We use AI in our work, but not at every step. It helps us speed up research, produce first drafts, get help while writing code and broaden our tests. However, we don't use it to draw final logos, to process our clients' data or to carry out the final quality check. In this article, we explain openly how we use AI in our design and software process, where our limits are, and why.
In short
- For us, AI is an assistant: we use it for research, first drafts, coding help, testing and copy editing.
- Where we don't use it is clear: final logos and brand marks, client data and the final quality check.
- A person reviews every output AI produces; nothing goes to a client or gets published without approval.
- We don't put client data or confidential files into public AI tools. This is also consistent with the core principles of Turkey's Personal Data Protection Law (PDPL).
- We apply the same principles when developing our own products (AquaCRM, the Label Job Tracking Assistant and Grafik Sanat).
Why are we writing this?
When AI comes up, people may ask a design and software studio two natural questions. "Did you make this with AI?" And "Why should I work with a studio when AI exists?" We'll address the second question in a separate article. The answer to the first is "yes, at some steps," and you have a right to know which steps those are.
Google suggests something similar to content creators. It recommends explaining the use of AI or automation where readers might ask "how was this made?" We want to do this not just for content but for all our services.
How we use AI: which steps?
Research and initial screening
When a project starts in a new industry, AI helps us quickly scan the terminology, competitors' general approach and frequently asked questions. But we don't use the information AI gives us as a source. As Google also points out, generative models don't retrieve information from somewhere. Instead, they predict likely sequences of words based on their training data. That's why they can produce incorrect information. If a piece of information matters, we verify it against an official source, the legislation or the manufacturer's documentation.
Ideas and first drafts
In design, we use AI mostly in the exploration phase: to see different color directions, composition ideas or layout alternatives in rough form. These outputs are part of a mood board, not part of the delivered work. In the next step, we make design decisions by hand and produce the work as original.
Help while writing code
In software projects, coding assistants help us speed up repetitive code, understand a bug, explain existing code or see refactoring options. Our principle here is this: we review code suggested by AI at least as closely as code written by a developer, not less. Research shows this caution isn't unnecessary. For example, a study published in 2021 and presented at IEEE Security & Privacy 2022 looked at 1,689 programs that GitHub Copilot generated across 89 scenarios. The researchers found security vulnerabilities in about 40 percent of them. The tools have improved since then. Still, only human review closes the gap between "it works" and "it's secure and maintainable." We covered this in detail in our article on AI-assisted software development.
Test scenarios
To think through the edge cases in which a form or a workflow might break, we ask AI for scenario suggestions. Examples include an empty field, very long text, Turkish characters or two records at the same time. We write and run the tests ourselves; AI only helps us expand the list.
Content and copy editing
In blog posts and website copy, AI helps us produce drafts, correct spelling and phrasing, and simplify long texts. We check every technical and legal claim in each article against its sources one by one. We also keep the sources at the end of the article. Before publishing, every article goes through human approval. Finally, we don't write information such as statistics, prices or client results if there's no source for it.

Where don't we use AI?
This section is the real reason for this article.
Final logos and brand marks
We don't have AI draw the final logo or brand mark. There are three reasons for this:
- Risk of similarity: AI tends to produce results close to common patterns. As a result, a mark that looks too much like an existing brand can cause problems at registration.
- Unclear rights: Copyright protection for content generated from prompts alone is contested, and it varies from country to country. The US Copyright Office concluded that writing prompts alone does not confer authorship.
- File and system needs: A logo requires an identity system and a clean vector file that stays sharp at any size.
We covered these topics in detail in our articles on designing a logo with AI and the commercial use of AI-generated images.
Client data and confidential files
We don't enter our clients' personal data, customer lists, contracts, unreleased product information or system access credentials into public AI tools. Instead, if we need help with a piece of code, we use sample (dummy) data instead of real data.
The final quality check
A person is responsible for the check before a design goes to print. The same applies to the test before a site goes live and the final review of a software release. AI can help with part of that check, but it doesn't make the "OK, we can send it" decision. We're the ones accountable when something goes wrong, so we're the ones who make the call.
Data privacy and the PDPL: our principles
Turkey's Personal Data Protection Law (PDPL, Law No. 6698) sets clear rules for processing personal data. The purposes must be specific, explicit and legitimate, and the processing must be relevant, limited and proportionate to those purposes. Article 12 of the law covers cases where another person processes data on the data controller's behalf. In that case, the data controller is jointly responsible with that person for security measures.
AI tools and transfers abroad
Typing personal data into an AI tool can mean transferring that data to a third party. Moreover, many tools have their servers abroad. Article 9 of the PDPL, which governs transfers abroad, changed in 2024 and introduced new safeguards such as standard contracts. These rules mean that using an AI tool with personal data is no longer as simple as "typing into a chat window."
The Personal Data Protection Authority (KVKK) has also published guidance on this. In November 2025, it released the "Guide on Generative AI and the Protection of Personal Data (in 15 Questions)." Then, in March 2026, it published a document on the use of generative AI tools in the workplace. The Authority points out that employees often use these tools based on their individual choices, without a company policy. In its view, this makes oversight difficult.
Our data privacy principles
Our principles build on this:
- No personal data: We don't enter personal data or confidential client information into public AI tools.
- We read the terms: We check the data retention and training-use terms of the tools we use. For example, some providers state that by default they don't use data entered into their enterprise products for model training. However, terms may differ for individual accounts.
- We share only what's needed: We don't give a tool more information than is needed to ask the question.
- Human approval: No output produced by AI goes to a client or gets published without a review.
We've also explained PDPL-compliant design principles for software in our article on PDPL-compliant software development.
Our experience
We apply these principles not only in client projects but also when developing our own products.
AquaCRM is a subscription-based service management platform we developed for water treatment service companies. Subscribing companies manage customer and device records, service history, filter replacement reminders and WhatsApp/SMS notifications on the platform. Each subscribing company works in its own isolated data space. This structure means the platform holds personal data: end customers' names, addresses and phone numbers. That's why we never give real subscriber data to coding assistants during development; we work with sample data instead. We may get a draft from AI for texts such as notification templates. Even so, a template goes into the system only after we review it.
The Label Job Tracking Assistant is our product, currently in pilot use, that tracks jobs from quote to invoice for roll label manufacturers. Its flows include quoting, print approval, production queues and the dispatch note (irsaliye) integration with Paraşüt, a Turkish accounting platform. In these flows, a mistake can go straight through to production and invoicing. In integrations like these, we use a solution suggested by AI only after we've tested and understood it.
Grafik Sanat is our free education platform. For an education platform, accurate information in the term explanations and quizzes is a basic requirement. For this reason, we treat AI only as an assistant when it comes to content.
Frequently asked questions
Can I find out whether AI was used in my project?
Yes. You can ask at which step and for what purpose we got help from AI; we'll tell you openly. If there's a step in your project where you don't want it used at all, we can discuss that from the start.
Are the files and information I send uploaded to an AI tool?
No. We don't give clients' personal data, confidential files or access credentials to public AI tools. If we need tool support on something, we use sample data instead of real data.
Does your use of AI lower the price of the work?
It speeds up some steps. However, the most time-consuming parts of the work still require human effort: making decisions, producing original design, testing and checking. We prefer to spend the time we save on evaluating more options and on more thorough testing.
Who owns the rights to the delivered design?
The project contract sets out the scope of the rights, so we recommend discussing it openly at the start of the work. In fact, this is one of the reasons we don't use AI output in the final mark: we don't want the rights status of the work we deliver to remain unclear.
Conclusion
AI is a powerful tool that speeds up our work; we don't reject it. But we believe that saying openly how we use AI, and where we don't, is part of trust. Final design, client data and the final check remain our responsibility.
If you'd like to talk through our process in the context of one of your projects, take a look at our services or get in touch with us. If you're curious where you could use AI in your own business, our article on AI for business is a good place to start.
This article is for general information only and is not legal advice.
Sources9
- Law No. 6698 on the Protection of Personal Data (Arts. 4, 9, 12), Turkey's Legislation Information System (Mevzuat Bilgi Sistemi) mevzuat.gov.tr
- Personal Data Protection Authority (KVKK), "Standart Sözleşmeler ve Bağlayıcı Şirket Kurallarına İlişkin Dokümanlar Hakkında Kamuoyu Duyurusu" [Public announcement on documents for standard contracts and binding corporate rules] (amendment of Art. 9 by Law No. 7499) kvkk.gov.tr
- Personal Data Protection Authority (KVKK), "Üretken Yapay Zekâ ve Kişisel Verilerin Korunması Rehberi (15 Soruda)" [Guide on Generative AI and the Protection of Personal Data (in 15 Questions)], 24 November 2025 kvkk.gov.tr
- Personal Data Protection Authority (KVKK), "İş Yerlerinde Üretken Yapay Zekâ Araçlarının Kullanımı" [The Use of Generative AI Tools in the Workplace], 5 March 2026 kvkk.gov.tr
- Google Search Central, "Using generative AI content on your website" developers.google.com
- Google Search Central, "Creating helpful, reliable, people-first content" (Who, How, Why) developers.google.com
- Pearce et al., "Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributions", arXiv:2108.09293 (IEEE S&P 2022) arxiv.org
- U.S. Copyright Office NewsNet, Copyright and AI Part 2 (Copyrightability) copyright.gov
- Anthropic Privacy Center, "Is my data used for model training?" (default for enterprise products) privacy.claude.com



