Privacy Policy

This Privacy Policy explains how Kemal Yaşayan ("Buya3DPrint", "we"), acting as Kemal Yaşayan, processes personal data, informed by GDPR principles for EU/EEA users and Turkey's KVKK (Law No. 6698) as the primary framework for this platform's initial market.

Product decisionThis document describes what Buya3DPrint actually does, including the data inventory below — a privacy policy existing is not itself proof of GDPR/KVKK compliance; this one reflects real, code-audited behavior.

1. Data inventory

• Account data (email, hashed password, name/avatar from Google sign-in) — for account creation and authentication, kept for the life of the account.
• Profile data (username, bio, location, company, social links) — optional, user-entered, publicly displayed.
• Address data (saved addresses: name, phone, address, city, postal code, tax number) — for shipping physical orders.
• Order/purchase data (item purchased, amount, shipping/billing address) — for contract performance and accounting/tax obligations; retained indefinitely as a financial record even after account deletion.
• Custom manufacturing request data (name, email, phone, address) — for the quoting process; retained as a financial record once a request becomes a real order.
• Print Partner data (company name, tax ID, VAT number, contact info) — for partner application and verification.
• Download logs (IP address, browser info, timestamp) — for license/download-right tracking and abuse detection.
• Payment provider data (transaction ID, payment status — not card numbers) — webhook data from PayTR, the current active payment provider; iyzico and Stripe are registered but not currently active, retained as a financial record.
• Error/security logs — technical identifiers and error messages only; passwords, card data, or full payment payloads are never logged.
• Cookies/local storage — session token only (localStorage, not a cookie); no third-party tracking/analytics is used (see below).

2. Legal basis

Account and order data are processed for contract performance; financial records for legal obligation; optional profile fields on the basis of consent.

3. Who sees your data

A model's Creator can see download/view data for that model. A Print Partner sees only the customer name/city/address needed for a job they've won — never email or phone, and no customer identity at all before winning. Admin staff can access relevant data for moderation and support purposes.

4. International transfers

Legal requirementTurkey's KVKK Article 9 was substantially overhauled in 2024 (Law No. 7499) into a three-tier order: (1) an adequacy decision for the recipient country/ sector/organization, if the Board has issued one; (2) failing that, an appropriate-safeguard mechanism the Board has published (in particular, the Board's own standard contract, filed with the Board within 5 business days of signing); (3) failing both, one of the law's narrow exceptions for specific/occasional transfers (e.g. explicit consent). The subprocessors/infrastructure providers actually used in this codebase are: Supabase (database and storage — hosted in Frankfurt, Germany, region eu-central-1), PayTR (current active payment provider, Turkey-based — this stays a domestic transfer, not an international one), Resend (email delivery), Cloudflare (CDN/DDoS protection, request routing), and Google (only for users who choose "Sign in with Google" — email address and profile name are received FROM Google once OAuth sign-in completes; this item is data flowing from Google to this app, not data sent to Google). iyzico and Stripe are retained in the platform's infrastructure but are not currently processing data. Our domain (buya3dprint.com) is managed through GoDaddy — GoDaddy only provides domain name/DNS registration and is not a personal-data subprocessor. No adequacy decision currently covers Supabase, Resend, Cloudflare, or Google, so the applicable mechanism for these four is the Board's published standard contract (Module 2 — Controller to Processor), executed separately with each and filed with the Board within 5 business days of signing — a concrete operational step for the data controller to complete (see docs/OPERATIONS.md and docs/PRODUCTION_CHECKLIST.md), not an unresolved legal question awaiting counsel's opinion — the applicable mechanism under current law is clear; carrying it out is a production task.

5. Cookies and tracking

Legal requirementAs of this document's publication, Buya3DPrint uses no third-party analytics, advertising, or tracking technology (verified by a full codebase audit — no Google Analytics, Meta Pixel, Hotjar, or similar is integrated anywhere). Session persistence uses the browser's local storage, not a cookie, and is strictly necessary/functional. If this changes (e.g. analytics is added later), this section will be updated and a consent mechanism added if required.

6. Data retention and account deletion

You can permanently delete your account from Settings → Security. This:

• Deletes: saved addresses, notifications, wishlist, follows, likes, draft models, collections.
• Anonymizes: your profile (username becomes "deleted-user-...", bio/avatar/social links are cleared).
• Cancels (not deleted): active memberships/entitlements — future access ends, historical record remains.
• Retained indefinitely (financial record): purchases, orders, royalty/payout records, completed manufacturing requests' customer info.
• Known gaps (found in this sprint's audit, disclosed rather than hidden): download-log rows you generated on another Creator's model are not deleted by account deletion; verification information submitted during partner onboarding (if any) isn't part of the account-deletion flow; raw webhook data from payment providers (admin-readable only) is retained.

7. Your rights

You have the right to know whether your data is processed, request information, correction, deletion, and to object, under KVKK Art. 11 and (for EU/EEA users) GDPR Arts. 15-22. Send requests to support@buya3dprint.com.

8. Contact

Kemal Yaşayan — Yenidoğan Mah. Uluyol Cad. Muhtaharbey Sanayi Sitesi No: 20-22 İç Kapı No: 41 Bayrampaşa / İstanbul
Data protection contact: support@buya3dprint.com