as a hash by our authentication provider), plus verification and password-reset events.
• Content you upload: product photos, and the analysis generated from them (title, price range, description, keywords). We store your email address alongside each analysis so it can be linked to your account.
• Technical data: IP address, browser and request logs created by our hosting and infrastructure providers, and the counters we use to limit how many analyses can be run per hour.
• Usage events: we record in our own database simple events about how the Service is used, such as that an analysis was created or failed, the language, currency and market you selected, which result sections you copy, and whether you rated a result as useful. These events do not contain your photos or the generated text, and we do not use third-party analytics or advertising trackers. We also record which page you viewed, roughly how long you stayed, and, when our host supplies it, the country code of that signed-in visit. These events do not store your IP address or a precise location. We also store any written feedback you send.
• Consents: the date and version of the terms, privacy, AI-processing and responsibility acknowledgements you accepted.
• Optional update emails: if you opt in, we may email you about product changes, allowances, and announcements. The choice is unchecked, you can skip it and keep using the Service, and you can turn it off or on later from your account page. Turning it on asks you to confirm the same notice. We do not send these messages to members who skipped them or turned them off. Verification, password-reset, and security emails are sent whether or not you opt in.
• Cookies: only the session cookies needed to keep you signed in. See the Cookie Policy.

Please do not upload photos that show people's faces, addresses, licence plates, documents or other personal data. If a photo contains such data anyway, it will be processed as described here.

• To create your account, sign you in and provide the analysis you request (performance of a contract, GDPR Art. 6(1)(b)).
• To send each uploaded photo to our AI provider for analysis (your consent, GDPR Art. 6(1)(a), given once when you create an account or first use the dashboard; you can withdraw it by deleting your account).
• To keep the Service secure, prevent abuse and enforce usage limits, and to measure and improve the quality of the Service using the usage events described above (our legitimate interests, GDPR Art. 6(1)(f)).
• To comply with legal obligations, for example tax and accounting rules once paid plans exist (GDPR Art. 6(1)(c)).

We do not sell your personal data and we do not use your photos to train our own models.

• Supabase (database, authentication and file storage; region: East US, North Virginia).
• Our AI provider (Google, Gemini API) for image analysis. The product interface does not name this provider, but privacy law requires us to name who receives the photos. During the beta we may use a usage tier under which the provider can use submitted content to improve its products and human reviewers may read it. We plan to move to a paid tier with different terms; this policy will be updated when we do. [Confirm the current provider terms that apply to your tier and location.]
• Vercel (website and API hosting), once the Service is deployed there.
• Supabase Auth for verification and password-reset emails. Incoming mail to privacy@itemdraft.com is forwarded to a personal inbox.
• Our administrators can view and delete uploaded photos and analyses for support, security and abuse-handling purposes.

We may also disclose data where required by law or to protect our rights.

We operate from Türkiye and our providers may process data in the EU, the United States and other countries. Where data leaves the EEA or UK, we rely on an adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism provided by the relevant provider. [Lawyer to confirm the mechanisms for each provider.]

• Photos and analyses: until you delete them or your account is deleted.
• Account data: for as long as your account exists.
• Server and security logs: 30 days.
• Backups: removed within 30 days after deletion, where the provider allows.

You can delete any analysis, with its photo, at any time from your dashboard.

Depending on where you live you may have the right to access, correct, delete, restrict or object to the processing of your data, to receive a copy of it, and to withdraw consent. To exercise a right, email privacy@itemdraft.com. We will verify your identity before acting on a request. EU/UK residents can also complain to their data protection authority.

California and other US state residents: you may have rights to know, delete and correct personal information and to opt out of its sale or sharing for advertising. We do not sell or share personal information for cross-context behavioural advertising. You will not be treated differently for exercising these rights.

You can delete your account yourself from your dashboard. Deleting it permanently removes your account, your analyses and your uploaded photos. Anonymised usage events (which no longer identify you) may be kept. Backups are purged on the schedule in section 6.

Analysis results are produced by an AI system and may be wrong or incomplete. They are suggestions, not facts, and no legal decision about you is made automatically. You are responsible for checking content before you publish it.

The Service is not directed at anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

We use access controls, per-user data isolation, encrypted connections and private file storage. No system is perfectly secure; if a breach affects you we will notify you and the authorities where the law requires.

We may update this policy. We will change the date above and, for material changes, notify you in the app or by email.