solac studio

this notice explains how solac studio processes personal data, under türkiye's law on the protection of personal data (kvkk, no. 6698). it is an information notice, not a consent form.

1. who is responsible

the data controller is atakan solak, a natural person operating solac studio on his own hardware. contact: atakan@solac.studio · web: solac.studio. there is no company, no representative and no establishment outside türkiye.

2. what solac studio is

solac studio is one native application, for iphone, ipad and mac. every tool is a room inside it. open to every member: bridge (your machines, reachable from each other: files, screens, folders), calendar (a sleep-aware day planner - your day re-planned around when you actually wake), converter (convert almost anything into almost anything), custody (know where every disk is - who holds it, what is on it, and a handoff both sides confirm), health (two trackers, kept honestly: water, and quitting smoking), wallet (money, as it actually moves). open when you are invited to a production: adr (the adr notes on the current cut - a line to re-record, the take, the sync), color (the colour notes on the current cut - grade, look, matching, a burn-in fix of that kind), credits (end credits, on their own), dailies (dailies without a lab - point it at a card, get viewing transcodes and a report that maps every clip to its sound), dialog (a dialog bank for a series), edit (the offline edit, followed - cuts and their proxies, every note placed on the newest cut, what changed between versions), motion (the motion graphics notes on the current cut - titles, lower thirds, maps, animation), music (the music notes on the current cut - a cue, a change, where it starts and stops), offload (verified card offload - one read, many targets, every copy re-read from disk and sealed with asc-mhl), online (the online period - the conform and every online cut, the aafs that come with the lock, the shotlist as the live record, the pulls, qc on every cut), post (the production spine - the summary, render and backup of a series, on top of its apps), screen (a review room for your cut - share an expiring watermarked link, collect notes at the exact timecode, hdr on the devices that can show it), sound (the sound notes on the current cut - mix, levels, room tone, a fix on the dialogue; the stems are post's materials), subtitle (the subtitle notes on the current cut - a line, a timing, a spelling), vfx (the vfx shots - pulled, their versions as they arrive, approved or sent back, placed in the online cut or not). there is no web version of the application; the web carries the landing page, this notice, the agreement, the status page and the download.

3. what is processed

3.1 identity and contact: username, email address, and the record that you accepted the user agreement, with its version and the time.

3.2 security and access: password hash (the password itself is never stored), sign-in sessions, a per-device number and its event history (sign-ins, sign-outs, platform changes), a shortened fingerprint of the network address (the raw address is not stored), and server error logs.

3.3 what you put into the tools: what you write down in the tools you open. your money entries and balances; the files you upload to convert and what they are converted into; the project material of a project you were invited to (audio, documents, the transcripts made from them, credit lists); and the tool settings you choose.

3.4 data that may qualify as health data: the water tracker and the smoke tracker record what you drink and your progress in stopping smoking. this may count as health data under article 6 of the law, which is a special category, and it is treated accordingly (see §6).

4. how an account is made

an account is made in one of two ways. either the controller creates it for you, or you sign up yourself inside the application: username, password, email address. a code is sent to that address and the account is not usable until the code is entered; the code expires after 24 hours and can be sent again. a sign-up that is never activated is deleted after 7 days, address and all. the user agreement is accepted before the account exists, never after.

5. why it is processed

to create and maintain your account and let you sign in; to verify that the email address you gave is yours; to run each tool's function for you (the money you keep, the file you convert, the project you work on); to keep your data in step across your own devices; to secure the service and diagnose faults; to notify you about things you asked to be notified about; and to meet legal obligations when a competent authority makes a lawful request.

6. the legal basis

account, sign-in and the running of a tool you chose to use: under article 5/2(c), processing is necessary to perform the contract between us.

security records, error logs and abuse prevention: under article 5/2(f), the controller's legitimate interest in keeping the service secure and available, weighed against your interests; the records are minimal and are not used to profile you.

responding to a lawful request from an authority: under article 5/2(ç), a legal obligation.

the water tracker and the smoke tracker: under article 6/3, your explicit consent, asked on its own short screen before the tool records anything, never buried in a general agreement. you can withdraw it at any time, and you can delete what the tool holds.

7. how it is collected

entirely by automated means, in electronic form, through the native application, through the api calls it makes, through the public web pages, and through server logs.

8. who it is shared with

solac does not sell personal data, does not run advertising, and does not share personal data with third parties for their own purposes.

inside türkiye: nothing is transferred to another party. the data stays on the studio's own machine. one exception is your own doing: in a project you were invited to, the people on that project see the project's material, and a share link you create can be opened by anyone holding it. such links expire and you can cancel one at any time.

outside türkiye: the site is reached through cloudflare, which operates servers in many countries and carries the traffic between you and the studio. traffic therefore passes through infrastructure outside türkiye. no application data is stored abroad. outgoing email (the activation code, password reset) is delivered through mail infrastructure that may route outside türkiye.

authorities: personal data may be disclosed to competent public authorities where a lawful request obliges it.

9. how long it is kept

account data and what you put into the tools are kept for as long as your account exists. a sign-up that is never activated is deleted after 7 days. an account can be deactivated, by you, from inside the application, or by the controller. a deactivated account cannot sign in and does nothing further; its data is kept, with no time limit, so that coming back is coming back and not starting over. the application has no button that deletes an account, on purpose. your right to have your data erased is untouched by that: ask in writing (§12) and it is erased. error logs and security records mentioning you are cleared on their own cycle, within six months at the latest.

10. how it is protected

the server is not a shared cloud host; it is the controller's own machine, reachable only through an encrypted tunnel. passwords are stored as hashes, never in readable form. traffic is encrypted in transit. access to the server is limited to the controller.

11. cookies and automated decisions

the public web pages set no cookie for advertising or tracking, and carry no analytics and no third-party tracker. the application signs in with a token it keeps on your own device, not with a cookie.

no decision producing a legal effect concerning you, or significantly affecting you, is made solely by automated means. some tools use models to transcribe, categorise or suggest, and the result is a suggestion inside your own work, not a decision about you.

12. your rights, and how to exercise them

under article 11 of the law you have the right to: learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether it is used accordingly; know the third parties to whom it is transferred, at home or abroad; request correction if it is incomplete or incorrect, and that this be notified to those parties; request erasure or destruction where the grounds for processing have disappeared, and that this be notified to those parties; object to a result arising exclusively from automated analysis that is to your detriment; and claim compensation for damage caused by unlawful processing.

write to atakan@solac.studio from the email address registered to your account, stating your request and your name. requests are answered free of charge, within thirty days at the latest. if answering a request carries a cost, only the tariff set by the personal data protection board may be charged. if your request is refused, if the answer is unsatisfactory, or if no answer arrives in thirty days, you may complain to the personal data protection board within thirty days of learning the answer, and in any case within sixty days of the application.

13. changes

this notice carries its own version, in three parts, and it does not follow the application's version. the version in force is the one shown at the top of this page. when a practice described here changes, the text is updated, the version is raised, and members are told what changed. from v1.0.0 onwards a member is shown what changed and answers it inside the application; until then the current text is simply the one in force.

i have read and understood this notice.

contact: atakan@solac.studio · user agreement