Privacy Policy
Last updated: 2 November 2026
1. Controller
Şuzi Gülcan (sole proprietorship), Bahçelievler Mah. Aydın Sok. No: 11, Kargı / Çorum, Türkiye, email: [email protected] (full details in the imprint).
2. What data we process
- Account: company name, name, email address, password (stored only as a non-reversible hash).
- Security: sign-in times, IP address, a device identifier used to verify new devices.
- Content: logo, products, tiles, customer records, designs and quotes that you create in the program.
- Billing: chosen plan, payment dates, invoice details. We do not store card details.
3. Purposes and legal bases
- Providing the program and performing the contract – Art. 6(1)(b) GDPR.
- Preventing misuse (e.g. limiting sign-in attempts, verifying new devices) – legitimate interest, Art. 6(1)(f) GDPR.
- Keeping invoices – legal obligation, Art. 6(1)(c) GDPR.
- Newsletters only with your consent – Art. 6(1)(a) GDPR.
4. Service providers (processors)
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | Secure connection (HTTPS), domain, forwarding of incoming emails | Connection data (IP address), transferred content in transit | USA (EU-US Data Privacy Framework, standard contractual clauses) |
| Brevo (Sendinblue SAS) | Sending password and confirmation emails | Email address, email content | France (EU) |
| fal.ai (Features & Labels, Inc.), model: ByteDance Seedream | "uleso Render": photo-like images | Only the screenshot of the bathroom – no names, phone numbers or addresses. We do not store the result. | USA (standard contractual clauses) |
| dogado GmbH | Server storing the program and data | All data in the program | Germany (EU) |
| Google (Google Drive) | Nightly backup copy | All data in the program, encrypted before upload – Google cannot read the content | Ireland (EU) / USA (EU-US Data Privacy Framework) |
5. Your customers' data – data processing on your behalf
For the customer data you store in the program (name, phone, design, quote) you are the controller; uleso processes this data only on your behalf. A data processing agreement under Art. 28 GDPR is available on request at [email protected].
6. Cookies and local storage
We only use one strictly necessary session cookie that keeps you signed in. We use your browser's local storage for your language choice and so that your design is not lost if the connection drops; this data is not sent to us. There are no advertising or tracking cookies.
7. Retention
We keep your data as long as your account exists. After the contract ends it is deleted within 90 days unless legal retention periods apply (e.g. 10 years for invoices). Our server makes daily backups that are overwritten after 14 days, plus an encrypted copy on Google Drive kept for 30 days.
8. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR) and may withdraw consent at any time. Contact [email protected]. You may also lodge a complaint with a data protection supervisory authority.
9. Security
The connection is encrypted (HTTPS). Passwords are stored only as hashes, repeated failed attempts are blocked, and sign-ins from new devices are confirmed with an email code.