Privacy notice (Turkish Personal Data Protection Law)
Last updated: October 29, 2026
This notice is given under Article 10 of Turkey's Personal Data Protection Law No. 6698 (the "Law") and the communiqué on the duty to inform. It is not a consent form: you are not asked for explicit consent to use the service.
1. Data controller
Emre Yılmaz, the individual who operates ProductionEngine ("ProductionEngine", "we"). When a company is founded this section will be updated with its name and address. Email: info@productionengine.app.
ProductionEngine provides script breakdown, shooting schedules, call sheets and budgeting for film, TV and commercial productions through productionengine.app, app.productionengine.app and the iOS, Android and desktop apps (the "Service").
2. Whose data we process, and in what role
| Group | Who | ProductionEngine's role |
|---|---|---|
| Account holders | Users who sign up with their own email | Data controller |
| Crew members and recipients | Cast and crew an account holder adds to a project; people who receive a call sheet, sides, document or image link | Data processor — the controller is the production company or account holder who added them |
| Site visitors | People who visit productionengine.app | Data controller |
If you are a crew member, please send requests about your data to the production that added you first. If you write to us, we forward the request to the right controller.
3. Personal data we process
- Account holders: email address; optional profile name; if you set a password, only its one-way hash (never the password itself); sign-in records (date, IP address, device and browser); a device token if you turn on push notifications; production company details entered in project settings; if you connect Google Calendar, the access grant Google issues (encrypted); if you enter your own AI key, that key (encrypted); if you agree to promotional emails, the consent record (date, where it was given, wording version, language, the email address at that time); once payments are enabled, billing details and the customer/subscription ID from the payment provider (card details are never stored by us).
- Crew members and recipients (on behalf of the controller): name, role and department, email, phone; personal call times and notes on call sheets; view and acknowledgement stamps of shared links; character, availability, costume and hair-makeup notes on cast cards; photos if the account holder adds them; project change history (who changed which record and when; the record's short label — e.g. a person's name or scene number — stays in the history, old and new field values are not stored).
- Site visitors: server access logs (IP, time, page requested, browser). No advertising trackers or third-party analytics are used.
- Script and breakdown content may contain personal data; notes about real people are the account holder's responsibility. We do not aim to process special categories of data (health, religion, political opinion, etc.); please do not enter such data into the Service.
4. Purposes and legal bases (Article 5)
| Purpose | Legal basis |
|---|---|
| Creating the account, signing in, session security | Formation and performance of a contract (Art. 5/2-c) |
| Storing project data, real-time teamwork, sharing call sheets and documents, delivery by email and push notification | Performance of a contract (Art. 5/2-c); for crew members, the controller's instructions |
| Seen / acknowledgement tracking, reminders | Performance of a contract; legitimate interest (Art. 5/2-f) |
| Invoicing, payment and accounting records (once payments are enabled) | Legal obligation (Art. 5/2); performance of a contract |
| Security logs, abuse prevention, troubleshooting | Legitimate interest (Art. 5/2-f); legal obligation |
| Answering support requests | Performance of a contract; legitimate interest |
| AI breakdown, summaries and schedule suggestions (only when you run the feature) | Performance of a contract (Art. 5/2-c) |
| Aggregated, anonymous usage statistics for product development | Legitimate interest (data is anonymised) |
| Discount, promotion and news emails to people who agreed | Explicit consent (Art. 5/1); prior consent under Law No. 6563 Art. 6 |
| Keeping consent records to prove consent and withdrawal | Legal obligation (Art. 5/2) |
Promotional emails are sent only if you tick the box on the sign-up form or the Account page yourself; the box is never pre-ticked and the Service works without it. You can withdraw at any time, free of charge, on the Account page or with the unsubscribe link in every message. Addresses of crew members added to projects are never used for this. Sending starts only after registration with Turkey's Message Management System (IYS) and upload of the consents.
ProductionEngine does not use your data for advertising, does not sell it and does not use it to train AI models. When you run an AI feature with your own key, the content goes to that provider under your account's terms; for example, Google may use content sent with a free-tier Gemini key to improve its products. If you don't want that, use a paid tier or another provider.
5. Who receives the data, and where
The Service runs on the providers below, whose servers are outside Turkey. The legal basis for regular transfers abroad is the standard contracts published by the Turkish Personal Data Protection Board under Article 9/4. These contracts will be signed with the providers and notified to the Board once the company is founded; this section will be updated then.
| Provider | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, authentication, file storage | European Union (Ireland) |
| Vercel Inc. | Hosting, server functions, access logs | USA / global network |
| Resend Inc. | Sign-in codes, invitations and call sheet emails | USA |
| Apple Inc., Google LLC | iOS and Android push notifications | USA |
| Your browser's push service | Web push notifications (only if enabled; content encrypted) | USA / EU |
| Google LLC | Google Calendar sync (only if you connect it) | USA |
| YouTube (Google LLC), Vimeo, vumbnail.com | Preview images of video links added to a project (loaded when the preview comes into view) and playback; preview images of the site's tutorial videos (when the page opens) and the videos (when played) | USA |
| Open-Meteo, OpenStreetMap | Weather and maps (only a location address or city is sent) | Europe |
| ImprovMX, Google LLC (Gmail) | Forwarding and storing the emails you send to info@productionengine.app (including requests) | EU / USA |
| Anthropic PBC, OpenAI, Google | AI breakdown and summaries (only with your own key) | USA |
| Payment provider (once payments are enabled) | Subscription payment; card details stay with the provider | EU / USA or Turkey |
Data may be disclosed to authorised public bodies under a court order or legal obligation. When you share a link with the Share or WhatsApp button, the message travels through the app you choose and under its terms; ProductionEngine is not a party to that sharing.
6. How data is collected
Through the sign-up and sign-in forms, what you enter in the app, crew lists added by account holders, email and notification interactions (views, acknowledgements), server logs and subscription notices from the payment provider, by automated or partly automated means.
7. Retention
- Account and project data: while the account is open. When you delete your account, your profile and memberships are deleted. Projects that can pass to another admin or member are transferred to them and stay in their account; otherwise the project is deleted entirely. Deleted data may take up to 35 days to leave backups.
- Crew member data: with the project data; personal share links of a removed person close immediately.
- Short share links: deleted 45 days after creation.
- Sign-in and security logs: up to 12 months. Abuse-prevention counters: 1 day.
- Invoices and accounting records: the period required by law (10 years).
- Promotional email consent records: while the account is open; deleted with the account.
- Project change history: up to 180 days; deleted immediately with the project.
8. Your rights (Article 11) and how to apply
You have the right to learn whether your data is processed and request information about it, learn the purpose and whether it is used accordingly, know the third parties it is transferred to, request correction of incomplete or inaccurate data, request deletion under Article 7, request that these actions be notified to recipients, object to an adverse outcome produced solely by automated analysis, and claim compensation for damage.
Send your request from the email address registered in the Service to info@productionengine.app. Requests are answered free of charge within 30 days. If you find the answer insufficient or get no answer in time, you may complain to the Turkish Personal Data Protection Board (Article 14). You can also delete your account directly in the app (Account → Delete account).
9. Security and data breaches
Data is encrypted in transit and at rest; database row-level security (RLS) limits access to project members; share links are signed and expire; AI keys and calendar grants are stored encrypted. If a breach affects your data, the Board is notified within 72 hours and affected people as soon as possible.
10. Changes
When this notice changes, the date above changes; account holders are told about significant changes by email.