1. Scope and who we are

This notice explains how your personal data is processed when you use the Oversee web and mobile application (app.overseee.com and the iOS app) and its sign-in, invitation, password reset and job application pages. It is based on Turkish Law No. 6698 on the Protection of Personal Data (KVKK) and the EU General Data Protection Regulation (GDPR).

Oversee is a software service that lets construction investors and their design firms, subcontractors, suppliers and staff manage contracts, progress payments, payments, site tracking and documents in one place. See Contact for our organisation details.

2. Roles: controller and processor

Oversee is a multi-tenant (SaaS) service; each company works separately under its own licence. The roles are as follows:

• Account and session data (sign-in e-mail, password, session, invitation and password-reset e-mails, security and error logs): Oversee is the controller.
• Project, contract, progress payment, payment, message, document and “party” records (everything your company enters into the application): the controller is the company using the application (the licence holder / investor), which decides what data is entered and why. Oversee is the processor that hosts this data on the company’s instructions.
• Job application data: see Job applicant data.

If you have a request about records a company has entered about you (for example as a subcontractor, supplier or employee), we suggest contacting that company first; we will provide the help it needs. You can reach us through Contact.

3. What data we process

Special categories of personal data, such as health data, should not be entered into free-text fields (for example OHS records or notes) unless necessary. We do not collect any data for advertising, analytics or behavioural tracking.

4. Purposes and legal bases

• Providing the service (account creation, sign-in, company setup, invitations, project/contract/progress payment/payment management, notifications, messaging, file storage): performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)) and the company’s legitimate interests.
• Security, debugging and service continuity (audit and error logs, preventing misuse): legitimate interests (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)).
• Legal obligations (commercial, financial and tax record keeping and retention): legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)).
• Location data: collected only when a site clock-in/out is recorded and only if you accept your device’s permission prompt; if you decline, the app works without location. Basis: explicit consent (KVKK Art. 5/1; GDPR Art. 6(1)(a)).
• Job applications: see Job applicant data (explicit consent).
• Responding to rights requests and legal claims: legal obligation and the establishment, exercise or defence of legal claims.

We do not use your data for marketing, advertising or profiling, and we do not sell it. We make no decisions based solely on automated processing that significantly affect you.

5. Job applicant data

The following applies if you use the public job application page (is-ariyorum) that lets you apply to a company that uses the application.

• What information: full name, profession, experience, city, phone, e-mail and an optional free message. Please do not put unnecessary sensitive information (health, religion, trade-union membership, etc.) in the free message.
• Purpose: for the company you applied to to assess your application and contact you.
• Recipient: the company the application is made to (an employer using Oversee). Application data goes into that company’s HR pool; that company is the controller. Oversee is the processor that provides the application page and infrastructure. Your application is not shown to companies other than the one you applied to.
• Legal basis: your explicit consent, given through the tick box on the form. The application cannot be submitted without ticking the box; applying is entirely voluntary.
• Retention: by default for at most 2 years, after which the application record is deleted automatically. The company may set a shorter period or delete the record earlier.
• Withdrawing consent and deletion requests: you may withdraw consent and ask for your record to be deleted at any time. Write to the e-mail address in Contact, with the name and e-mail/phone you used in the application; we will pass your request to the company and delete the record. Withdrawal does not affect the lawfulness of processing carried out before it.

6. Service providers and recipients

We do not sell your data. To run the service we use these providers (processors):

• Supabase — database, authentication (including sign-in, password-reset and invitation e-mails) and file storage. Project region: Frankfurt, Germany (EU).
• Vercel — hosting and serving the application’s web pages.
• jsDelivr (content delivery network) — the open-source “supabase-js” library the application uses is loaded from here when a page opens; your IP address and browser information may therefore be visible to jsDelivr.

We do not use any other content delivery network, font provider, analytics, advertising or tracking tool. Data is also available to: authorised users of the same company (within their permissions), legally authorised public authorities (where the law requires) and, for application data, the company applied to. In the event of a merger or transfer of the business, data passes to the successor with the same level of protection and we will inform you.

7. International transfers

The database and files are hosted on Supabase infrastructure in Germany (Frankfurt). Seen from Türkiye, this is a transfer of personal data abroad. Vercel and jsDelivr also operate servers in many countries; the companies behind these providers may be established outside the European Union (for example in the USA).

Transfers rely on the safeguards required under KVKK Art. 9 and Chapter V of the GDPR (for example an adequacy decision, standard contractual clauses or explicit consent). For information on which safeguard is used, write to us through Contact. Please be aware that using the application necessarily involves these transfers; if you do not accept them, you should not use the application.

8. Retention periods

• Account data: for as long as your account is open; when you delete your account, your sign-in account is deleted immediately and permanently.
• Personal contact and identity fields in “party” records (tax number, national ID number, phone, e-mail, IBAN) and certificate document links: 10 years from the date of the record; once contracts linked to that person end (completed/terminated), 10 years from the contract end date (whichever is later). When the period expires, the system clears these fields automatically every day.
• Business and financial records (contracts, progress payments, payments, expenses, messages, etc.): kept in the company’s account for the company’s legal retention periods.
• Audit log: for the life of the related business record and the licence.
• Error log: only as long as needed for troubleshooting; records that are no longer needed are deleted.
• Account deletion record: kept as proof that the account was deleted (the e-mail only as an irreversible digest).
• Job applicant data: at most 2 years (see Job applicant data).

Deleted data may remain in backups for the duration of the hosting provider’s ordinary backup cycle.

9. Security measures

• Each company’s data is separated from other companies’ in the database with row-level security (RLS); one company’s user cannot see another company’s records.
• Access is authorised server-side according to the signed-in user’s role and position.
• Data travels between the application and the server over an encrypted connection (HTTPS/TLS).
• Passwords are stored one-way hashed; we cannot see your password.
• Uploaded files are not public; they are kept in private storage and opened only through short-lived, authorised links.
• Changes to important business records are written to an audit log.
• Account deletion runs on the server and requires confirmation with the account’s e-mail address.

No system is entirely risk-free; we keep working to improve our measures. If you notice a security issue, please report it through Contact. If a breach affects personal data, the competent authority and affected persons will be notified as and when the applicable law requires.

10. Browser storage and cookies

The application does not use cookies. It writes only the following to your browser’s local storage (localStorage) on your device; none of it is for tracking or advertising:

• ov_lang — the language you chose (TR/EN).
• ov_filtre_… — filters you selected on list screens.
• ov_proje_gorunum — your project screen view preference.
• sb-…-auth-token — the Supabase session token; needed to keep you signed in and removed when you sign out.

You can delete this data at any time in your browser settings; doing so signs you out and resets your preferences.

11. Your rights and deleting your account

Under KVKK Art. 11 and the GDPR you have the right to:

• find out whether your data is processed and request information; obtain a copy of your data (access and portability),
• learn the purpose of processing and whether it is used accordingly,
• know the third parties, in Türkiye or abroad, to whom your data is transferred,
• have incomplete or inaccurate data corrected,
• request erasure or destruction (“right to be forgotten”) and restriction of processing, and ask that corrections/erasures be notified to third parties the data was transferred to,
• object to processing, and object to a result against you arising solely from automated processing,
• claim compensation if you suffer damage from unlawful processing,
• withdraw your consent at any time,
• lodge a complaint with the competent authority: in Türkiye the Personal Data Protection Board (KVKK Kurulu); in the EU, the data protection authority of your country.

Deleting your account inside the application

In the application you can delete your account yourself from the My Account screen by typing your e-mail address. When you do:

• Your sign-in account is permanently deleted (you may register again with the same e-mail).
• The e-mail, phone, national ID number and IBAN on your party record are cleared; your notifications are deleted.
• Business and financial records such as contracts, progress payments, payments and messages remain in the company’s records because of legal retention duties (the record keeps its name and tax number but is no longer linked to any sign-in account).
• If you are the company’s only investor account and the company has no other users, the licence becomes inactive (data stays, nobody can sign in). A sole investor account cannot be deleted while other users exist in the company; another investor must be added first.

How to apply

For other requests, write to the address in Contact. We may ask for extra information to verify your identity. We respond to requests within 30 days at most. Requests about records entered by companies may be directed to the company that is the controller.

12. Children

Oversee is a business application and is not directed at people under 18. We do not knowingly collect data from people under 18; if we notice any, we delete it.

13. Changes and version history

We may update this notice from time to time. We will announce material changes in the application or by e-mail; the current text is always published at this address and its effective date is shown at the top of the page.

14. Contact

Controller (account and session data) / processor (company data): Oversee (overseee.com)

E-mail for privacy and KVKK/GDPR requests: ceo@overseee.com

Putting “Privacy / KVKK” in the subject line helps us respond faster.

Service provider: Murat HÜSEYİNOĞLU (Pibure brand). Tax office / no: Kağıthane Tax Office / 4640940226. Address: Hamidiye Mah. Cendere Cad. No: 103/3C, Kâğıthane / İstanbul. Contact: WhatsApp +90 552 000 00 22. (pibure.com)