Privacy Policy

1. Who we are and how to reach us

VARANTECH ENERJİ SAN. TİC. LTD. ŞTİ. ("Quote3D", "we", "us") operates the Quote3D service at quote3d.com. We are established in Ankara, Türkiye.

We have not appointed a data protection officer. We are not required to appoint one, because we do not carry out large-scale monitoring of individuals and we do not process special categories of data on a large scale as our core activity.

Representative in the European Union (GDPR Article 27): «EU REPRESENTATIVE — to be completed before publication». Representative in the United Kingdom (UK GDPR Article 27): «UK REPRESENTATIVE — to be completed before publication».

Until those entries are completed, individuals in the European Union and the United Kingdom should contact us directly at [email protected], and we will respond within the statutory deadlines set out in section 11.

• Postal address: Fevzi Çakmak Mah. Orhan Gazi Cad. No:92/A, Sincan, Ankara, Türkiye
• Email for all privacy matters, including requests and complaints: [email protected]

2. When we decide, and when your supplier decides

There are two different situations, and your rights route differently in each.

We are the controller when you deal with us directly: you visit quote3d.com, create an account, upload a model, request a quote, subscribe, use the API with your own credentials, or contact support. This policy covers that processing.

We are a processor when you reach us through someone else's website. Our customers embed a Quote3D widget on their own sites. If you uploaded a file to get a quote from a print shop, that print shop is the controller and decides why your data is processed; we act on their instructions. In that case, exercise your rights with them. If you contact us instead, we will not answer on the merits, because it is not our data to speak about — we will tell you to contact them and we will let them know you asked. The terms governing that relationship are in our Data Processing Agreement.

3. What we collect, and where it comes from

Most of this comes from you directly. Where it does not, the source is named.

We do not ask for special categories of data under Article 9 GDPR, and the service is not designed to receive them. Be aware that an anatomical, dental or prosthetic model can carry health information. If that is your use case, contact us before you upload, so we can agree the right terms.

4. Why we process it, and on what legal basis

A legal basis is stated per purpose, not as a general list. Where we rely on legitimate interests, the specific interest is named and we have weighed it against your rights.

We do not use your personal data, your uploaded files or your geometry to train machine-learning models. We do not sell personal data. We do not use uploaded content for advertising.

5. Is providing data required?

Article 13(2)(e) requires us to be clear about this.

• An email address is a contractual requirement: without it we cannot create an account, authenticate you, or send you the quote. If you do not provide it, we cannot provide the service.
• A model file is necessary to perform the contract for quoting. Without the file there is nothing to analyse, so no quote can be produced.
• Billing details are a contractual and statutory requirement for paid plans. Without them a subscription cannot be established or invoiced.
• Analytics and advertising cookies are entirely optional. Refusing them costs you nothing: the service works identically.
• Technical and security data is collected automatically as part of serving a request over the internet and cannot be switched off while using the service.

6. Who receives your data

These are categories and named recipients, not a vague reference to "trusted partners". The full sub-processor list, with the data each one receives and where it is processed, is published at /legal/subprocessors.

Each of these is bound by a contract that limits what it may do with the data. We do not disclose personal data to anyone else.

• Lemon Squeezy — merchant of record for paid plans: checkout, payment, tax and VAT determination, invoicing, renewals. Receives your name, email, billing country and billing details.
• Google — powers the AI live-support assistant through the Gemini API. Receives the full text of the messages you type into it and the replies. It does not receive your uploaded files, your geometry, your credentials or your billing data.
• Google — reCAPTCHA for bot protection, which is necessary and loads without separate consent; Tag Manager and analytics, which load only if you accept analytics cookies; AdSense, which loads only if you accept marketing cookies; and federated sign-in, if you choose it.
• Meta — federated sign-in, only if you choose it.
• Our email delivery provider — transactional messages such as sign-in links, verification, password reset and billing notices.
• Our hosting, database and cache providers — they hold all stored data, with uploaded files held in encrypted form.
• Courts, regulators and other competent authorities, where we are legally required to disclose.
• A purchaser or successor, if the business is sold or reorganised. We would tell you before your data moved to a different controller.

7. International transfers

We are established in Türkiye, and the servers that run the service, hold the database and store your files are located in Türkiye, operated for us by VG Telekomünikasyon Tic. Ltd. Şti. Your uploaded files therefore do not leave Türkiye. Some of our other providers — payment, the AI assistant, bot protection and, where you consent to them, analytics and advertising — process data in the United States and the European Union.

Unless and until the European Commission adopts one, there is no adequacy decision for Türkiye. Where we transfer personal data from the European Economic Area or the United Kingdom onward to a provider outside them, we rely on the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, and on the International Data Transfer Addendum for the United Kingdom. You can obtain a copy of the clauses we rely on, and of the supporting transfer assessment, by writing to [email protected].

One point is commonly stated incorrectly, so we state it correctly: when you are in the European Economic Area and you send us your own data yourself — by signing up, uploading a file or writing to support — that is not a restricted transfer under Chapter V GDPR, because you are not a data exporter. What Chapter V covers is the flow from our business customers to us, and our onward flows to the providers named in section 6. Those are the transfers the clauses above protect.

Where Turkish law applies, we rely on the mechanisms available under Article 9 of Law No. 6698 and complete any filing the applicable regulation requires within its deadline.

8. How long we keep it

Concrete periods, as Article 13(2)(a) requires. These are enforced by a scheduled cleanup job, not merely intended.

Where a record is subject to more than one period, the longer applies, and only for the purpose that justifies it.

• Uploaded files that produced no quote: deleted 24 hours after upload. This is an operator setting; if it is changed, this policy is changed with it, and you can ask us what it is set to today.
• Uploaded files that produced a quote: deleted 365 days after they were last used. Requesting a new quote from a file resets that clock. The operator can shorten this period in the admin settings; if it is changed, this policy is changed with it.
• Quote records, meaning the price, the parameters and the derived measurements without the file: retained while your account is open, so that your quote history remains available to you.
• Derived geometry analysis results: stored in a shared cache keyed by the content hash of the file, so an identical file need not be recomputed. These hold measurements, not file content, and the link to your account is removed when the file is deleted.
• Audit logs, API usage logs and system logs: 90 days. The IP address and user agent recorded with a quote are cleared after the same period; the quote record itself stays, only those two fields are emptied. This is an operator setting; if it is changed, this policy is changed with it, and you can ask us what it is set to today.
• Password reset and email verification tokens: 7 days. Used upload sessions: 24 hours.
• Account data: retained while your account is open. You can delete the account yourself from your dashboard settings, and it happens immediately rather than within 30 days. Before you confirm, that screen lists every record that survives deletion and the legal reason for each one.
• Consent records, including the copy of the text you accepted: retained for 3 years after the subscription ends, because that is our evidence of what was agreed. This is also required of us under United States automatic-renewal law.
• Invoicing, accounting and tax records: retained for the period the applicable tax law requires, which outlives the account.
• Encrypted backups: overwritten on their rotation cycle and deleted no later than 35 days after the data was deleted from the live system. Until then they are used only for disaster recovery.

9. How we protect it

We describe our measures precisely rather than broadly, because an overstated security claim is itself a legal exposure and because we are bound by what we publish here.

The limit of that protection, stated plainly: encryption at rest protects the storage medium. It is not end-to-end encryption. The service has to decrypt a model in order to analyse it, so we are technically able to access file content, and you should not assume otherwise.

No system is absolutely secure. If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will tell you without undue delay, and we will notify the competent authorities within the deadlines that apply to us.

• Uploaded files are encrypted at rest with AES-256-GCM, using a key derived for each individual file through HKDF-SHA256 from a master key and a random per-file salt.
• The stored file format carries a key identifier, so master keys can be rotated and retired without rewriting existing files.
• Files are stored in authenticated 256 KB frames. Each frame carries its own authentication tag, and each frame's nonce and additional authenticated data bind it to its position and to end-of-file, so frames cannot be reordered, dropped, or the stream truncated without detection.
• Traffic to and from our public interfaces is protected with TLS.
• Access to production data is role-based and granted on a need-to-know basis; files are isolated per account with restrictive filesystem permissions; API tokens are scoped and rate-limited; repeated failed sign-ins lock the account.
• Backups are encrypted. Service availability is monitored. Retention is enforced by scheduled jobs rather than by good intentions.
• Changes are covered by an automated test suite, including regression gates that check consent enforcement and the content of these legal documents.

10. Automated processing

A quote is produced automatically: the engine slices your model and computes a price without a human reviewing it. We have taken a position on what that means legally rather than leaving it unaddressed.

In our assessment, an automated price quote for a printing job is not a decision that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22(1) GDPR. It is a price estimate you are free to accept, reject or obtain elsewhere, and nothing about your rights or status changes as a result of it.

We therefore do not treat quoting as Article 22 automated decision-making. If you disagree in your particular case, write to us: you may ask for the basis of a quote to be explained and reviewed by a person. Under Turkish law, Article 11(1)(g) of Law No. 6698 gives you an express right to object to a result produced solely by automated analysis where it works against you, and we will honour that.

11. Your rights

Subject to the law that applies to you, you have the following rights. You exercise all of them the same way: email [email protected] from the address on your account, or tell us enough for us to find your records.

Where Türkiye's Law No. 6698 applies, Article 11 additionally gives you the right to learn whether your data has been transferred domestically or abroad and to whom, to request that third parties be notified of a correction or deletion, and to claim compensation for damage arising from unlawful processing.

We do not charge for these requests. We acknowledge a request within 5 business days and answer within 30 days. Where a request is complex we may extend that, and we will tell you why before the original deadline passes. We will ask you to verify your identity, and no more than that.

If you are unhappy with how we handled a request, tell us. We acknowledge complaints within 30 days and tell you what we intend to do about them.

• Access — obtain confirmation of whether we process your data, a copy of it, and the information in this policy as it applies to you.
• Rectification — have inaccurate data corrected and incomplete data completed.
• Erasure — have your data deleted where the legal conditions are met. You do not have to ask: dashboard settings has a delete button that erases the account immediately. It names, before you confirm, every record a legal obligation makes us keep and why.
• Restriction — have processing limited while a dispute about accuracy or lawfulness is resolved.
• Objection — object to processing based on our legitimate interests, on grounds relating to your particular situation. We will stop unless we can show compelling legitimate grounds that override your interests.
• Portability — receive the data you provided to us in a structured, commonly used, machine-readable format, and have it sent to another controller where technically feasible. Dashboard settings has a download button that produces this as a single JSON file. Your API secrets are deliberately left out of it.
• Withdraw consent — at any time, for anything we do on the basis of consent, without affecting the lawfulness of processing before the withdrawal. Cookie consent is withdrawn through the cookie banner; the assistant's consent and marketing email are withdrawn by writing to us.
• Complain to a supervisory authority — in the European Economic Area, the authority in your country of residence, work, or the place of the alleged infringement; in the United Kingdom, the Information Commissioner's Office; in Türkiye, the Personal Data Protection Authority (KVKK). You do not have to complain to us first.

12. Cookies, Do Not Track and Global Privacy Control

We use four categories of cookie: necessary, analytics, marketing and functional. Everything except necessary is switched off by default and loads only after you accept it through our cookie banner. Our Cookie Policy describes each category.

Do Not Track: our service does not respond differently to a Do Not Track browser signal. There is no agreed industry standard for how a site should react to it, and we would rather tell you plainly than imply a protection we do not provide.

Global Privacy Control: we do honour a Global Privacy Control signal. When your browser sends one, we treat it as a refusal of analytics and marketing cookies, and those technologies are not loaded. The signal takes precedence over an earlier acceptance in our banner, because an opt-out that a previous click could override would not be an opt-out. If you want analytics or advertising enabled, turn the signal off in your browser.

Other parties collecting data across sites: if — and only if — you accept analytics or marketing cookies, Google may collect information about your activity on this site and combine it with information from other sites over time, in its role as an analytics and advertising provider. If you refuse those categories, that collection does not happen here. Necessary technologies, including reCAPTCHA, operate regardless, but they are used for security rather than for building a profile of you.

13. California

This section is provided for residents of California. We do not currently meet the thresholds that make a business subject to the California Consumer Privacy Act, but we publish this disclosure because the California Online Privacy Protection Act applies regardless of our size, and because we would rather you could check.

You may request access to, deletion of and correction of your personal information, and you will not be treated differently for asking. Use the contact route in section 11.

When we act as a service provider to one of our business customers, we handle their consumers' information only under their instructions and under the contract terms set out in our Data Processing Agreement.

• Categories of personal information collected in the last 12 months: identifiers (name, email, account identifier, IP address); commercial information (subscription, plan and transaction records); internet activity (pages visited, interaction with the service); geolocation inferred only at country level from your IP address for tax and language purposes; and the content you submit, meaning your files and your messages to support.
• Sources: you, your browser, our payment provider, and the identity provider you choose to sign in with.
• Business purposes: those set out in section 4.
• Categories of third parties we disclose to: those named in section 6.
• We do not sell personal information, and we have not sold it in the preceding 12 months.
• Sharing for cross-context behavioral advertising: our advertising technologies load only where you have accepted marketing cookies. Where you accept them, the resulting advertising may amount to "sharing" under California law. Refusing marketing cookies, or sending a Global Privacy Control signal, stops it.
• We do not knowingly collect personal information from anyone under 18, so we do not sell or share the personal information of minors.
• Retention: as set out in section 8.

14. Age

The service is intended for people aged 18 or over. You must be 18 to create an account, and paid plans require the capacity to enter a contract.

We do not knowingly collect personal data from anyone under 18. If you believe a minor has given us personal data, write to [email protected] and we will delete it. If you are a parent or guardian and want to check, contact us and we will help.

15. Changes to this policy

The effective date at the top of this page is the date the current wording took effect. It changes only when the wording changes, so you can rely on it.

Where we make a material change — one that affects what we collect, why, who receives it, how long we keep it, or your rights — we will tell account holders by email at least 30 days before it takes effect, and we will say what changed. Where a change requires your consent, we will ask for it rather than assume it.

Earlier versions are available on request.