Privacy Policy
Effective date: September 24, 2026
This policy explains which personal data we process when you use ShipTrack (shiptrack.ensatech.dev), why, who we share it with and what your rights are. It serves as the privacy notice under the EU General Data Protection Regulation (GDPR) and as the information notice under Turkey's Personal Data Protection Law No. 6698 (KVKK).
1. Data controller
The data controller is Ensar Ergan (EnsaTech). For any privacy question or request: destek@ensatech.dev
2. What data we process
| Data | Examples | Why |
|---|---|---|
| Account details | Email, full name, password (hashed only), and the email and name of your Google or GitHub account if you sign in with one | Creating your account, letting you sign in, sending service emails |
| Project content | The ideas you write, generated plans, versions, steps, notes and activity records | The service itself: generating, storing and showing your plan |
| Agent and Otopilot data | Summaries and changed file names sent by agents; if you use Otopilot, the agent's output and the diff of the code changes it made (at most 200 KB); your computer's name, operating system and the list of installed agents | Showing your progress and letting you review what the agent did |
| Project keys | Names (not values) of the environment variables Otopilot finds in your project folder, and their values only if you enter them (encrypted) | Showing missing keys; having Otopilot write the values you enter to the project's .env file on your computer |
| Payment provider connections | Your Stripe or Lemon Squeezy key (encrypted), revenue metrics and recent payments read from that account (amount, date, status, the customer's email address) | Showing the revenue page (only if you connect one) |
| Launch tab | The site address and store IDs you enter; check results read from the public pages and DNS records of those addresses; if you connect them, your key (encrypted) for hosting, database, domain, email, payment, analytics, monitoring and store services (e.g. GitHub, Vercel, Supabase, Cloudflare, Resend, Sentry, App Store Connect, Google Play) and status read from those accounts (e.g. whether the last deploy succeeded, whether the domain is verified, the names only of environment variables) | Ticking off your launch checklist automatically (connections only if you add them, read-only) |
| Technical and usage records | IP address, browser details, error logs, AI usage amount and cost | Security, preventing abuse (e.g. the daily plan limit), debugging |
Your code itself is never sent to our servers: Otopilot runs the agent on your computer and only sends us the summary, output and diff described above. The paths of your project folders stay on your computer.
3. Legal bases
- Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c): account, project, agent and revenue data.
- Legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5/2-f): security records, preventing abuse, improving the service.
- Legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5/2-ç): records required by law.
4. Who we share data with
We don't sell your data or share it for advertising. We work with these service providers to run the service:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database and authentication | EU (Ireland) |
| Vercel | Hosting the application | US and global servers |
| Anthropic (Claude) | Generating a plan from your idea; the idea text and plan content are processed | US |
| Resend | Verification, password reset and notification emails | US / EU |
| Cloudflare | Domain (DNS) management | Global |
| Google, GitHub | Authentication, only if you sign in with these accounts | US |
| Stripe, Lemon Squeezy | Reading revenue data, only if you connect them | US / EU |
| Services you connect in the Launch tab | Reading your account's status, only if you connect them; requests are sent to these services with your key | US / EU |
Under Anthropic's commercial terms, content sent through the API is not used to train its models by default. Data may be shared with competent public authorities when they make a lawful request.
5. International transfers
Some of the providers above are outside Turkey and the EU. These transfers rely on the safeguards provided for by the GDPR and KVKK Art. 9 (standard contractual clauses and the providers' data processing agreements), and only to the extent the service needs.
6. Your customers' data
When you connect a payment provider, your own customers' email addresses and payment details are processed to show them on the revenue page. You are the controller of that data; we only process it on your behalf and on your instructions. Informing your customers about this processing is your responsibility.
7. Retention
- Account and project data: as long as your account is open. When you delete a project, all data linked to it is deleted immediately.
- Recent payments list: refreshed on every sync; at most the last 100 payments are kept.
- Security and usage records: as long as their purpose requires, at most 2 years.
- When you delete your account, your data is deleted within 30 days, except where the law requires us to keep it.
8. Security
- All connections are encrypted with HTTPS.
- Payment provider and Launch tab service keys, and the values you enter for project keys, are stored encrypted with AES-256-GCM and never sent back to your browser; project keys are only passed to the Otopilot on your own computer that is linked to that project.
- MCP and computer connection tokens are stored hashed only.
- Row-level access rules in the database make sure every user can only reach their own data.
9. Cookies
We only use strictly necessary cookies: the session cookie that keeps you signed in and a cookie that remembers your language. We don't use analytics, advertising or tracking cookies. If that changes, we'll update this policy and ask for your consent.
10. Your rights
Under the GDPR and KVKK Art. 11 you have the right to:
- Find out whether your personal data is processed and request information about it
- Learn the purpose of the processing and whether it is used accordingly
- Know the third parties it is transferred to, in Turkey or abroad
- Have it corrected if it is incomplete or wrong, and erased or destroyed where the conditions are met
- Have those actions notified to the third parties it was transferred to
- Object to an outcome against you that results solely from automated analysis
- Claim compensation if you suffer damage from unlawful processing
- Receive your data in a portable format
You don't need to send a request to download a copy of your data or delete your account: you can do both yourself in the "Your data" section of the Account page.
You can send any other request to destek@ensatech.dev. We reply free of charge within 30 days at the latest. If you're not satisfied with our reply, you can complain to the data protection authority of your country or to Turkey's Personal Data Protection Board.
11. Changes
We may update this policy. We'll announce important changes by email or in the app before they take effect.