Privacy notice

Last updated 12 October 2026

Who we are

This website and the Tomruq service are run by Tomruq (company in formation). The company is being formed; once it is registered, this notice and the legal notice name it. Until then, write to us at hello@tomruq.com.

This website

This website sets no cookies and uses no analytics, advertising or tracking. It loads nothing from other companies: its fonts and images are served from this site, and nothing is stored in your browser.

The website is hosted by Render. Like any web server, the host processes the technical data every request carries (the IP address, the time, the page asked for and the browser) to deliver the page and to protect it from abuse. We do not use that data to identify or follow visitors.

When you write to hello@tomruq.com, or send the pilot form (which opens your own email program), we receive what you write: usually your name, your email address, your organization and your message. We use it only to answer you and, if you ask, to arrange a pilot or a demo, and we delete it once it is no longer needed for that. The legal basis is taking steps you asked for before a contract, and our legitimate interest in answering business enquiries (GDPR Article 6(1)(b) and (f); KVKK Article 5(2)(c) and (f)).

The apps and the console

Organizations, our customers, use Tomruq to record their timber. For the personal data in those records, the organization is the controller, and Tomruq processes it as its processor: only on the organization’s instructions, under the agreement with it. If you are recorded by an organization, as a crew member, a driver or a member of its staff, please send questions and requests to that organization. If you write to us, we pass your request on.

What an organization may record in Tomruq:

• Names: of the people with an account, and of crew members on the organization’s list. Usernames, and email addresses where a person signs in or is invited with one.
• Identifiers such as an employee number and, if the organization records one, a national identification number. These are masked, and reading one in full takes a reason and is recorded.
• The work: which tree, log, load or board, who recorded it, on which device and when. Optional notes about a tree. Drivers’ names and truck plates.
• The location of a felling, taken only while the felling screen is open. The app never follows anyone in the background.
• Photos of felled trees and their stamps, taken with the app’s own camera, without a location in the file. They are kept encrypted in the app and never saved to the device’s gallery.
• Device data: an identifier the app makes for its installation, so the organization can see and revoke the device (not an advertising identifier), the app’s and the operating system’s version, and after each sync how many records wait to be sent.
• Sign-ins and actions in the console, with the IP address used, in a log the organization’s owners, managers and auditors can read. Whether a person uses two-step sign-in.
• The mails the service sends (invitations, password resets, alerts and summaries), and each person’s choice of mails.

What we never do

• We do not sell personal data, and we do not use it for advertising.
• The apps and the console contain no advertising, analytics or tracking software. Crash reporting is switched off. The service’s emails are a separate case, explained under “Emails from the service”.
• We never combine or compare data across organizations, for any purpose.
• Nobody at Tomruq reads an organization’s records unless one of its owners grants support access, for a limited time, and every access is recorded.

Cookies in the console

The console uses one cookie, to keep you signed in, and keeps a few settings in the browser, such as which organizations it has signed in to and your recent searches. These are needed for the console to work, so no consent banner is shown. There are no tracking cookies.

Emails from the service

The service’s emails (invitations, links to set or reset a password, alerts, summaries and notices about the account) are sent through Brevo (Sendinblue SAS, France, in the EU), which processes them for us as our processor.

Brevo routes the links in these emails through its own redirect, and adds a tiny image that tells Brevo when an email is opened, if your mail program loads images. Brevo cannot switch either off for these emails. We use Brevo’s anonymous mode, so opens and clicks are not tied to you or your email address, and we do not use these figures to profile anyone. Brevo uses them to deliver the emails and to prevent security problems and abuse.

The legal basis is our legitimate interest in delivering the service’s emails reliably and securely (GDPR Article 6(1)(f); KVKK Article 5(2)(f)). Because the links pass through Brevo, every invitation and password link works only once and then expires.

Where the data is, and who helps us

The data is hosted in the European Union. These providers process it for us, on our instructions:

• Render (Render Services, Inc., United States): runs the service, the console and the database, in Frankfurt, Germany; also hosts this website.
• Cloudflare (Cloudflare, Inc., United States): stores photos, imported files, exports and the encrypted backups in Cloudflare R2, under its EU jurisdiction setting.
• Brevo (Sendinblue SAS, France): sends the service’s emails, as described under “Emails from the service”.

Transfers

Render and Cloudflare are companies based in the United States; the data they hold for us is stored in the EU. Where access from outside the EU counts as a transfer, it is covered by the European Commission’s standard contractual clauses in their data processing terms. For organizations in Türkiye, the data is stored outside Türkiye, in the EU; the safeguards for that transfer under KVKK Article 9 are part of the agreement with each organization.

How long data is kept

• Records are kept for as long as the organization uses Tomruq: the history is the organization’s evidence of where its timber came from, so records are not deleted one by one.
• Where the law requires a person’s data to be erased, an owner of the organization does it in the product. The person’s name and identifiers are replaced by a pseudonym, and the erasure is recorded.
• A person can delete their own account in the device app (Settings, Delete my account) or on the web. The sign-in is removed; the work they recorded stays in the organization’s register under a pseudonym.
• When an organization closes its account, it has 30 days to export its data. Then the data is deleted, and the deletion is confirmed in writing.
• The database is backed up every night, encrypted. Backups are kept for 30 days and then deleted, so deleted data leaves the backups within 30 days. The host also keeps its own recovery copies for a few days.

Your rights

Under the GDPR you may ask for access to your data, for it to be corrected or erased, for its processing to be restricted, and for a copy to take elsewhere, and you may object to processing based on our legitimate interest. Under the KVKK (Article 11) you may also ask whether your data is processed, for what purpose, and to whom it is transferred, and ask for the outcome of a correction or deletion to be passed on.

For data an organization recorded about you, ask that organization; for anything else, write to hello@tomruq.com. We may need to confirm who you are first, and we answer within 30 days. You may also complain to a data protection authority, in the EU where you live or work, or in Türkiye to the Personal Data Protection Authority (KVKK).

Changes

When the service changes, this notice changes with it, and the date at the top says when. We tell organizations’ owners by email about a change that matters to them.

How the data is protected: Security and data protection. Legal notice.