Türkçe · English
Privacy and Personal Data Protection
This notice is prepared to fulfil the obligation to inform under Turkish Personal Data Protection Law No. 6698 (KVKK) and to explain which data is processed on Easy3dPaint (the “Site”) and how.
1. Data controller
Hatice Beşikçi Sürmeli (sole proprietorship; brand: Easy3dPaint)
Mimar Sinan Mahallesi, 117. Sokak, No: 4/10, Atakum / Samsun, Türkiye
Phone: +90 542 224 95 83 · Email: vita.serene@outlook.com
Tax office / number: Gaziler Vergi Dairesi / 1660574509 · MERSIS no: 3153-7598-7080-0000
For all requests about personal data: vita.serene@outlook.com.
2. Your model files (STL / 3MF / images)
The model files you upload and the images you choose for keychains are processed only in your browser. They are not sent to our servers, not stored and cannot be seen by us. The files you export are also created in your browser.
3. Information stored on your device
So that you can continue where you left off, painting information is stored in your browser's local storage (IndexedDB); small settings such as your language preference are also kept in local storage. When you sign in, session keys are stored in your browser's local storage (localStorage) to remember your session. This information does not leave your device; you can delete it by signing out or clearing your browser's site data. No advertising or tracking cookies are used.
4. Account and subscription
When you sign up, only the following is stored on our server (Supabase database):
- your email address and an irreversible hash of your password (the password itself is not stored),
- account creation, email verification and trial end dates,
- subscription information: plan, status, period start/end dates, cancellation information and the subscription/customer numbers issued by Paddle,
- download records: download type (3MF, STL…) and time (to prevent abuse and account sharing),
- for the “My projects” list, only the project name, file name, triangle and object counts and the color codes used (not the model file itself),
- a record of payment notifications from Paddle: event type, time and numbers (no name, address or card details).
Verification and password reset emails are sent via Resend, Inc.
5. Payment (Paddle)
Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders: it takes the payment, issues the invoice, calculates and pays taxes (VAT etc.) and handles refund requests. The name, email, country/postal code, billing details and card details you enter at checkout are sent directly to Paddle and are processed by Paddle, as an independent data controller, under its own privacy policy: paddle.com/legal/privacy. We never see or store your card details. Paddle shares your email address and subscription status with us so that we can manage your subscription.
6. Technical logs
To prevent abuse, when limiting the number of requests your IP address is kept irreversibly hashed for at most 48 hours. The Site is hosted on Cloudflare, Inc. infrastructure; Cloudflare may keep connection logs to provide the service and maintain security: cloudflare.com/privacypolicy.
7. Artificial intelligence and voice commands
The AI selection and voice command features are currently disabled in the interface. The “Keychain from image” tool does not use AI and processes the image on your device. If these features are enabled in the future, this notice will be updated beforehand.
8. Purposes, legal grounds and retention periods
| Data | Purpose | Legal ground (KVKK Art. 5) | Retention |
|---|---|---|---|
| Email, password hash, trial dates | Creating the account and providing the service | Conclusion/performance of a contract (Art. 5/2-c) | Until the account is deleted |
| Subscription information and Paddle numbers | Providing the purchased service, cancellations and refunds | Performance of a contract (Art. 5/2-c), legal obligation (Art. 5/2-ç) | Until the account is deleted; accounting records for the legal period (up to 10 years) |
| Download records | Access control, preventing abuse | Legitimate interest (Art. 5/2-f) | Until the account is deleted |
| Project information (name, counts, colors) | Showing the “My projects” list | Performance of a contract (Art. 5/2-c) | Until you delete it or the account is deleted |
| Hashed IP address | Rate limiting, preventing abuse | Legitimate interest (Art. 5/2-f) | At most 48 hours |
| Payment and billing information | Taking payment and invoicing | By Paddle (independent data controller) | Under Paddle's policy; not stored by us |
9. Recipients and transfers abroad
Data is shared only with the service providers needed to provide the service: Supabase, Inc. (database and authentication; servers in the European Union, Frankfurt), Cloudflare, Inc. (hosting), Resend, Inc. (email delivery) and Paddle (payment, Merchant of Record). Where necessary it may be shared with professional advisers such as an accountant and with legally authorised authorities. As these providers are located abroad, data may be transferred abroad; such transfers are made under one of the methods provided in KVKK Art. 9 (e.g. standard contractual clauses).
10. Security
Your data is transmitted over an encrypted connection (HTTPS); in the database each user can access only their own records; only the server can write payment and subscription records. Secret keys are never sent to the browser.
11. Your rights
Under KVKK Art. 11 you have the right to learn whether your personal data is processed, to request information, to learn whether it is used for its intended purpose, to know the third parties to whom it is transferred, to request correction if it is incomplete or incorrect, to request its deletion or destruction, to object, and to claim compensation for damages. You can send your requests to vita.serene@outlook.com; they will be answered within 30 days at the latest. You can also delete your account with the “Delete account” button in the app.