Privacy policy

Scope and responsibility

Saha Doküman is offered in two ways: as a cloud service running on our servers, and as a licence installed on a company’s own servers. A company that installs the licensed version operates the system itself, and its own privacy policy applies.

In the cloud service, the company — the employer — is the controller (GDPR) / data controller (KVKK) for its users’ and its content’s data. Saha Doküman is the processor: it processes this data only on the company’s behalf and on its instructions. For the website and for messages sent to us, Saha Doküman is responsible.

The website (sahadoc.com)

• No cookies, analytics, advertising or social media plug-ins. Fonts and videos come from our own server, and the pages make no requests to other sites.
• The language you choose is remembered only in your browser (localStorage) and is not sent to us.
• The web server keeps access logs for security and troubleshooting: IP address, time, the requested page (without the query part of the address), the response code and the browser identification. These logs are deleted after 14 days.
• When you e-mail us, we use your address and message only to reply.

Accounts

• Accounts are created by the company’s administrators; there is no public sign-up.
• An account holds the full name, user name, an optional e-mail address, department memberships, roles and positions.
• Passwords are stored only as salted hashes; nobody, including us, can read your password. Sessions use short-lived tokens.

Content and its history

The pages, rules, files, change requests and comments that users add are the company’s content. Who added, changed, published or deleted each piece of information is recorded as part of the company’s documentation history. This is a core function of the product and is kept for as long as the company uses the service.

Usage data

• Page views, favourites and notifications; notifications are deleted after 180 days.
• Search logs are not linked to the user: only the simplified search phrase, the number of results, the department filter and the time are kept, and they are deleted after 180 days.
• Assistant conversations are visible only to their owner and are deleted after 90 days by default (the company can change this). Questions the assistant could not answer are counted without any user information, to show gaps in the documentation.

Security records and backups

• Audit log: security and administration events such as sign-ins (with the IP address) and account and permission changes; kept for 400 days by default.
• Application logs: written with passwords, keys and query values removed; kept for 31 days.
• Backups: database backups are kept for 14 days, file backups for 7 days.

Artificial intelligence

• Search and the “similar information” check run on our own servers, including the language model that computes the text vectors; company content does not leave the servers for them.
• Without the company’s own Anthropic API key, the assistant answers with a demo assistant that runs entirely on our servers: it quotes the passages it found and sends nothing out.
• If the company’s administrator adds the company’s own Anthropic API key, the question and excerpts of the pages the user is allowed to see are sent to Anthropic PBC (USA) to generate the answer (and for the AI language review of contributions). This happens under the company’s own agreement with Anthropic and Anthropic’s commercial API terms.
• Companies can mark spaces “Closed to AI”; no content from those spaces is ever sent out.

E-mail

Account activation and subscription e-mails are sent from our own mail server.

Hosting and third parties

• The servers are rented from Hetzner Online GmbH; the data centre is in Falkenstein, Germany (European Union). For companies in Turkey this means the data is hosted abroad.
• All connections are encrypted (HTTPS / TLS).
• The domain name service (DNS) is Cloudflare; traffic does not pass through Cloudflare.
• We do not sell personal data or use it for advertising, and we do not pass it to any third party other than those listed above.

The mobile app (Android and iOS)

• Permissions: internet; the camera, photos and files only when you choose to attach something to a page, through the system picker. Nothing is accessed in the background.
• Stored on the device: the company’s address, code and name; the session tokens in the device’s secure storage (iOS Keychain / Android Keystore); the language choice and recent searches. Signing out deletes the session tokens, the recent searches and the cached images; the company address stays until you change the company code.
• No location, contacts, advertising ID, analytics, crash reporting or push-notification services.

Demo companies

The demo companies demotr, demoar and demoen are used for presentations with shared demo accounts. Everything entered there is deleted every night at 00:00 (Istanbul time) and whenever a demo is reopened. Please do not enter personal data in the demo companies.

Your rights

Under the GDPR and article 11 of the Turkish KVKK you have the right to access your data, to have it corrected, deleted or its processing restricted, to object, to data portability, and to complain to the supervisory authority (in Turkey, the Personal Data Protection Authority, KVKK).

For requests about your company account, contact your company’s administrator first: the company is the controller, and we support it. You can also write to us directly at info@sahadoc.com.

Accounts are deactivated by the company’s administrators; the records of who added what remain part of the company’s documentation history. When a company leaves the service, its database and files are deleted at its request.

Children

Saha Doküman is a business application and is not intended for children under 16.

Changes

When this policy is updated, the date at the top of the page changes. We also inform the companies’ administrators of significant changes.