Privacy notice

1. During the preview

Before accounts open, we only process what you send us: the early-access form (name, email, what you plan to make, team size and an optional message) and emails to support@enginekit.dev. We use it to contact you about access and to plan capacity.

2. What we process once you have an account

• Account data: name, email, sign-in records and, if you sign in with GitHub, your GitHub id and public profile name.
• Billing records: plans, orders, hours and usage. Payment card details go to Polar and never reach us.
• Rig and project data: rig configurations, sessions, the files and backups you store, and task results.
• Security and abuse signals: IP addresses, browser details, sign-in and audit logs, and automated checks on running rigs — process names, resource use and connection counts, never the contents of your files.

3. Why, and on what legal basis

• To provide the Service you signed up for: performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• To keep the Service secure and prevent fraud and abuse: our legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• To keep records the law requires, such as accounting records: legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)).
• To answer early-access requests and messages you send us: your request and our legitimate interests.

We do not sell personal data, show advertising or use advertising trackers.

4. Who processes data for us

• Cloudflare, Inc. — website hosting, security and email delivery.
• A managed PostgreSQL provider — the account and billing database, once accounts open.
• Daytona Platforms Inc. — the cloud machines your rigs run on, once accounts open.
• Polar Software Inc. — our merchant of record, which processes payments as its own controller under its privacy policy.
• GitHub, Inc. — only if you choose to sign in with GitHub.

Some of these providers process data outside the EU and Türkiye. Where they do, transfers rely on the safeguards the law requires, such as the European Commission's standard contractual clauses and, under KVKK, the transfer rules of Article 9.

5. How long we keep it

• Early-access requests: until accounts open and up to 12 months after, unless you ask us to delete them sooner.
• Account and project data: while your account is open; we delete it within 30 days of closing, except backups that expire on their own schedule.
• Security logs: up to 90 days, longer only while an incident is being investigated.
• Billing records: as long as tax and accounting law requires.

6. Your rights

You can ask us for access to your data, its correction or deletion, a copy in a portable format, or to restrict or object to how we use it. Under KVKK Article 11 you can also learn whether we process your data, for what purpose and to whom it is transferred, and ask for the effects of unlawful processing to be put right.

Email support@enginekit.dev; we answer within 30 days. You may also complain to your data protection authority — in Türkiye, the Personal Data Protection Board (KVKK).

7. Cookies

We use only the cookies the Service needs to work, such as the cookie that keeps you signed in. We use no advertising or cross-site tracking cookies, so there is nothing to opt into.

8. Security

Data travels over encrypted connections, access to it is limited to what each part of the Service needs, and secrets such as your engine licences or AI credentials are never stored on our servers by default. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

9. Children

The Service is not for anyone under 18, and we do not knowingly collect their data.

10. Changes

We will update this notice as the Service changes, and tell account holders about material changes before they take effect.