Legal

Privacy policy

Last updated: 22 October 2026 · Version 1

This is a translation. The German version prevails.

This policy describes which personal data we process when you use Fine Techs Companion OS – the app at app.fine-techs.com, this documentation at docs.fine-techs.com and the emails we send you. It applies under the EU General Data Protection Regulation (GDPR) and under the Turkish Law No. 6698 on the Protection of Personal Data (KVKK).

1. Controller

Mete Han Yalçın, sole proprietorship, trading as Fine-Techs
Mahmutlar Mah., Mahmutlar Aydın Sk., Mir Quality No: 7, İç Kapı No: 9, Alanya / Antalya, Turkey
Email: info@fine-techs.com

Write to this address for all privacy questions and to exercise your rights. We have not appointed a data protection officer.

2. The essentials

• Your data is stored primarily on a server at Hetzner in Germany. The operator is based in Turkey and accesses it from there for operation and support.
• For AI answers we send the necessary texts with your own key to OpenAI or Anthropic in the USA.
• Actions that send, post, change, delete or pay something on your behalf only run after your approval. There is no tracking, no advertising and no analytics.
• You can delete your account yourself at any time.

3. Which data we process, why and on what legal basis

3.1 Visiting this documentation

The documentation consists of static pages. It sets no cookies, stores nothing in your browser and loads nothing from other servers. To deliver the pages, our server processes your IP address and your browser's details only for the duration of the request; we do not write access logs for the documentation.

3.2 Account and sign-in

• Account data: your email address, a display name (initially the part of your address before the @), for accounts you created yourself the time and version of your consent to the terms of use, whether you signed up yourself and whether your account is blocked. Purpose: running your account and signing you in. Legal basis: contract (Art. 6(1)(b) GDPR).
• Sign-in and confirmation links: when you request a link we store your email address, time, IP address and browser identifier. Purpose: sign-in and protection against abuse (limits per address and per IP address). Legal basis: contract and our legitimate interest in a secure service (Art. 6(1)(b) and (f) GDPR). Retention: at most 7 days, after which we delete them automatically.
• Sessions: while you are signed in we store a session with time, last use, IP address and browser identifier. Retention: until 30 days after the session ends (sign-out or expiry), then automatic deletion.
• Abuse protection at sign-up: we check whether the address belongs to a known disposable email service and limit sign-ups per IP address. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Notice to the operator: if an address is set up for this, the operator receives a short email with the address of every new account so that abuse can be spotted early. From the 21st sign-up on one day the app keeps the addresses until the next day and then sends them together. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Invitations: if the operator invites you, we store your email address, the area and who invited you until the account or the invitation is deleted.

Without an email address we cannot run an account for you.

3.3 Your content

What you create in the app is stored in your area: conversations, notes and knowledge, uploaded documents, projects, tasks, team rooms in the Atelier, routines, Osiris watches and their reports, the settings and the picture of your companion. Purpose: providing the service. Legal basis: contract (Art. 6(1)(b) GDPR). Retention: until you delete the content or your account. You can currently delete notes, tasks, routines, Osiris watches, skills and keys one by one; conversations and projects can be archived. Everything else – including archived items, documents and team rooms – is deleted with your account or on request by email.

When you delete a single note, it disappears from your knowledge and is no longer used. Its history, however, stays stored in your area until you delete your account – so you can trace changes. On request by email we delete single items including their history for good.

If you mark notes or documents as sensitive, your companion does not include them in requests to an AI model – unless you write their content into a message yourself.

If you upload your own picture for your companion, it goes to OpenAI for checking and conversion; the result is stored. For privacy mode the app stores the mapping between placeholders and real details encrypted in your area, plus your list of names that are always protected.

3.4 Your AI keys

We store your keys for OpenAI or Anthropic encrypted; afterwards only the last four characters are shown. Purpose: requests to the provider on your behalf. Legal basis: contract (Art. 6(1)(b) GDPR). Retention: until you remove the key or delete your account.

3.5 Costs, caps and log

For each request to an AI model we store time, model, amount (tokens or seconds) and reported cost. Purpose: showing you your costs and enforcing the daily caps. Approvals and executed actions are recorded in the log of your area so that you can trace what happened when. Legal basis: contract (Art. 6(1)(b) GDPR). Retention: until you delete your account.

3.6 Emails

We send you sign-in links, notifications from the Atelier (for example when a team room is finished or needs your approval) and error emails (when something goes wrong, for example a routine stops or a call to the AI provider fails). The notifications are on by default; you can switch them off in the settings. Error emails cannot be switched off individually. They go to you and – if an address is set up for this – to the operator; they contain a short note on the kind of error – this can be the name of a routine or the AI provider's error message – but never keys. Legal basis: contract (Art. 6(1)(b) GDPR) and legitimate interest in stable operation (Art. 6(1)(f) GDPR).

3.7 Feedback

When you send us feedback or answer “Did this help?”, we store your answer and your comment, for feedback also the page, language, appearance, window size and program version. Only if you explicitly agree may we use the request, the answer and the comment for improvements – beforehand the app replaces names, email addresses, phone numbers, addresses and similar details with placeholders. Legal basis: legitimate interest in a better service or your consent (Art. 6(1)(f) and (a) GDPR).

If you share the design of your companion in the gallery, we create a copy that other users can see after our review. Legal basis: your consent (Art. 6(1)(a) GDPR); you can withdraw it.

3.8 Server log of the app

When you use the app, our server writes a technical access log: IP address, time, requested address (without sign-in token; search terms in the address are included), the request headers such as browser identifier, language and referring page (without cookies), response, size and duration. Purpose: operation, troubleshooting and security. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Retention: the log is continuously overwritten once it reaches 50 MB; there is currently no fixed period in days. The app also writes a technical operating log (error messages, shortened email addresses) that is overwritten by the same rule. It also contains sign-in attempts (link requested, redeemed or rejected with a reason) – without email address, link and IP address, only with a short identifier from which the address cannot be calculated back; this lets us find out why a sign-in email did not arrive. For the speed of chat and voice the app measures the timings of each answer and keeps the identifier of the conversation with them (no content); we delete these measurements with your account.

3.9 Backups

We back up the database and the stored files on the server every day and before every software update. Older backups are deleted there automatically after 7 days; the newest one is always kept, even if a backup fails once.
If you delete your account, your data is therefore only gone from the backups once these periods have passed.

3.10 What remains when you delete your account

When you delete your account we remove your account, both areas with all content, your keys, sessions, sign-in links, invitations, your files and a shared companion design from the gallery. What remains: entries in an area you share with others; copies of your gallery design that others have already taken over; the notice emails at the operator; the sending logs at Resend according to its periods. If a connected app cannot be disconnected, the app tells you – then please also remove the access in that app. For anything else, write to us.

4. Recipients and service providers

We do not pass on your data, do not sell it and do not use it for advertising. For operating the service we work with these providers:

OpenAI and Anthropic: for answers, research, voice and pictures we send the necessary content to OpenAI or Anthropic – with your own key and on your behalf. For this you have your own contract with the provider; its terms and privacy notices apply (OpenAI, Anthropic). Both providers are based in the USA. According to their terms for business customers they safeguard transfers to the USA with standard contractual clauses; for OpenAI, the contracting party for customers in the EEA is OpenAI Ireland Ltd. according to its data processing addendum. In conversation mode a pseudonymous identifier of your area is sent to OpenAI (for abuse detection at the provider). Legal basis for our transfer: contract with you (Art. 6(1)(b) GDPR).

Voice: in conversation mode your browser opens a direct connection to OpenAI; your voice and your IP address go directly to OpenAI. Read aloud and dictation also run via OpenAI. Privacy mode, which replaces names and numbers with placeholders before the model, does not apply there. If privacy mode is on, the app points this out before the first conversation.

Apps you connect: if you connect an app via Composio (for example Gmail, calendar or Instagram), your browser opens the sign-in page of Composio or of the app – they see your IP address and browser details. After that the data needed for a task also goes to the provider of that app. What only reads runs without asking; anything that sends, posts or changes something there only runs after your approval. The app classifies this by the kind of action.

Web pages: if you name a web page (“Read web page”), our server fetches this address, including the site's rules file (robots.txt) and redirects. For research it fetches the sources found. The operators of these pages see the address of our server, not yours.

Certificate: for the encrypted connection (HTTPS) we obtain certificates from Let's Encrypt. No data about you is transferred.

Authorities: only where we are legally obliged.

5. Transfers to third countries

• USA: to Resend, Composio and – with your key – to OpenAI and Anthropic, on the bases named in section 4.
• Turkey: the controller is based in Turkey and accesses the server from there for operation, maintenance and support. There is no adequacy decision of the EU Commission for Turkey. The access is necessary to perform the contract with you (Art. 49(1)(b) GDPR).

6. Cookies and browser storage

This documentation sets no cookies and stores nothing in your browser.

The app only sets cookies that are necessary for operation (Section 25(2) TDDDG, therefore without consent):

In addition the app remembers interface settings in your browser's storage (localStorage): appearance, collapsed sidebar, width of the chat next to the side panel, last chosen view of the side panel per conversation, 2D or 3D in the Second Brain, whether the small roadmap in the team room is open, chosen chat model and voice settings. A text not yet sent in the input field of a team room is kept until you close the tab (sessionStorage). This information does not leave your browser. It stays in the browser after signing out or deleting your account until you delete the site data in your browser.

There are no analytics, advertising or tracking cookies. The app loads nothing from other servers – exceptions are the direct connection to OpenAI in conversation mode and the sign-in page of Composio or of the app when you connect an app. Pictures in answers or notes that point to other addresses are not loaded by the app; they appear as a link.

7. Privacy by design

We built the service so that as little data as possible leaves your account (Art. 25 GDPR):

• Your own keys: you settle AI costs directly with the provider; we use no key of our own for your requests.
• Separate areas: Private and Business are separated in the database; one area does not see the other's data.
• Privacy mode: on request the app tries to recognise names, email addresses, phone, account, tax and ID numbers, dates of birth and addresses and to replace them with placeholders before anything in chat and tasks goes to the AI model. It recognises common first names itself; you add further ones to your name list. Exceptions: the voice (conversation, read aloud, dictation), pictures and the web search during research.
• Sensitive: notes and documents marked this way are not included in requests to a model.
• Approval: actions that send, post, change, delete or pay something on your behalf only run after your approval. Only if you explicitly switch on working on its own for a project is the question skipped – with a warning, a spending limit and a log.
• No tracking in the app and the documentation.

8. You are talking to an AI

Your companion is an artificial intelligence, not a person. Its answers are generated automatically and can be wrong. It makes no decisions that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The only automatic decision at sign-up: addresses of known disposable services and too many attempts from the same IP address or for the same address are rejected. For a disposable address the app tells you; for too many attempts simply no email arrives. Write to us if this affects you wrongly.

9. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. A short email to info@fine-techs.com is enough.

• Do it yourself: you delete your account under Settings › Account. You download your notes under Knowledge as a ZIP file.
• Everything else: write to info@fine-techs.com. We send further data in a common format on request by email.
• Complaint: you can lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work (Art. 77 GDPR).

10. Your rights under the KVKK

Under Art. 11 KVKK you can ask to learn whether we process data about you, and for information on the purpose and whether it is used accordingly; to learn to whom in Turkey or abroad it is transferred; to have incomplete or incorrect data corrected; to have it erased or destroyed; that recipients are informed of the correction or erasure; to object to a result that arises to your disadvantage solely from automated analysis; and to compensation for damage from unlawful processing.

We collect the data electronically – via the app, the documentation and emails –, partly automatically (Art. 10 KVKK). Legal bases under Art. 5(2) KVKK are performance of the contract (c), legal obligations (ç) and our legitimate interest (f); where necessary your explicit consent. We base transfers abroad on Art. 9 KVKK.

Send your request to info@fine-techs.com. We reply within 30 days at the latest. If you are not satisfied with the reply, you can turn to the Turkish data protection authority (Kişisel Verileri Koruma Kurulu, www.kvkk.gov.tr).

11. Minimum age

The app is only for people aged 18 or over.

12. Changes

If the service changes, we update this policy. The current version is at docs.fine-techs.com/en/privacy. We inform you by email in advance of significant changes.