Your data

Privacy notice

What happens to your data when you visit this site or write to me — in plain language, as Article 13 of the GDPR requires.

  • Last updated:
  • Controller: Tolga Şahin
  • No cookies — checked in the site's code
  • TrackingNo cookies, no analytics

    Nothing is loaded from third parties. Fonts and scripts come from this site.

  • Contact formGoes to my inbox only

    The form sends your message to my inbox. A copy is kept on the site’s server for at most 90 days, then deleted.

  • Retention12 months at most

    Enquiries are deleted at the latest 12 months after our last exchange.

  • Your rightsOne email away

    Access, correction, deletion, objection — I reply within one month.

Checked in your browser, now

This page has sent requests to other sites.

Checked before publishing; recounted in your browser when scripts run.

Open the full X-ray →

How it was measured

Your browser’s own list of what this page loaded (Resource Timing), filtered to addresses outside this site, counted when this section came into view.

Limits

It covers this page and this visit only; browser extensions are not counted. It is a check, not a certificate.

Source type

Your browser, now.

Who is responsible

The controller for this website and for the messages you send me is Tolga Şahin, a natural person who runs TAI Solutions.

What I process and why

I only process what you choose to send me, and only to answer you. Each activity below shows what, why and on which legal basis in the GDPR.

The contact form

What
Your name, email address, the service you're interested in and your message — plus, if you add them, budget, timeline, company size or current system. The email also carries the address of the page you sent it from.
Why
To reply and, if you ask, to prepare an offer.
Legal basis
Steps you ask for before a possible contract — Art. 6(1)(b).

When you press send, the form sends your name, email, the chosen service, your message and the optional budget and timeline to this site’s server (Cloudflare). From there it is emailed to my inbox; the server copy is deleted automatically after 90 days. To limit abuse, the server also keeps a scrambled, daily-changing code derived from your IP address — never the address itself. If the form can’t reach the server, it opens a pre-filled email in your own email app instead, and that email leaves only when you press send.

Email, WhatsApp and phone

What
Your email address or phone number, the name you use there, and what you write or say — including any attachments.
Why
To answer you.
Legal basis
Art. 6(1)(b) when you ask about a service; otherwise my legitimate interest in answering people who contact me — Art. 6(1)(f).

Visiting this site

What
Technical data your browser sends with every request — such as IP address, browser type, the time and the page requested — recorded by the hosting provider.
Why
To deliver the site and protect it against abuse.
Legal basis
Legitimate interest in a working, secure website — Art. 6(1)(f).

Hosting: Cloudflare Pages.

If we work together

What
Your contact and billing details and what we agree in writing.
Why
To do the work and keep the accounts.
Legal basis
Performing our contract — Art. 6(1)(b); accounting obligations — Art. 6(1)(c).

I don't add you to any mailing list and I don't use your data for any other purpose. If that ever changes, I will tell you before I start (Art. 13(3)).

What this site does not do

Checked in the site's code on 28 September 2026:

  • No cookies — which is why you see no cookie banner.
  • No analytics, tracking pixels or advertising tags.
  • No third-party scripts, fonts, maps or video embeds — everything loads from this site.
  • No profiling and no automated decisions about you.
  • The demos — TAI Pontaj, the automation studio, the website demo and the CV fit check — run entirely in your browser, on fictional sample data or on text you type; nothing you do in them is sent anywhere.

The WhatsApp button and links to other sites (for example LinkedIn or official sources) take you there only when you click them; from then on you are on that site, under its own rules. tolgaphotoart.com — a separate site of mine, linked from the project cards — uses Google Analytics. If I ever add analytics here, I will update this notice first.

Tools that run in your browser

  • Ask box. When you open it, this site loads one file from itself — its own search index. What you type is matched in your browser and is not sent anywhere. Nothing is stored. While the box is open, this site does not ask your browser to prepare other pages.
  • X-ray mode, the proof notes, the live counter at the top of this page and the four demos run entirely in your browser. The counter reads your browser’s own list of what this page loaded; nothing is sent. Files you download are created on your device. A CSV you choose in the automation studio, and text you paste into the CV fit check, are read only by your browser.
  • Faster page changes. When you pause on or near a link, your browser may prepare that page in advance. The request goes to this site only, like a normal visit, and may appear in the hosting logs described above.
  • Homepage intro. It checks, only inside your browser, whether you arrived from another site, so it does not replay while you browse. It loads its drawing files from this site, like an image. Nothing is stored in your browser.
  • Motion switch. Turning motion off adds ?motion=off to the links you follow on this site; nothing is stored.

Apps you can download

  • Downloads. The app files and sample files on the Websites & Apps page are plain files served from this site; the desktop installers come from its download address, dl.taisolutions.net (same hosting provider). There is no account, no sign-up and no tracking of who downloads what; the request reaches the hosting provider like any page visit and may appear in the hosting logs described above.
  • The apps themselves (TAI Reconcile, TAI Reader, TAI Quote) contain no analytics; the desktop apps and the Android app make no network requests. The files you open in them stay on your device. If I send you an installer link by email or WhatsApp, that message is handled as described under “Email, WhatsApp and phone”.
  • TAI Quote in a browser (iPhone, iPad or computer) opens from this site once, then works offline. When you are online, your browser may check this site for an app update; that request may appear in the hosting logs described above. Your company details, catalogue, clients and quotes are stored only in that browser on your device. Deleting the app or clearing the browser’s data removes them; the JSON backup in its settings is a file you keep yourself.
  • TAI Reconcile and TAI Reader in your browser open from this site; loading their pages and the sample files may appear in the hosting logs described above. The files you choose are read by your browser on your device and are not uploaded: the pages allow no requests to other servers. Opening some PDFs makes your browser load extra font, image or colour data files from this site; these requests carry no part of your document, but their file names can appear in the hosting logs. They remember your settings in that browser, such as language and theme. TAI Reconcile also remembers your last five setups: column positions and how many columns each side has, the matching rules, the names you give the two tables, when you ran them and a short fingerprint of the header row (for a file without a header row, only its number of columns). The rows themselves are never stored. “Forget saved setups” clears them. In TAI Reader a signature is saved only if “Keep on this device for next time” is ticked when you add it (in the browser this box starts unticked), and it stays until you delete it with ×. TAI Reader in the browser also saves its own program files (about 6 MB: the PDF engine, fonts and the sample file) in your browser so that it keeps working if the connection drops; your documents are never saved there. Clearing this site’s data in your browser removes all of it.

Recipients

Only the services that carry your message to me:

  • Google (Gmail)My email provider — it stores the emails you send me. Google Privacy Policy
  • WhatsApp Ireland LimitedOnly if you choose WhatsApp — it provides that service under its own privacy policy. WhatsApp Privacy Policy
  • CloudflareHosts this site, receives contact-form messages (kept at most 90 days) and forwards them and emails sent to [email protected] to my inbox; it handles the technical logs described above. Cloudflare Privacy Policy

I don't sell your data and I don't pass it to anyone else.

Transfers outside the EEA

These providers may process data outside the European Economic Area, including in the United States. According to their own privacy policies (read on 24 September 2026), they rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework and on standard contractual clauses. Their policies describe these safeguards in detail.

How long I keep it

  • EnquiriesForm emails, other emails, WhatsApp messages and notes from calls: kept until your enquiry is answered and followed up, and deleted at the latest 12 months after our last exchange.
  • If we sign a contractAccounting documents such as invoices: as long as accounting law requires — currently 5 years, counted from 1 July of the year after the financial year ends (Law 82/1991, art. 25).
  • Hosting logsKept by the hosting provider for the periods set in its own policy.

Your rights

You have these rights under the GDPR. Using them is free of charge.

  • Access Art. 15

    Ask whether I hold data about you and get a copy.

  • Rectification Art. 16

    Have wrong or incomplete data corrected.

  • Erasure Art. 17

    Have your data deleted when I no longer need it or have no legal ground to keep it.

  • Restriction Art. 18

    Ask me only to store your data, not use it, while a question is being settled.

  • Portability Art. 20

    Receive the data you gave me in a machine-readable format or, where technically feasible, have it sent directly to another controller.

  • No automated decisions Art. 22

    Not to be subject to a decision based solely on automated processing. None are made here.

How to use your rights

Write to [email protected] — the subject “Privacy request” helps. I reply without undue delay and within one month at the latest. If a request is complex, I may extend this by up to two more months and will tell you why within the first month (Art. 12(3)). If I have reasonable doubts about who is asking, I may ask you to confirm your identity (Art. 12(6)).

Email a privacy request

Complaints

If you think I handle your data unlawfully, you can complain to the Romanian data protection authority — or to the authority in the EU country where you live or work (GDPR Art. 77). You're welcome to write to me first, but you don't have to.

ANSPDCP — National Supervisory Authority for Personal Data Processing
www.dataprotection.ro · Procedure for complaints

Good to know

Do you have to give me your data?

No. No law or contract requires it. Without an email address or phone number, though, I can't reply to you.

Automated decisions

None. No decision about you is made by software alone, and no profile of you is built.

Client work

Work for clients is agreed in writing before I start. Where I process personal data on a client's behalf — for example during a TAI Pontaj audit or maintenance — we sign a data processing agreement first (GDPR Art. 28), and the client remains the controller.

Credits

Intro figure: Quaternius, CC0.

Changes to this notice

If the way I handle data changes, I update this page first and change the date at the top. Last updated: .

Sources

  1. Regulation (EU) 2016/679 (GDPR) — Art. 6, 12, 13, 15–22, 28, 77 · EUR-Lex
  2. Law 190/2018 implementing the GDPR in Romania · legislatie.just.ro
  3. Law 82/1991 on accounting, art. 25 · legislatie.just.ro
  4. ANSPDCP — contact details · dataprotection.ro
  5. Google — data transfer frameworks · WhatsApp — Privacy Policy (European Region) · Cloudflare — Privacy Policy — read on 24 September 2026