In short

Projelio is a team and work management service. This policy explains what information we collect when you use Projelio, why we process it, who we share it with, and how you can exercise your rights.

In short: we do not use your data for advertising, we do not sell it to third parties, and we do not allow your content to be used to train AI models. Beyond the suppliers we need to run the service, your data does not leave us.

The server and database holding your data are in Türkiye. Data leaves the country only for a short, individually listed set of services: AI, email delivery, push notifications and web fonts.

This summary does not replace the policy; the full text below is what binds us.

1. What this policy covers

This policy applies to the projelio.app website, the Projelio web and mobile applications, the Lio assistant, the WhatsApp integration, our support channels and all related services (together, the "Service").

We act in two different roles, and the distinction matters. When you create an account, visit the site, contact us or when we bill you, we are the data controller for that data.

The content your organisation creates inside the Service — projects, tasks, module records, files, comments, contact and finance records — belongs to the organisation. We process that content on the organisation's behalf and on its instructions; there we act as a processor. For your organisation's own privacy practices you should contact your administrator, and we may forward a request about such content to the relevant organisation.

If you do not agree with this policy, please do not use the Service.

2. Information you give us directly

Account and profile information: full name, email address, an irreversible hash of your password (bcrypt), profile photo, job title, phone number, the organisation and department you work in, your role, and your interface preferences (theme, font size, notification settings).

If you choose to sign in with Google or Microsoft, we receive only your name, email address and profile picture from that provider; we never see your password.

Content information: jobs, projects, tasks and subtasks, programmes and routines, calendar entries, department and module records (for example contacts, products, invoices, payroll, stock records), budget and finance entries, deliverables, comments, feed posts, files and images you upload, cover images, and your personal to-do list.

Social media account credentials: if you choose to store an account's username and password in the social media module, the password is written to the database encrypted. It is closed by default: someone who can see the module sees that a password exists, not its value. Only the person who entered it, the relevant administrator and people the administrator has explicitly authorised can reveal it, and every reveal is logged with who, when and under which right.

Communication and support information: emails you send us, support requests, bug reports, screenshots, survey and feedback responses.

What you write to Lio: the content of the messages you send the assistant, any files or images you attach, and the answers it returns.

Billing information: billing name, address, tax office and tax number, and your purchase and subscription records. We do not collect or store card details at all: payment is taken with 3D Secure through the infrastructure of PayTR, a licensed payment institution, and card details are sent directly to PayTR. So that your subscription can renew automatically, your card is stored at PayTR with your consent; only the last four digits of the card and a card identifier issued by PayTR come back to us. We initiate renewal payments through PayTR using that identifier. You can stop your saved card from being used by changing your card or cancelling your subscription.

3. Information collected automatically

Usage information: which screens you open, how many records you create and update, module usage statistics, search and filtering behaviour, whether you completed onboarding tour steps, how many requests you made to Lio and how many Lio Units they consumed.

Device and connection information: IP address, browser and operating system, device type, screen size, language and time zone preference, referring address, application version, and error/crash logs.

Security and session information: sign-in attempts and times, validity data for session tokens (JWT), email verification and password reset events, and records that help us detect suspicious access.

Local storage and cookies: we use your browser's local storage and strictly necessary cookies to keep you signed in, remember your preferences and run core functions. See "Cookies and local storage" for detail.

Notification information: if you enable push notifications, your device's notification subscription (push endpoint or device token) is stored.

4. Information from other sources

Other users: whoever invites you to a job, project, department or module team may have given us your email address and name. In that case we send you a notification stating who invited you and to which job.

Organisation administrators: if your account belongs to an organisation, your administrator can add or update your staff record, department, title and permissions.

Third-party services you connect: if you choose to connect services such as Google Drive, Microsoft OneDrive or an Outlook mailbox, or Instagram, we receive data within the scope of the permission you grant — file lists, folder information, message headers or publishing account details, for example.

WhatsApp integration: if you set up the connection, we process your phone number, the content of the messages you send us and their timestamps.

5. Why we process information, and on what legal basis

To provide the Service and manage your account: creating your record, authenticating you, determining your permissions, storing your content and sharing it with your teammates. Legal basis: performance of a contract (GDPR Art. 6(1)(b); Turkish Law no. 6698 Art. 5/2-c).

To operate, maintain and improve the Service: debugging, measuring performance, understanding which features are used, designing new ones. Wherever possible we use aggregated and de-identified data for this. Legal basis: legitimate interests (GDPR Art. 6(1)(f); Law no. 6698 Art. 5/2-f).

To send transactional communications: email verification, password reset, invitations, task assignments, comment and due-date notifications, and service announcements. These are part of the Service, are separate from marketing, and cannot be switched off entirely (although you can manage notification types in settings). Legal basis: performance of a contract and legitimate interests.

To provide support: understanding, diagnosing and resolving your issue, including reviewing technical records relating to your account where necessary. Legal basis: performance of a contract and legitimate interests.

To keep the Service secure: detecting and preventing unauthorised access, abuse, fraud and spam; investigating policy violations; taking backups. Legal basis: legitimate interests and our legal obligation to secure data (GDPR Art. 32; Law no. 6698 Art. 12).

To meet legal obligations: keeping invoicing and accounting records, responding to duly made requests from competent authorities, and establishing or defending legal claims. Legal basis: legal obligation and legal claims (GDPR Art. 6(1)(c) and 6(1)(f); Law no. 6698 Art. 5/2-a, ç, e).

Marketing communications: product announcements, news and campaigns are sent only with your consent, and every message carries a one-click unsubscribe link. Legal basis: consent (GDPR Art. 6(1)(a); Law no. 6698 Art. 5/1).

References and customer stories: we publish your name, company or testimonial only if you separately agree.

6. Lio and AI features

Lio is the AI assistant inside Projelio. When you send a request, your message and the context needed to answer it (for example the title of the task you asked about) are sent to the supplier that runs the model, and an answer is generated. If you attach a file or an image, its content travels the same way.

The model is run by Anthropic, PBC (United States). To keep the service available, MiniMax and Z.ai (Zhipu AI) may be configured as fallback suppliers; the servers of these two are in the People's Republic of China. A fallback is used only when the primary supplier is temporarily unable to answer. Requests containing data from your Google account (such as Google Calendar events) are never sent to a fallback supplier; if Anthropic cannot answer at that moment, the request is not answered (see section 7).

Which supplier and which model is used is decided by the Projelio administrator, not by users. We keep the list of suppliers in use, and the countries data goes to, current in this policy.

Your content is not used to train AI models. We have a data processing agreement to that effect with our primary supplier, and a fallback supplier is only enabled once an agreement with the same commitment is in place.

Lio cannot reach any data you are not permitted to see in the panel. Permission rules work identically in the interface and in chat: Lio can read a record only if you can, and change it only if you can.

Your chat history is kept so conversations stay coherent, and is permanently deleted together with its messages 90 days after the last message. For Lio Units accounting, the tokens each request consumed and its cost are recorded against your account; those records contain no message content and remain, for billing purposes, after the conversation is deleted.

AI output can be wrong. We recommend you do not base financial, legal or operational decisions on Lio's answer alone.

7. Third-party services you connect

Projelio can connect to other services when you ask it to. Until you set up a connection, no data is shared with those services, and you can remove a connection at any time in settings.

Google Drive and Microsoft OneDrive: used to attach your files to Projelio records. Only the files and folders within the scope you grant are accessed; when you give access to a job or project, the related folder is shared only with members who have accepted their invitation.

Google Calendar: if you connect your calendar, events from the calendars you select (title, time, location, description, number of guests and the organiser's name or email address) are stored on our server so they can be shown in Projelio's calendar, and are refreshed from Google regularly. Events and time blocks you choose to add from Projelio are written to your Google Calendar; no guests are added and no invitations are sent. When you ask Lio about your calendar, only the events needed to answer your request are sent to Anthropic, PBC (USA). Anthropic does not use this data to train models. Your calendar data is never sent to the fallback suppliers named in section 6 (MiniMax, Z.ai). When you disconnect, the calendar data is deleted from our server; events you added from Projelio stay in your Google Calendar.

Projelio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use data received from Google only to provide the features we offer you: we do not use it for advertising, do not sell it, do not use it to train AI models, and do not let humans read it without your explicit permission, except for security purposes and legal obligations.

Microsoft Outlook mailbox: if you use the mail module, message headers and bodies are displayed in the interface within the scope you grant.

Instagram and Meta services: if you use the social publishing module, the image, video and text you choose to publish are sent to that platform.

WhatsApp: if you choose to use Lio over WhatsApp, your phone number is linked to your account with a single-use verification code generated inside the app. Messages travel over Meta Platforms, Inc.'s infrastructure and that transport is subject to Meta's own terms; the server running the bridge is ours and is located in Türkiye.

Habie: the messaging module embedded in Projelio. Your session is presented to Habie with a single-use code generated by Projelio; your password is never passed on.

These services have their own privacy policies and we are not responsible for their practices. We recommend reading the relevant policy before connecting.

8. Other people's data that you enter into modules

Projelio can hold records about customers, suppliers, employees and candidates: contact cards, invoices, payroll and personnel records, job applicants, support requests, customers who write in over WhatsApp. These people are usually not Projelio users, but their data is personal data.

Your organisation, not us, is the controller for that data. Giving the required privacy notice, determining the legal basis, obtaining consent where necessary and deciding retention periods are the organisation's responsibility. We process these records only on the organisation's instructions, to provide the Service.

We recommend that you do not enter special categories of personal data. Projelio has no separate protection layer for health reports, criminal convictions, trade union membership, religion or biometric data; putting such data in a free-text field means everyone with access to that field can see it.

We sign a data processing agreement (DPA) meeting the requirements of both the Turkish law and the GDPR with our business customers. Just ask for one.

9. Share links and people without an account

You can create a share link to show a project's status to someone without a Projelio account (a client, an investor, a consultant). The link is read-only and what it exposes — summary, tasks, budget, team — is chosen switch by switch when the link is created; by default only the summary and tasks are open.

Anyone holding the link can see what you chose to expose. If you attach an email address to the link, whoever opens it is asked to type that address; this is not authentication, it is a gate that makes accidental spread harder. The real protection is that the secret string in the link cannot be guessed, so send it only to the people you mean to and close it when it is no longer needed.

The email address you attach to a link is shown only to the person who created the link; it never appears in the public view.

Likewise, when you share a file through Google Drive or OneDrive, the access rules are that service's rules.

10. Who we share information with

With other users in your organisation: when you join a job, project, department or module team, your name, profile picture, title and the content you create there are visible to everyone with access to that area. Task assignments, comments and feed posts are open to the relevant team.

With administrators: the job owner, the department manager and the organisation owner can access content and membership information within the scope of their permissions. If you joined an organisation with your work email address, this administrator access is an inherent part of the Service. Administrators may also receive aggregate reports on Lio Units spending.

With our service providers: we use a small number of suppliers to run the Service — server hosting (Hosting Dünyam, servers located in Türkiye; the application, the database and the files you upload all live there), marketing site hosting (Vercel Inc., USA), email delivery (Resend, Inc., USA), AI (Anthropic, PBC; where configured, MiniMax and Z.ai/Zhipu AI as fallbacks), push notifications (your browser vendor's push infrastructure — Google LLC, Mozilla, Apple or Microsoft), web fonts (Google Fonts), and, where you connect them, services from Google LLC, Microsoft Corporation and Meta Platforms, Inc. Each processes data only on our behalf, on our instructions and under contractual limits.

With competent authorities: only where there is a duly made, written request required by law, and only to the extent of that request. Unless we are legally prevented, we will try to inform you.

In corporate transactions: in a merger, acquisition, demerger or asset sale, data may be transferred to the acquirer. We will inform you beforehand and ensure the acquirer honours the commitments in this policy.

We never sell or rent your data to third parties for advertising.

11. Where your data is kept, and what leaves the country

The application server, the database and the files you upload are kept in Türkiye, on a server we rent. Backups are also kept in Türkiye, in an environment restricted to authorised people.

Data leaves the country only in these cases: (a) the messages and context you send to Lio go to the supplier running the model — to the United States, or to the People's Republic of China if a fallback supplier is in use (except data from your Google account, which goes only to the United States); (b) the address and content of emails we send you go to our email supplier (USA); (c) push notification headlines go to your browser vendor's push server; (d) your IP address reaches Google Fonts when a page downloads font files; (e) to the third-party services you connect, within the scope you granted.

Transfers are made under Article 9 of Turkish Law no. 6698 with a standard contract, an undertaking, or another safeguard the legislation provides. For transfers out of the European Economic Area we rely on the European Commission's Standard Contractual Clauses.

12. Retention

Account and content data: kept for as long as your account is active.

Account deletion: a 30-day waiting period starts when you request deletion. If you sign in during that period the request is cancelled and nothing is deleted. When the period ends your account and personal data are permanently deleted; clearing them from backups can take a few extra weeks. Jobs and organisations with no other members are deleted too; those containing other people's work are preserved and your contributions there are anonymised.

Organisation-owned content: even if you delete your account, content owned by the organisation (comments you sent to teammates, task records you completed) stays with the organisation. Deleting that content depends on a request from the organisation's administrator.

Lio chat history: automatically deleted, along with its messages, 90 days after the last message. Lio Units and usage records are kept longer for billing purposes and contain no message content.

WhatsApp conversation records: kept for a maximum of 90 days and then deleted automatically. Raw event records received from WhatsApp (which contain the full message text) are kept for at most 7 days after processing.

Single-use links and codes (email verification, password reset, WhatsApp linking): deleted 30 days after they expire.

Social media password reveal logs: as an audit trail, kept until the password record itself is deleted; deleting the record deletes these traces too.

Technical and security logs: kept for a maximum of 12 months, or until a security investigation in progress is concluded.

Backups: database backups are kept for 14 days and then deleted.

Billing and accounting records: kept for the period the law requires (as a rule 10 years in Türkiye).

Marketing consent and communication records: until you withdraw your consent; when you do, a record of the request is retained so we can demonstrate compliance.

13. Security

All data in transit is encrypted with TLS. Passwords are stored irreversibly (bcrypt); nobody — including us — can see your password. Account passwords you store in the social media module are written encrypted with a separate key and are only revealed to an authorised person, with the reveal logged.

The database can only be reached from the server's internal network; it is not exposed to the internet. Server administration happens only over a private network and with keys; password access is disabled.

No client connects to the database directly. All data access goes through our server, and two independent layers at the database level — row level security and revoked grants — permanently deny direct outside access.

Authorisation follows least privilege: you can see a record only if you belong to the relevant job, project, department or module team. A pending or rejected invitation grants no access at all.

The type of an uploaded file is determined from the file's own signature rather than the client's claim, which prevents executable content being uploaded as an image, and file size is capped.

Sign-in attempts are rate limited per IP and per account; after repeated failures an account is temporarily locked.

No system is completely secure. If a data breach occurs, we will notify the affected individuals and the competent authorities within the period the law requires (within 72 hours under the GDPR, and to the Turkish authority within 72 hours under Law no. 6698).

For your own safety, use a strong and unique password and never share it. If you notice a vulnerability, please tell us.

14. Cookies and local storage

Strictly necessary cookies and local storage: used to keep you signed in, remember your language and theme, and preserve interface state (open tab, sort order, dismissed notices). These are required for the Service to work and cannot be turned off; clearing them in your browser signs you out.

We currently use no analytics, advertising or profiling cookies, and no third-party measurement tool runs on the site. Should that change, analytics cookies will run only with your consent and you will be able to withdraw it at any time.

Public demo account: when you sign in with the demo account, the pages opened during that visit, the time spent on them and the interface labels of the buttons pressed are recorded anonymously to improve the demo. This uses no cookies; the visit is told apart only by a random identifier kept in the browser tab. No IP address, device identifier, content you type or link to an account you open later is kept, and records are deleted after 90 days. No such measurement takes place when you use your own account.

Our pages load web fonts from Google Fonts, which means your IP address reaches Google. Apart from that, our pages carry no third-party tracking code.

We do not share your data with ad networks.

15. Your rights and how to exercise them

Under Article 11 of Turkish Law no. 6698 you have the right to: learn whether your personal data is being processed and request information about it; learn the purpose of processing and whether it is used accordingly; know the third parties in Türkiye or abroad to whom the data is transferred; request correction of incomplete or inaccurate data; request erasure or destruction; request that these actions be notified to third parties the data was transferred to; object to a result reached solely through automated analysis that works against you; and claim compensation for damage caused by unlawful processing.

If you are in the European Economic Area or the United Kingdom you also have the right to: access and obtain a copy of your data, have it corrected, request erasure, request restriction of processing, object to processing, receive your data in a structured, machine-readable format (portability), and withdraw any consent you gave. Withdrawal does not affect processing carried out before it.

You can handle most requests yourself: update your profile in settings, change your notification preferences, remove connected third-party services, export your data as an Excel file from settings, and request deletion of your account.

For anything else, write to info@projelio.app. We may ask for additional information to verify your identity. We respond within 30 days at no charge; where a request requires additional cost, we may charge the fee set by the competent authority's tariff.

If your account belongs to an organisation and your request concerns content the organisation owns, we forward the request to that organisation and let you know.

If you are not satisfied with the outcome, you may complain to the Turkish Personal Data Protection Authority (KVKK Kurulu), or, in the EEA or the UK, to the supervisory authority in your country.

16. Automated decision-making

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. We do not carry out profiling.

The text Lio produces and the actions it proposes are drafts, not decisions; a human always confirms the outcome. Lio can only act within the permissions you already have.

17. Children's privacy

Projelio is business software and is not directed at people under 18. We do not knowingly collect personal data from children.

If we learn that someone under 18 has given us data, we delete it without delay. Please tell us if you become aware of such a case.

18. Changes to this policy

We may update this policy from time to time. The current text is always published on this page together with its effective date.

For significant changes we will notify you by email or with a prominent in-app notice before the change takes effect. Bringing a new AI supplier into use, and beginning to transfer data to a new country, count as significant changes.

If you do not accept the changes, you can stop using the Service and request deletion of your account.

19. Contact us

Data controller: Yiğitcan Kiremitci (sole proprietorship), Küçükbakkalköy Mah. Dereboyu Cad. R5 Blok No: 3A, Interior Door No: 48, Ataşehir/İstanbul, Türkiye.

VERBIS: data controllers with fewer than 50 employees and an annual balance sheet total below TRY 25 million, whose principal activity is not the processing of special categories of personal data, are not required to register with the Data Controllers' Registry; our business falls within that exemption.

For any privacy question, request or complaint: info@projelio.app

Individuals in the European Economic Area and the United Kingdom: the Service is directed at Türkiye and we have not appointed a representative in the EEA or the UK; you can send your requests directly to info@projelio.app.

Effective date: 28 September 2026.

Privacy Policy