Studio
Sign in

Privacy Policy

Last updated: 27 October 2026

This Privacy Policy explains how 850 HOUSE YAZILIM VE TİCARET LTD. ŞTİ. ("850house", "we", "us") collects and uses personal data when you use 850house Studio at https://studio.850house.co and the site previews at sites.850house.co (together, the "Service"). It applies to all users, including users in the European Union and the United Kingdom.

If you are in Turkey, our KVKK Privacy Notice (Turkey) gives the information required by the Turkish Personal Data Protection Law No. 6698 (KVKK) and forms part of this policy.

This policy is published in Turkish and English. If the two versions differ, the Turkish version prevails.

1. Who is responsible for your data

The data controller is 850 HOUSE YAZILIM VE TİCARET LTD. ŞTİ., Büyükdere Mah. Çayırbaşı Cad. No: 58 İç Kapı No: 1 Sarıyer / İstanbul, Turkey (Sarıyer Tax Office 0281059451, MERSIS 0028105945100001).

For any privacy question or request, write to info@850house.co. You can also reach us at info@850house.co or +90 532 348 44 84.

2. What we collect

  • Identity and contact: your email address, your name if you give it and, if you sign in with Google, your basic Google profile (name and profile photo).
  • Account security: your password (stored only as a one-way hash, never in readable form), your sign-in sessions and sign-in records.
  • What you create: your chat messages to the AI agent, the files of each site and each of its versions, logos and images you upload, images we generate for you, your brand kits and their settings (colours, type, logo, illustrations), your credit balance and credit history.
  • Quote requests (bigger builds, custom domains and hosting): name, email, company, what you want built, domain and hosting needs, timeline, budget and any notes you add.
  • Payments: order number, amount, date and payment status, as received from the payment provider. Card details are entered on the payment provider's page; we never receive or store full card numbers.
  • Technical data: IP address, browser and device information, server and error logs, and cookies (see our Cookie Policy).

We collect this data directly from you when you sign up, use the Service, buy credits or contact us, and automatically through our servers and cookies. Google sends us your basic profile only if you choose Google sign-in.

3. Why we use it and our legal bases

PurposeLegal basis (GDPR / KVKK)
Creating and running your account, signing you inContract: GDPR Art. 6(1)(b); KVKK Art. 5/2(c)
Planning, writing, checking and publishing previews of your sites with AI, and keeping their versionsContract: GDPR Art. 6(1)(b); KVKK Art. 5/2(c)
Creating, storing and exporting your brand kits, generating imagesContract: GDPR Art. 6(1)(b); KVKK Art. 5/2(c)
Selling credits, billing, invoices (e-invoice / e-archive) and tax recordsContract and legal obligation: GDPR Art. 6(1)(b), (c); KVKK Art. 5/2(c), (ç)
Customer support and answering your requestsContract and legitimate interest: GDPR Art. 6(1)(b), (f); KVKK Art. 5/2(c), (f)
Preparing a quote for a bigger build, custom domain or hosting when you ask for oneSteps before a contract: GDPR Art. 6(1)(b); KVKK Art. 5/2(c)
Security, preventing fraud and abuse, keeping logsLegitimate interest and legal obligation: GDPR Art. 6(1)(f), (c); KVKK Art. 5/2(f), (ç)
Establishing, exercising or defending legal claimsLegitimate interest: GDPR Art. 6(1)(f); KVKK Art. 5/2(e)
Improving the Service from usage and error dataLegitimate interest: GDPR Art. 6(1)(f); KVKK Art. 5/2(f)
Service messages (sign-in links, account and billing notices)Contract: GDPR Art. 6(1)(b); KVKK Art. 5/2(c)
Non-essential cookies, if we ever use themConsent: GDPR Art. 6(1)(a); KVKK explicit consent

We do not send marketing emails without your separate consent (and, in Turkey, registration in the Commercial Electronic Message Management System, İYS). We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. AI providers

To build your site, your chat messages and the files of the site are sent, for each turn, to Anthropic (Claude, the AI model that plans and writes the site). When you generate images or a brand description, your prompts and, for logos, your brand name are sent to OpenAI. They use this content only to produce your result and return it to us. Under their API terms they do not use API data to train their models [confirm per provider].

We do not use your sites, brand kits or prompts to train AI models, and we do not feature your site publicly without your permission.

5. Who we share data with

We do not sell your personal data. We share it only with service providers that process it on our behalf under contract, and with others when the law requires:

ServiceWhat forLocation
SupabaseDatabase, sign-in, file storageEU (Frankfurt, Germany)
VercelHosting https://studio.850house.co and the site previews at sites.850house.co[USA / global edge network]
Trigger.devRunning the agent's background jobs (writing and checking sites)[EU / USA]
AnthropicAI model (Claude) that plans and writes the siteUSA
OpenAIAI image generation and brand descriptionsUSA
ResendSign-in, account and other transactional emailsUSA
PayTRCard paymentsTurkey
GoogleGoogle sign-in (only if you choose it)USA
Accountants, tax authorities, courts and public authoritiesAccounting, tax and legal obligations, when requiredTurkey

Anyone with the link to a site preview (https://sites.850house.co/<site id>/) can open it. Links are unlisted, not secret, so share them with care and do not put personal data in a site you do not want others to see.

6. Transfers abroad

Most of our service providers are outside Turkey, and some are outside the EU. For transfers from Turkey we rely on the safeguards in Article 9 of the KVKK (as amended by Law No. 7499, in force since 1 June 2024), mainly standard contracts notified to the Turkish Personal Data Protection Authority within five business days of signing, and, where no adequacy decision or safeguard is available, occasional transfers allowed under Article 9/6, for example where the transfer is necessary to perform our contract with you.

For users in the EU or UK, transfers to countries without an adequacy decision are covered by the European Commission's Standard Contractual Clauses or, where the recipient is certified, the EU-US Data Privacy Framework.

7. How long we keep data

  • Account, site and brand kit data: while your account is open. After it is closed, deleted or anonymised within about 6 months, except where we must keep it longer.
  • Invoices, payment and transaction records: up to 10 years, as required by the Turkish Commercial Code, the Tax Procedure Law and Law No. 6563.
  • Deleted sites and brand kits: their files, versions and images are removed immediately when you delete them in the app, and the preview link stops working.
  • Server and access logs: up to 2 years (including the traffic data hosting providers must keep under Law No. 5651).

When a retention period ends, data is deleted, destroyed or anonymised under our data retention and destruction policy, including periodic destruction.

8. Security

We use encrypted connections (HTTPS), access controls, private file storage, and providers with recognised security practices. No system is perfectly secure; if a breach affects your data, we will notify you and the competent authorities as the law requires.

9. Your rights

Depending on where you live, you can ask us to:

  • tell you whether we process your data and give you a copy of it;
  • tell you why we process it, who we share it with (in Turkey and abroad) and whether it is used as intended;
  • correct inaccurate or incomplete data;
  • delete or destroy your data, and tell the recipients about the correction or deletion;
  • restrict processing or object to processing based on legitimate interests;
  • receive your data in a portable format (data portability, for EU/UK users);
  • withdraw consent at any time, without affecting earlier processing;
  • object to an outcome against you that results solely from automated analysis;
  • be compensated for damage caused by unlawful processing.

To use these rights, email info@850house.co from the email address registered with us, or use the other channels listed in the KVKK Privacy Notice (Turkey). We answer free of charge within 30 days. To delete your account, email us; deleting your account removes your remaining credits.

You can also complain to a supervisory authority: in Turkey, the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu); in the EU or UK, the data protection authority where you live or work.

10. Children

The Service is not for people under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

11. Cookies

We use only cookies that are strictly necessary for signing in and remembering your language and cookie choices. We do not use analytics or marketing cookies today. Details, and how to change your choices, are in our Cookie Policy.

12. Changes to this policy

We may update this policy when the Service or the law changes. We will post the new version on this page with a new date, and tell you by email or in the app about significant changes.

13. Contact

850 HOUSE YAZILIM VE TİCARET LTD. ŞTİ., Büyükdere Mah. Çayırbaşı Cad. No: 58 İç Kapı No: 1 Sarıyer / İstanbul. Email: info@850house.co. Phone: +90 532 348 44 84.