Privacy Policy

Joint controllers within the meaning of Art. 26 GDPR are Erkin Uzuncakmak and Anıl Gökçe. Contact for privacy requests: kontakt@chokdil.com.

Both jointly decide the purposes and means of processing personal data in connection with the “Chokdil” service (website and application at chokdil.com). Erkin Uzuncakmak is responsible for technical operation and hosting. Data-subject requests received at kontakt@chokdil.com are handled by both controllers, who inform each other. Data subjects may exercise their rights against either joint controller.

This privacy notice describes which personal data we process when you use chokdil.com or create an account. Last updated: November 2026.

You are not legally required to provide your data. However, sign-up is not possible without an email address.

Account and access: name, email address, password (stored only as a hash), optional company, role and purpose at sign-up; email verification status; access status (pending, approved, rejected) and related review metadata where applicable.

Session: technically necessary authentication session cookies (including better-auth.session_token and related cookies; Secure-prefixed in production) so you stay signed in.

Hosting access data: When you visit the site, the hosting provider (Vercel) automatically processes technical access data (IP address, date/time, requested URL, user agent, status code) to deliver the site and for security. Legal basis: Art. 6(1)(f) GDPR. Retention follows the provider’s default settings.

Content you create in the product: project data (e.g. tasks, risks, schedule, budget, stakeholders with names/emails, document metadata), workshop and whiteboard content, Design Studio / CAD uploads and related files, contributions and session data.

Third-party data: When you enter personal data of other people (e.g. stakeholder names and email addresses in Project Management), we process it only to provide the service. Users who enter such data must be authorised to do so. Data subjects may contact kontakt@chokdil.com.

AI features: When you use AI features, the inputs required for that feature (e.g. chat questions, selected board/project data, CAD context) are sent to the configured AI provider.

Workshop voice: When you join voice in Workshop Studio, connection data and real-time audio are processed via the voice service (LiveKit).

Email: We send transactional emails (verification, password reset, access request to administrators, approval notice) to the intended recipients.

Security and abuse protection: short-lived in-memory rate-limit counters (including by IP address or user id) — without lasting storage of those IP addresses in our application for this purpose.

Admin deletion: When an administrator deletes an account, we store an audit record with the acting admin id and a hash of the deleted user id (not the deleted user’s email).

Local browser storage: The application stores technical UI preferences in your device’s localStorage/sessionStorage (e.g. last selected project, display options). Those values do not leave your device by virtue of that storage alone.

Performance of the contract or pre-contractual steps (account, sign-in, providing the tools): Art. 6(1)(b) GDPR.

Security, abuse protection, rate limiting, hosting access data and technical diagnostics (including necessary server/provider logs): Art. 6(1)(f) GDPR (legitimate interest in a secure and available service).

Consent (Art. 6(1)(a) GDPR) is not currently collected for optional tracking/marketing cookies, because such cookies and trackers are not used in the application. If consent became necessary in the future, we would collect it separately.

After sign-up you receive an email to confirm your address (time-limited link, currently 24 hours). Until verification you can use the email-confirmation page.

Chokdil is in a controlled beta: after successful verification, access usually remains “pending” until an administrator approves it. Administrators may approve or reject requests. On approval, a confirmation email may be sent. On rejection, no rejection email is sent at this time.

Unverified accounts without approved access and without relevant content may be deleted after 48 hours by a daily cleanup job.

We use service providers that process personal data only to deliver their services for us:

Vercel – hosting and delivery of the web application and related operational and access logs.

Neon – application database storage (accounts, project data, workshops, etc.).

Resend – sending transactional emails (recipient addresses and message content).

Cloudflare – object storage (R2) for uploaded files and, when live collaboration is enabled, Durable Objects relay for whiteboard sync.

AI providers, where configured for the feature in use: OpenAI, Anthropic, Google (Generative AI) and/or xAI — the inputs required for the request and the generated response.

LiveKit – real-time voice for Workshop Studio when you use the voice feature.

Optional CAD processing: a configured processing service (e.g. via Railway) for CAD files when that feature is used.

Fonts are self-hosted; the application does not load Google Fonts CDN resources.

Some of the providers above may process personal data in the United States or other third countries. Where required, we rely on appropriate GDPR safeguards, in particular the EU-US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses, to the extent the respective provider offers them.

AI outputs are generated automatically. There is no automated decision-making with legal effect or similarly significant impact within the meaning of Art. 22 GDPR; material changes to project data occur only after your confirmation in the application where a feature proposes changes.

Which content is transmitted depends on the feature you trigger (e.g. assistant question with project context, whiteboard selection, CAD review).

We only use technically necessary cookies for authentication and session management, and UI preferences in localStorage/sessionStorage. Legal basis: § 25(2) no. 2 TDDDG (strictly necessary to provide a service expressly requested by the user). The application does not load analytics or marketing cookies or comparable trackers. Therefore no cookie-consent banner is shown at this time.

Unverified accounts without approval and without relevant content: deletion after 48 hours (daily job).

Accounts and related data: until deletion at your request or by an administrator.

On admin deletion, owned projects and workshops are removed, memberships end, and personal traces in other people’s content are reduced to “Deleted user” / a sentinel user where implemented; object-storage files are deleted when possible. Admin-deletion audit entries are deleted after 3 years (daily cleanup job).

Server and provider logs follow the default retention of the respective hosting/email/storage providers where our application does not configure a different retention.

Under the GDPR you have, in particular, rights of access, rectification, erasure, restriction of processing and data portability. Where consent was given, you may withdraw it at any time with effect for the future.

Rights requests are free of charge. We generally respond within one month. To exercise your rights, contact kontakt@chokdil.com.

You also have the right to lodge a complaint with a supervisory authority, for example Die Landesbeauftragte für den Datenschutz Niedersachsen.

We may update this privacy notice when the service, the law or our providers change. The current version is always available at /privacy and /datenschutz. The stated “last updated” date is controlling.