Garage

Data policy

Last updated: October 30, 2026

This policy explains where the business data you enter in Coudy is kept, who can reach it, what leaves Turkey and what happens when you cancel. In short: your data is yours, Coudy never sends it abroad, it is handed over whenever you ask, and when you cancel it is handed over first and then permanently deleted.

01Scope

This policy separates two kinds of data. The first is the business data your company enters in Coudy: accounts, invoices, vehicles, work orders, stock, cash and bank movements, staff and user records. Your company owns this data and is its controller under KVKK and the GDPR.

The second is what you send us through the forms on coudy.app: demo, quote and contact requests and meeting bookings. Codian Limited is responsible for these; how they are handled is set out in the KVKK notice and the GDPR privacy notice.

02Your data is yours

  • We process your business data only to serve you: installation, updates, maintenance and the support you ask for.
  • We don't sell or rent your data, use it for advertising or share it with any other business.
  • We don't use your data to train AI models or for our own product analytics.
  • With the server in the package and with server care, Codian processes your data on your behalf; that relationship is set out in the Data Processing Agreement.

03Where your data is kept

  • Your own server: Coudy is installed on your server, and your data stays there, wherever you choose to keep it.
  • Server in the package: the server is rented for your business alone from a trusted Tier III data centre in Turkey, and your data is kept on it. You never share a database with another customer.
  • Backups: backups of the server in the package are encrypted and kept at a separate location in Turkey. With server care, where the backups are kept is agreed with you and never outside Turkey.

04What leaves Turkey

Coudy does not send your business data outside Turkey. The one exception is the telemetry Coudy sends to check its licence and watch that it runs. Telemetry goes to Codian's servers in data centres in the European Union (OVHcloud and AWS), where it is kept under the EU's data protection rules (the GDPR).

  • What is sent: the installation's ID, the company code, the Coudy version, the licence status, and the number of users and branches. When error summaries start being sent, they will carry no personal data and no business records.
  • What is never sent: account, invoice, vehicle, work order, stock, cash or staff records; the personal data of your customers and staff; users' passwords.

05Data that goes where you tell it

  • e-Invoice and e-Archive: the invoices you issue go, by your choice, to a GİB-approved private integrator and from there to the Turkish Revenue Administration. This transfer stays within Turkey.
  • Your customer's signature: the signing link opens on your customer's phone; the signed document stays on your server.
  • If you print or share a report, a statement or an invoice, where that copy goes is your choice.

06When the Coudy team can reach your data

  • With the server in the package and with server care, we reach the server to install, update, back up and maintain it; we don't open your business records while doing so.
  • We look at your business records only when you ask for support, and only as far as that request needs.
  • Sign-ins of the Codian system administrator account in Coudy are logged, so you can see who signed in and when.
  • If you run your own server without server care, we cannot reach it unless you let us.

07How we protect your data

The connection is always encrypted with HTTPS; session and encryption keys are generated anew for each installation; every user sees only the screens their role allows; and you can limit the system to your own networks. The Security page has the details.

08Your data, whenever you ask

You can ask for all of your data while your subscription runs and after it ends. Within 30 days of your request we hand over:

  • A full backup of the database (PostgreSQL), which can be restored into Coudy or another system.
  • Readable exports of lists such as accounts, stock, invoices and cash (CSV or Excel).
  • The PDF and UBL files of your invoices.

09When you cancel

  • Within 30 days of the cancellation date we hand over all of your data in the form above.
  • Within 30 days of the handover we permanently delete your data from the server and the backups, and confirm it to you in writing.
  • On your own server your data is already with you; any backups we hold under server care are deleted on the same timeline.
  • Retention duties set by law, such as those of the Turkish Tax Procedure Law, are your company's; we recommend keeping the copy we hand over for as long as they require.

10Changes and contact

If we change this policy we publish the new version on this page and tell our customers by e-mail beforehand. For questions and data requests, write to [email protected].