Privacy Policy

SiriusSync ITS (the “Application”)

Effective date: October 12, 2026

Last updated: October 12, 2026

This Privacy Policy describes how data is processed when you deploy, license, or use SiriusSync ITS. SiriusSync ITS is an enterprise desktop ERP and inventory management system developed by Bilal Khalid Mohammed Ameen (Coder ACJHP) (“Software Provider,” “developer,” “we,” “us,” or “our”), officially hosted at https://siriussyncits.carrd.co/.

If you have questions regarding this Privacy Policy or enterprise data protection practices, please contact us at hexa.octabin@outlook.com

Summary. SiriusSync ITS is engineered with strict privacy-by-design and data segregation principles. The Application guarantees zero telemetry, incorporates no third-party tracking or advertising SDKs, communicates exclusively via encrypted HTTPS/WSS protocols, and preserves all operational commercial records under your enterprise’s direct control.

1. Data Protection Roles: Data Controller vs. Software Provider (KVKK & GDPR)

In compliance with the Turkish Law on the Protection of Personal Data (KVKK Law No. 6698) and the European Union General Data Protection Regulation (GDPR Regulation (EU) 2016/679), responsibilities are clearly demarcated:

Data Controller (Customer Enterprise): The commercial enterprise or business entity licensing and deploying SiriusSync ITS acts as the Data Controller. The customer enterprise determines the business purposes, data collection scope, authorized personnel roles, and lawful retention periods for all commercial and personal data stored within its deployment.
Software Provider (Developer): Bilal Khalid Mohammed Ameen (Coder ACJHP) serves exclusively as the Software Provider furnishing the desktop application software. The developer does not access customer databases in normal operations, maintains no centralized surveillance infrastructure, and does not act as a Data Controller for enterprise business records.

2. Categories of Processed Data

SiriusSync ITS processes the following categories of operational and commercial data:

User Accounts & Authentication: Enterprise user profiles, administrative accounts, role assignments, and passwords. Passwords are never stored in plain text; they are secured using one-way salted BCrypt hashing with a work factor of 12 (12 rounds) on the client side before verification against backend records.
Commercial ERP Records: Operational business records including stock inventory levels, product catalogs (SKUs, barcodes, dimensions, weights, unit costs), Customer Relationship Management (CRM) contacts (customers, suppliers, credit limits, outstanding balances, interaction history), Sales Order Management (SOM) quotations, orders, and delivery notes, Purchase Order Management (POM) procurement orders, goods receipt notes (GRN), multi-item financial receipts, and detailed cost sheets.
Hardware Fingerprinting (HWID Licensing): To enforce the commercial three (3) workstation device license allocation per enterprise deployment, the Application generates a cryptographic Hardware Identifier (HWID) using the open-source OSHI (Operating System and Hardware Information) library. The HWID is an irreversible hash derived from system hardware components (motherboard and processor serials) and collects no personal or behavioral data.
Media Uploads & Cloud Storage: Product images, document scans, and receipt attachments uploaded by authorized operators are stored in dedicated cloud object storage buckets (Supabase Storage) linked to the enterprise deployment.

3. Technical Security, Network Architecture & Telemetry Guarantee

SiriusSync ITS enforces comprehensive security controls to protect enterprise data confidentiality and integrity:

Zero Telemetry & No Analytics: The Application contains absolutely zero telemetry, no background phone-home mechanisms, no behavioral analytics libraries, and no advertising SDKs.
Closed PostgreSQL Direct Ports: Direct database ports (including default PostgreSQL port 5432) remain strictly closed to the public internet. The desktop client never connects directly to raw database ports.
HTTPS / TLS 1.3 & WebSocket Only: All communications between the desktop client and backend services flow exclusively through encrypted HTTPS endpoints using TLS 1.3 (via PostgREST APIs) and secure WebSockets (WSS channels) for real-time synchronization.
Immutable Audit Logs (activity_logs): Critical business operations (such as inventory updates, order lifecycle transitions, role permission modifications, and deletions) are recorded as immutable, append-only entries in the activity_logs table to guarantee traceability, audit compliance, and fraud prevention.

4. Automated Orphaned Media Cleanup Policy

To preserve storage integrity and prevent orphaned data retention, SiriusSync ITS implements an automated media cleanup routine. When an inventory product, financial receipt, or ERP record with cloud attachments is deleted, the corresponding unreferenced image files in Supabase Storage are automatically and permanently purged.

5. Third-Party Cloud Infrastructure (Supabase)

SiriusSync ITS utilizes Supabase for database management, PostgREST API handling, Realtime WebSocket synchronization, and cloud object storage. The customer enterprise maintains its own Supabase tenancy or project instance. Data stored within Supabase is governed by the customer’s cloud configuration, Row-Level Security (RLS) policies, and Supabase’s data processing standards.

6. Data Subject Rights (KVKK Article 11 & GDPR Articles 15–22)

In accordance with Turkish KVKK (Law No. 6698, Article 11) and GDPR (Articles 15–22), individuals whose personal data (such as enterprise user accounts or CRM counterparty details) is processed have the right to:

Request confirmation as to whether their personal data is being processed and obtain details of such processing;
Access their personal data and request copies thereof;
Request correction or rectification of incomplete or inaccurate personal data;
Request erasure, destruction, or anonymization of personal data (“right to be forgotten”);
Request restriction of processing or object to processing;
Request data portability, facilitated through built-in Apache POI Excel export and JasperReports PDF generation.

Because the customer enterprise acts as the Data Controller, data subjects should address requests directly to their organization’s designated system administrator. For technical questions regarding software capabilities, contact our support team.

7. Data Retention & Portability

All operational ERP records and account data are retained according to the customer enterprise’s internal policies and statutory commercial recordkeeping laws. The customer enterprise retains unencumbered data ownership and may export or delete records at any time using built-in system tools.

8. Changes to this Policy

We may update this Privacy Policy from time to time to reflect product enhancements or regulatory changes. The latest version is always published on the official portal at https://siriussyncits.carrd.co/ with the “Last updated” timestamp indicated above.

9. Contact Information

For privacy inquiries, security compliance questions, or technical support:

Developer Contact: hexa.octabin@outlook.com
Official Web Portal: https://siriussyncits.carrd.co/

This document is provided for transparency and informational purposes. It does not constitute formal legal counsel.