Privacy Policy

The data controller is Santral Mimarlık Mob. Tas. İnş. Tic. Ltd. Şti., İstasyon Mah. Hatboyu Cad. No: 99, Tuzla, İstanbul, Türkiye (tax office Tuzla, tax ID 7440465399). You can reach us at info@3dstock.org, by phone at +90 216 325 84 46 or through the contact form.

• Account data: username, e-mail address, password (stored only in hashed form by our authentication provider), profile details and avatar, and sign-in data if you use Google (or another social) login.
• Purchase data: orders, receipts, the agreements you accepted (with time, IP address and document version), credit balance and history, memberships and download history. Card details are entered on iyzico's secure form; we receive only the payment result and references, never your card number.
• Membership billing details: to set up the automatic renewal we send your name, billing address, mobile number and e-mail address to iyzico, which stores your card for the renewals. We keep your billing details to pre-fill them next time.
• Seller data: shop details, products you upload, sales and earnings, and the payout details you provide (Payoneer e-mail address or bank details for international transfers).
• Content you upload or send: model files, images, scenes for the render service, photos and text prompts for AI 3D Studio, photos for AI visual search, reviews, messages, support requests, copyright reports and malware reports (with your account ID and the text you write).
• Security and technical data: IP address, browser type, device and log data, rate-limit counters and the results of the automatic security checks of uploaded files, needed to run and protect the service.

• To provide the marketplace — accounts, purchases, downloads, credits, memberships and their renewals, seller earnings and payouts, AI features and customer support — because it is necessary to perform our contract with you.
• To keep records, issue receipts and invoices, and meet tax, accounting, consumer-protection and other legal obligations.
• To keep the platform secure: preventing fraud and abuse, enforcing download limits, checking uploaded files for malware and handling copyright and malware reports — based on our legitimate interest and legal obligations, and to establish, exercise or defend legal claims.
• To send service e-mails about your account, purchases and sales. Newsletters and other marketing messages are sent only with your consent; you can unsubscribe at any time with the link in every newsletter.
• We do not sell your personal data and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The automatic file checks only decide whether an uploaded file can be published; our team reviews held files on request.

We share personal data only with the service providers that help us run 3DStock, under contract and only as far as needed:

• iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş., Türkiye) — card payments, fraud checks and, for Gold memberships, the recurring charges.
• Google (Firebase / Google Cloud) — hosting of the website and the database in the European Union (Netherlands), sign-in (Firebase Authentication) and, for AI visual search, the Gemini API. Some of these services may process data in the United States.
• Amazon Web Services (United States, us-east-1) — storage of images and downloadable files, and automatic malware scanning of uploaded files.
• Meshy (United States) — only the photos and text prompts you submit to AI 3D Studio, to create your model.
• Resend (United States) — delivery of the e-mails the site sends (receipts, notifications, newsletters).
• Our e-mail hosting provider — messages you send to our support address.
• Payoneer and banks — the payout details of sellers, to pay their earnings.
• Creators (sellers) — when you get a licence for a model, its creator can see the sale and your public username, never your payment details or e-mail address.
• Courts and public authorities, when the law requires it or to protect rights and safety.

Some of these providers process data outside Türkiye and outside your country (mainly in the European Union and the United States). Such transfers are made in line with Article 9 of the Turkish Personal Data Protection Law No. 6698 (for example on the basis of the standard contracts announced by the Personal Data Protection Board) and, where it applies, the safeguards required by the GDPR (such as standard contractual clauses).

We use only what is strictly necessary to run the site: a session cookie to keep you signed in and your browser's storage to remember your cart and sign-in state. We do not use advertising, analytics or tracking cookies, so no consent is needed for them. If we add analytics or marketing cookies in the future we will ask for your consent first and list them here.

When you pay by card you enter your card on iyzico's secure payment form (on iyzico's page or embedded from iyzico on our secure payment page), which sets its own cookies under iyzico's privacy policy. You can delete cookies and site data at any time in your browser settings; you will then be signed out and your cart emptied.

• Account and profile data: while your account is open. When you delete your account, your profile is deleted or anonymised; records we must keep by law stay, without your profile details.
• Orders, payments, receipts, accepted agreements and payout records: 10 years, as Turkish commercial and tax law requires.
• Server and access logs: for the period required by Law No. 5651 (at least one and at most two years), then deleted.
• Support messages, copyright reports and malware reports: until the case is closed, and afterwards only as long as needed to defend legal claims.
• Newsletter: until you unsubscribe; the record of your consent and of your unsubscribing is kept for 3 years, as the rules on commercial electronic messages require.
• Short-lived technical records (rate-limit counters, AI visual-search thumbnails, one-time payment tokens) are deleted automatically, usually within days.
• Uploaded model files stay while the model is listed; files of models that were sold are kept as proof of what buyers received.

You can ask to access, correct, delete or export your personal data, object to or restrict certain processing, and withdraw any consent you gave — under the Turkish KVKK (Article 11, see the Turkish notice below) and, if you live in the EU or the UK, under the GDPR. Most profile data can be edited in Account → Settings, and you can delete your account yourself under Account → Settings → Delete Account. Sellers must first withdraw any remaining earnings.

Send any other request to info@3dstock.org from the e-mail address registered in your account. We answer within 30 days, free of charge. You also have the right to complain to the Turkish Personal Data Protection Board (KVKK) or to your local data protection authority.

We protect data with encryption in transit, access controls, short-lived download links for paid files and automatic checks of uploaded files. No system is perfectly secure, so please use a strong, unique password and tell us about any suspected problem.

3DStock is not directed at children, and accounts are for people aged 18 or over. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy. The date at the top shows the latest version; important changes will be announced on the site or by e-mail.