PRIVACY POLICY

Your data stays on your device.

Effective date: June 1, 2026. BulkPro is a local-first application; the files you process never reach our servers. This policy explains the minimum data we process, what we never process, the legal basis, our sub-processors, and your rights. It is written with Turkish Law no. 6698 (KVKK) and, for users in the European Economic Area (EEA), GDPR principles in mind.

1. Data controller

BulkPro is developed and provided by Bilgetek; for this policy the data controller is Bilgetek (Istanbul, Türkiye). General contact: hello@bilgetek.com. For privacy and personal data requests: privacy@bilgetek.com.

2. Core principle: local-first processing

BulkPro runs on your desktop. The files you process (PDF, Excel, images, video, audio) are processed only on your device and are never sent to Bilgetek servers or third parties. The limited processing described below is solely for licensing, communication and optional usage measurement.

3. What we process (minimum)

We process only the following limited data for the app to function and for our services to be delivered:

  • Anonymous device identifier (instance_id): an irreversible SHA-256 derived from a hardware signature. It cannot be linked to your identity; used for license uniqueness.
  • App version, operating system type and license status (licensed or not): for compatibility, security updates and aggregate usage estimation.
  • A periodic anonymous 'heartbeat' request: to know the app is in active use (at most once a day).
  • If you buy a Pro license: the email address associated with your license key, processed to validate the license and deliver the activation email.
  • If you use the contact form: name, email and message content, processed solely to answer your request.

Heartbeat telemetry is not mandatory. One click in Settings → Privacy turns it off; when off, the app runs fully offline.

4. What we do NOT process

  • File content: not a single byte of your PDFs, Excels, images, video or audio reaches our servers.
  • Filenames or file paths.
  • Identity data on the free tier: no signup or email is required.
  • Browser/cookie-based tracking inside the app: BulkPro is a desktop application.
  • Keyboard, mouse, screen, microphone or camera capture.
  • Third-party ad-network data or ad SDKs.

5. Purposes and legal basis

Each processing activity has a defined purpose and legal basis.

  • License uniqueness and activation: performance of a contract (KVKK art.5/2-c; GDPR art.6(1)(b)).
  • Security updates and aggregate usage measurement: legitimate interest (KVKK art.5/2-f; GDPR art.6(1)(f)).
  • Sending activation and transactional emails: performance of a contract (KVKK art.5/2-c; GDPR art.6(1)(b)).
  • Responding to the contact form: consent and/or legitimate interest (KVKK art.5/1, 5/2-f; GDPR art.6(1)(a), 6(1)(f)).

6. AI module data flow

OCR, background removal, Whisper transcription and every other AI feature run on local models. Models are downloaded on first use and then keep working offline.

  • No AI operation makes an external API call.
  • Your audio, image, text never leaves your device.
  • Models run locally on your device CPU.

7. Sub-processors

To deliver the service we work with a limited set of infrastructure providers. Each provider performs only its own function and has no access to your file content.

  • Cloudflare: website hosting, CDN, email routing and form security (Turnstile). Keeps standard connection metadata.
  • Resend: delivery of activation and transactional emails.
  • GitHub: hosting and download of installer releases.

Some of these providers operate their servers outside Türkiye. Limited data (e.g. connection metadata, email address) may therefore be transferred abroad, only to the extent needed to deliver the service.

8. Data retention

Heartbeat data (anonymous device identifier + version) is kept for at most 12 months and auto-deleted afterwards. License records are kept for the duration of license obligations and statutory retention periods. Contact-form correspondence is kept for at most 3 years after the request is resolved, then deleted or anonymized.

9. Your rights

Under KVKK and GDPR you have the rights of access, rectification, erasure, restriction of processing and objection. You can turn off heartbeat from inside the app; you can request deletion or a summary of your records by writing to privacy@bilgetek.com. We handle requests within 30 days. EEA users may lodge a complaint with their data protection authority; users in Türkiye may complain to the Personal Data Protection Authority (KVKK).

10. Children's privacy

BulkPro is not directed at people under 18 and we do not knowingly process children's personal data.

11. Policy updates

When this policy changes meaningfully, the effective date is updated and a summary is shown to the user on next app launch.

Got questions?

For privacy and personal data requests: privacy@bilgetek.com

Contact page