Privacy policy
This page explains what personal data is processed when you use Esansmatik, why, and what rights you have over it. Esansmatik is operated from Türkiye, so this policy is also our notice under Türkiye's Personal Data Protection Law No. 6698 (KVKK).
Last updated:
Who is responsible for your data
The data controller is Talha Emirhan Boyraz, who operates Esansmatik.
- Address: Fatih Mah. Aydos Cad., Sancaktepe, Istanbul, Türkiye
- Email: [email protected]
What data we process
| Category | What | When |
|---|---|---|
| Identity and contact | Username, email address | When you create an account |
| Account security | Password (stored as a one-way hash, never in plain text), session records | When you sign up and sign in |
| Sign in with Google | The name, email address, profile picture and account ID Google shares | When you sign in with Google |
| App content | Perfume and fragrance oil records, concentrations, batch notes, material prices, cost and profit calculations | As you use the app |
| Sharing and following | Share page settings, accounts you follow and who follows you, reports you submit | When you use these features |
| Security logs | IP address, browser and device information, session times | When you sign in and use the app |
| Contact form | Name, email address, subject and message | When you send the form |
| Preferences | Language | When you choose a language |
We do not process sensitive data such as health or biometric data, and we ask you not to enter it in the app.
Why we process it, and on what basis
- To create your account and provide the app (sign-up, sign-in, storing your formulas and calculations, sharing and following): necessary to perform our agreement with you (KVKK art. 5/2-c).
- Password resets and essential service emails: necessary to perform the agreement (KVKK art. 5/2-c).
- Security, abuse prevention and handling reports (session records, rate limiting, moderation): our legitimate interest (KVKK art. 5/2-f).
- Replying to contact form messages: our legitimate interest (KVKK art. 5/2-f).
- Aggregate visit statistics to improve the site: our legitimate interest (KVKK art. 5/2-f). These statistics do not identify you.
- Legal obligations and protecting our rights (requests from authorities, disputes): KVKK art. 5/2-ç and 5/2-e.
We don't send marketing emails, we don't use your data for advertising, and we don't sell it to anyone. None of our processing relies on your consent.
How we collect it
Data is collected electronically: from the sign-up and sign-in forms, from what you enter in the app, from the contact form, from Google when you sign in with Google, and automatically while you use the site (session records and cookies).
Who we share it with
We share data only with the service providers needed to run Esansmatik, and only for that purpose:
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | The server that runs the app and its database | Germany |
| Cloudflare, Inc. | Domain, traffic routing and protection, database backups, email routing, cookieless visit statistics | US and global data centers |
| Resend, Inc. | Sending password reset and contact form emails | US |
| Google LLC | Sign in with Google (only if you choose it) and loading the site's web fonts | US |
Because these providers' servers are outside Türkiye, your data is transferred abroad. Transfers are made only for the purposes above and under the conditions of KVKK article 9. Apart from these providers, we share data only with authorities legally entitled to it, when we are required to by law.
Share pages and following
Your records are private by default. If you open your share page, your username, your follower count and the batches you choose to share can be seen by anyone with the link, without signing in. Share pages are closed to search engines, and there is no user search in the app. Your cost and profit figures are never shared. You can turn sharing off at any time.
Cookies and browser storage
- Session cookie (app.esansmatik.com): needed to keep you signed in. It stops working when you sign out or when it expires.
- Language cookie (`em_lang`): remembers your language across esansmatik.com and app.esansmatik.com, kept for one year.
- Browser storage: interface preferences in the app, such as list view or whether the sidebar is collapsed, stay on your device and are not sent to our server.
We don't use advertising or tracking cookies. Cloudflare Web Analytics, which we use for visit statistics, sets no cookies and doesn't track you across sites.
How long we keep it
- Account and app data is kept while your account is open. When you delete your account from the app's settings, your data is deleted from the database and drops out of backups shortly after.
- Reports you submitted may remain as moderation records after your account is deleted, with the link to you removed.
- Session records are kept for a limited time for security.
- Contact form messages are not stored in our database; they stay in our mailbox for as long as the conversation needs.
Where the law requires a longer retention period, that period applies. Data past its retention period is deleted, destroyed or anonymized.
Security
Connections are encrypted with HTTPS, passwords are never stored in plain text, access to data is limited to authorized people, and the database is backed up regularly. No system is entirely risk-free; if a data breach occurs, we will notify the Turkish Personal Data Protection Authority and affected people as the law requires.
Your rights
Under KVKK article 11 you can ask us to:
- Tell you whether we process your personal data, and give you information about it,
- Tell you why it is processed and whether it is used for that purpose,
- Tell you which third parties in Türkiye or abroad it is transferred to,
- Correct it if it is incomplete or inaccurate,
- Delete or destroy it, under the conditions of KVKK article 7,
- Notify the third parties it was transferred to about any correction or deletion,
- Object to a result against you that comes solely from automated analysis,
- Compensate you for damage caused by unlawful processing.
You can view and correct most of your data, and delete your account, from inside the app yourself.
How to make a request
Write to [email protected] from the email address registered to your account, or send a written request to the address above. Include your name, your request and how we can reach you. We respond within 30 days, free of charge; if handling the request involves an extra cost, the fee set by the Personal Data Protection Board may apply. If you're not satisfied with our answer, you can complain to the Turkish Personal Data Protection Board.
Changes
We update this policy when the service or the law changes. We announce significant changes in the app or by email. The current version is always on this page, with the last updated date at the top.