3D-AR Studio

Privacy Policy

BASE BROS Bilişim Hizmetleri A.Ş. (the "Company", "we", "us", or "our"), a company incorporated under the laws of the Republic of Turkey (MERSİS No. 0892078506200001) with its registered office at Sanayi Mahallesi, Teknopark Bulvarı, No:1/4C Blok, Kat:3, İç Kapı No:307, 34906 Pendik / İstanbul, Türkiye and its headquarters at Girne Mah. Girne Cd. No: 125/2, 34852 Maltepe / İstanbul, Türkiye, operates BASE 3D-AR Studio (the "Studio" or "Service").

This Privacy Policy describes how we collect, use, disclose, retain, and protect your personal data when you access or use the Studio. This Policy applies to all users of the Studio, including visitors, registered users, and subscribers.

We are committed to safeguarding your privacy and processing your personal data in compliance with applicable data protection laws, including but not limited to the Turkish Personal Data Protection Law No. 6698 ("KVKK"), the European Union General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act ("CCPA"), and other applicable international data protection legislation.

By using the Studio, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this Policy, you must discontinue use of the Studio.

1. Data Controller

For the purposes of applicable data protection legislation, the data controller is:

BASE BROS Bilişim Hizmetleri A.Ş.
Registered office: Sanayi Mahallesi, Teknopark Bulvarı, No:1/4C Blok, Kat:3, İç Kapı No:307, 34906 Pendik / İstanbul, Türkiye (Teknopark Istanbul)
Headquarters: Girne Mah. Girne Cd. No: 125/2, 34852 Maltepe / İstanbul, Türkiye
MERSİS No: 0892078506200001
KEP (registered electronic mail): basebrosbilisim@hs01.kep.tr
Email: info@basebros.com
Web: basebros.com

2. Categories of Personal Data We Collect

We collect and process the following categories of personal data:

2.1 Information You Provide Directly

• Account Registration Data: Full name, email address, username, and password (stored exclusively as a cryptographic hash; we never store plaintext passwords).
• Profile Information: Profile picture, display name, company name, and other optional details you choose to provide.
• Authentication via Third Parties: If you sign in using Google OAuth, we receive your name, email address, and profile picture from Google. We do not receive or store your Google password.
• Payment Information: When you subscribe to a paid plan, payment processing is handled by our third-party payment processors. We do not directly store full credit card numbers or complete payment credentials on our servers.
• Communications: Content of emails, support requests, or feedback you send to us.
• Job Applications: If you apply through our careers page, your name, email address, the position you apply for, your LinkedIn profile link, and your message.

2.2 User-Generated Content

• 3D model files (.glb, .gltf, and related formats)
• Textures, images, and material configurations
• Scene and page configurations
• Project metadata and settings
• AI-generated 3D content created through Studio tools

2.3 Automatically Collected Data

• Device & Browser Information: Browser type and version, operating system, device type, screen resolution, and preferred language.
• Network Data: IP address, approximate geographic location (city/country level, derived from IP), and internet service provider.
• Usage Data: Pages and features accessed, actions performed, timestamps of interactions, session duration, referral URLs, and navigation paths within the Studio.
• Performance Data: Page load times, errors encountered, and technical performance metrics.

2.4 Cookies and Similar Technologies

We use cookies and similar technologies, such as your browser's local storage, in three categories. Essential cookies are always on. Analytics and Marketing stay off until you allow them: when you first visit basebros.com or open the Studio, a cookie banner lets you choose Accept all, Reject all or Customize (one switch per category, all off until you turn them on). Until you choose, no analytics or advertising script is loaded on basebros.com or in the Studio, no measurement request is sent to Google, and nothing is measured in your browser there. Published 3D viewer pages work differently; see the last row of the table below and Section 13.

Your choice is stored for 12 months in a first-party cookie named bb_consent on .basebros.com, so the same choice applies on basebros.com and in the Studio. After 12 months, or if you clear your cookies, we ask again. You can change your choice at any time with the Cookie settings link in the footer of basebros.com, or with Cookie settings in the Studio. When you turn Analytics off, tracking in your browser stops right away, and the Mixpanel and Google Analytics cookies and the visit statistics IDs stored in your browser are deleted. When you turn Marketing off, the Google Ads tag stops right away and its cookies on basebros.com are deleted. If you change your choice in the Studio, the Google Analytics and Google Ads cookies on basebros.com are deleted the next time you open a basebros.com page. Account events that the Studio's servers record are not affected by this setting (Section 2.5).

Google Analytics and Google Ads start only with a choice you make on basebros.com, where the banner names them. If you made your choice in the Studio, or before we added these tools, basebros.com shows the cookie banner once more, with both switches off. To tell these apart, your browser's local storage on basebros.com keeps the time of the choice you made there (bb_consent_g, essential).

Published 3D viewer pages (Section 13) set one first-party cookie, bb_sid, holding a random ID for 12 months so that the page owner's statistics can count unique visitors. With each view we also store the visitor's IP address, browser user agent, referring page and approximate location for up to 24 months. You can block or delete cookies in your browser settings; blocking essential cookies may stop sign-in and other Studio features from working.

Some blog articles contain YouTube videos. A video is not loaded with the page: it loads from YouTube (Google LLC, USA) in privacy-enhanced mode (youtube-nocookie.com) only when you press play, and from then on Google's privacy policy applies to it. Our pages also load the Inter and JetBrains Mono fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com); to deliver them, Google receives your IP address and browser details. Google Fonts sets no cookies, and these requests are not used to measure your visit.

2.5 Product Analytics (Mixpanel)

To understand how basebros.com and the Studio are used and to improve them, we use Mixpanel, Inc. (San Francisco, California, USA - mixpanel.com) as a product analytics processor. Our Mixpanel project uses Mixpanel's EU data residency, so this analytics data is stored in the European Union.

• What is collected: pages viewed, clicks and scroll depth, the features you use (for example opening the pricing table, using the 3D viewer, or generating, publishing and downloading models), device, browser and operating system, approximate location (city and country, derived from your IP address), and the referring site and campaign parameters (UTM). In the Studio, these events are linked to your account ID, and your email address, username, plan and capacity are stored on your analytics profile.
• What is never collected: passwords, payment card data, the text of your AI prompts or AI assistant messages, the messages you write in our forms, or the content of your files.
• Your consent comes first: Mixpanel runs in your browser only after you allow Analytics in our cookie banner or in Cookie settings (Section 2.4). Until then the Mixpanel script is not loaded and no Mixpanel cookie is set.
• Cookie: once you allow Analytics, a first-party Mixpanel cookie on .basebros.com holds a random identifier, so that a visit to basebros.com and a later sign-in to the Studio can be linked. Analytics requests are sent through our own domain.
• Session replay (basebros.com only): if you allow Analytics, we record how pages on basebros.com are used (pointer movement, clicks, scrolling and page changes) to find and fix usability problems. Everything typed into fields and the AI assistant conversation are masked, and our contact, support and careers forms are excluded from recordings. The Studio is not recorded.
• Opting out: you can turn Analytics off at any time in Cookie settings; tracking in your browser then stops right away and the Mixpanel cookies are deleted. If your browser sends a Do Not Track signal, Mixpanel analytics in your browser is also turned off. Account events that the Studio's servers record (sign up, plan and payment changes, generation results) do not come from your browser and are not affected by Do Not Track. You can ask us to stop all product analytics for your account, these account events included, or to delete your analytics data, by emailing info@basebros.com.

2.6 Google Analytics and Google Ads (basebros.com only)

On basebros.com, and only there (not in the Studio and not on published 3D viewer pages), we also use Google Analytics 4 and Google Ads, services of Google LLC (Mountain View, California, USA) and its affiliates (policies.google.com).

• Your consent comes first: until you make a choice in our cookie banner, the Google tag is not loaded and no measurement request is sent to Google. Google Analytics runs only if you allow Analytics, and Google Ads only if you allow Marketing; each is switched on separately. A choice made in the Studio, or before we added these tools, does not switch them on: basebros.com asks you once more (Section 2.4). We use Google Consent Mode, with Google's analytics and advertising storage denied by default.
• Google Analytics 4 (Analytics): counts visits and shows how basebros.com is used: pages viewed, scrolling, clicks on links and buttons, file downloads, the features you use (for example the pricing table, the 3D viewer, AR or the AI assistant) and whether a form was sent successfully, together with device, browser and operating system, approximate location (country and city, derived from your IP address), the referring site and campaign parameters (UTM). Google Analytics 4 does not log or store IP addresses. Google signals are turned off, and Analytics data is used for advertising only if you also allow Marketing.
• Google Analytics cookies: _ga (a random visitor ID) and _ga_M57BQY85KH (session state), set on .basebros.com and kept for up to 13 months after your last visit.
• Google Ads (Marketing): measures how our Google ads perform, for example whether a visit that started with a click on one of our ads led to a contact request, and lets us show our ads again to people who visited basebros.com.
• Google Ads cookies: _gcl_au and, when you arrive by clicking one of our Google ads, cookies such as _gcl_aw, _gcl_dc, _gcl_gb or _gcl_gs that hold the ad click information, set on .basebros.com and kept for up to 90 days. When you allow Marketing, Google may also read or set its own cookies on Google domains (for example google.com and doubleclick.net) under Google's own policies.
• What is never sent to Google: your name, email address or phone number, the messages you write in our forms, your AI prompts or AI assistant messages, or the content of your files. The events we send carry only fixed values, such as the type of page, where a button sits on the page or which form was sent.
• Google's role and international transfers: for Google Analytics, Google processes the data on our behalf. For Google Ads measurement, Google may also use the data as an independent controller under its own terms. The data may be processed on Google servers in the United States and other countries; Google LLC is certified under the EU-U.S. Data Privacy Framework (with its UK and Swiss extensions) and also relies on Standard Contractual Clauses. How Google uses this data: policies.google.com/technologies/partner-sites.
• Opting out: you can turn Analytics or Marketing off at any time in Cookie settings; the Google tag then stops right away for that category and the related Google Analytics or Google Ads cookies on basebros.com are deleted (after a change in the Studio, the next time you open basebros.com). Cookies that Google keeps on its own domains are managed by Google: you can control ad personalization in My Ad Center (myadcenter.google.com) and delete these cookies in your browser.

3. Legal Bases for Processing

We process your personal data based on the following legal grounds, as applicable under KVKK, GDPR, and other relevant legislation:

• Performance of a Contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)): Processing necessary to provide the Service, manage your account, and fulfill our contractual obligations to you, or to take steps at your request before entering into a contract, such as reviewing your job application.
• Legitimate Interests (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)): Processing necessary for our legitimate interests, such as improving the Studio, ensuring security, preventing fraud, conducting analytics, and providing publishers with visitor statistics for their published pages, where such interests are not overridden by your fundamental rights and freedoms.
• Consent (KVKK Art. 5/1; GDPR Art. 6(1)(a)): Where we rely on your consent, you have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
• Legal Obligation (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)): Processing necessary to comply with applicable laws, regulations, court orders, or regulatory requirements.

4. Purposes of Processing

We process your personal data for the following purposes:

• Providing, operating, and maintaining the Studio and its features
• Creating and managing your user account
• Authenticating your identity and maintaining session security
• Hosting, rendering, processing, and delivering your 3D and AR content
• Processing AI-powered 3D generation requests
• Processing subscription payments and managing billing
• Sending transactional communications (e.g., account verification, password resets, subscription confirmations)
• Providing customer support and responding to inquiries
• Reviewing job applications sent through our careers page
• Monitoring Studio performance, diagnosing technical issues, and preventing abuse
• Generating aggregated, anonymized analytics to improve the Studio
• With your consent, measuring how basebros.com is used (Google Analytics) and how our advertising performs, including showing our ads again to people who visited basebros.com (Google Ads)
• Providing publishers with visitor statistics for their published pages
• Enforcing our Terms of Use and preventing unauthorized or fraudulent activity
• Complying with legal obligations and responding to lawful requests from authorities

5. Data Sharing and Disclosure

We do not sell, rent, lease, or trade your personal data to third parties for their marketing purposes.

We may share your personal data only in the following circumstances:

5.1 Service Providers (Data Processors)

We engage trusted third-party service providers who process personal data on our behalf under strict contractual obligations:

• Cloud Infrastructure: DigitalOcean, LLC (servers, and object storage for 3D assets, source images, and Studio files, in the SFO3 region, San Francisco, United States)
• Database Hosting: MongoDB, Inc. (MongoDB Atlas) on Amazon Web Services, us-east-1 region, United States (account, project, and analytics data)
• Authentication: Google LLC - Google OAuth (when you choose to sign in with Google)
• Product Analytics: Mixpanel, Inc. (San Francisco, California, USA - mixpanel.com) - product analytics for basebros.com and the Studio, and session replay on basebros.com, in your browser only with your consent (Section 2.4); data stored in the European Union (EU data residency). See Section 2.5.
• Web Analytics and Advertising (basebros.com only): Google LLC (Mountain View, California, USA) - Google Analytics 4 with your Analytics consent and Google Ads with your Marketing consent, in your browser only after you allow them (Section 2.4); for Google Ads measurement, Google may also act as an independent controller. See Section 2.6.
• AI 3D Generation Providers: Meshy, Inc. (San Francisco, California, USA - www.meshy.ai), VAST AI / Tripo (operator of www.tripo3d.ai), Features & Labels, Inc. / fal.ai (San Francisco, California, USA - fal.ai - API at queue.fal.run), which runs the Rodin, TRELLIS and Pixal3D engines, and Tencent Cloud (international service, Singapore region - API at hunyuan.intl.tencentcloudapi.com), which runs the Hunyuan engine - process text prompts and reference images you submit to generate 3D models. See Section 12 for details.
• AI Assistant: Anthropic, PBC (San Francisco, California, USA - anthropic.com) powers the BASE AI assistant. The messages you send to the BASE AI assistant (in the Studio and on basebros.com), any images you attach to a message, and short context about the screen you are on (for example the open panel or the selected model) are processed by Anthropic to generate the answer. Under its commercial terms, Anthropic does not use this API data to train its models by default and keeps it only for a limited period. Your conversation history is kept by us.
• Payment Processing & Merchant of Record: Polar Software, Inc., a Delaware corporation; registered office: 3500 South DuPont Highway, Dover, DE 19901, USA; principal place of business: 548 Market Street, PMB 61301, San Francisco, CA 94104, USA; EU VAT identification: EU372061545; support@polar.sh · polar.sh. Merchant of Record (MoR) acting as both an independent data controller for its own checkout and customer-portal activities, and as a data processor on our behalf for subscription provisioning. Underlying card processing is performed by Stripe - the applicable Stripe entity is Stripe, Inc. / Stripe, LLC for U.S. transactions and Stripe Payments Europe, Limited for EEA cardholders (per Stripe Services Agreement). See Section 5.2 below for the full scope of data handling, certifications and international transfers.
• Email Services: Google LLC (Google Workspace, Gmail SMTP, United States) for transactional email, such as verification codes and password resets

All data processors are contractually required to process personal data only as instructed by us, maintain confidentiality, and implement appropriate technical and organizational security measures.

5.2 Payment Data - Polar (Merchant of Record) and Stripe (Card Processor)

All paid subscriptions, renewals, and one-time purchases in the Studio are processed through a two-layer payment stack:

• Polar Software, Inc. - Delaware corporation; registered office: 3500 South DuPont Highway, Dover, DE 19901, USA; principal place of business: 548 Market Street, PMB 61301, San Francisco, CA 94104, USA; EU VAT: EU372061545. Polar is the Merchant of Record (MoR) and is named as the seller on your invoice / receipt and as the descriptor on your bank or card statement (line item typically "Polar" / "polar.sh"). Privacy / data-subject contact: privacy@polar.sh; general support: support@polar.sh.
• Stripe - operating through the Stripe entity applicable to your jurisdiction (Stripe, Inc. / Stripe, LLC in the United States; Stripe Payments Europe, Limited in the EEA). Stripe is Polar's underlying PCI-compliant card processor.

The privacy implications of this arrangement are as follows:

• Roles and responsibility: Polar processes payment data partly as an independent data controller (for its own MoR, tax, fraud-prevention, accounting and statutory record-keeping obligations) and partly as a data processor acting on our instructions (to provision and renew your subscription). Stripe processes cardholder data as an independent controller for its own legal, fraud-prevention and PCI compliance purposes, and as a service provider/processor for Polar.
• Card data collected directly by Polar / Stripe: Your full payment instrument data - primary account number (PAN), card expiry, card verification value (CVV/CVC), card type and brand, last four digits, billing name and address, contact phone/email, and (where required) tax identification number - is collected and held directly on Polar's and Stripe's infrastructure. This data is never seen, stored or processed by us; we have no access to raw cardholder data.
• What we receive from Polar: We only receive a non-sensitive transaction reference sufficient to provision and manage your subscription. This typically includes: Polar customer ID, Polar subscription ID, plan (Pro), model capacity (the number of models you pay for, including any scheduled capacity change), billing period (current period start and end, which sets your next billing date), payment status (active / past_due / canceled), the subscription amount and any discount applied, billing country (for tax determination), and, where applicable, the last four digits and brand of the card so that we can show "Visa •••• 4242" in your account UI. We do not receive the full PAN, CVV, or full billing address.
• Security certifications (Stripe): Stripe maintains PCI DSS Level 1 certification (the highest tier defined by the PCI Security Standards Council, attested annually) and produces annual SOC 1 Type II and SOC 2 Type II reports. Stripe enforces PSD2 / Strong Customer Authentication (SCA) via 3-D Secure for cardholders in the European Economic Area and the United Kingdom, applies Stripe Radar machine-learning fraud screening, and uses TLS for data in transit with AES-class encryption at rest. Stripe's full security posture is documented at stripe.com/docs/security.
• International transfers (EEA / UK / Switzerland → United States): Polar and Stripe store and process payment data on infrastructure located primarily in the United States. For transfers from the EEA, United Kingdom, or Switzerland to the U.S.:
  • Stripe, LLC is certified under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework - listed on the official dataprivacyframework.gov registry. Stripe additionally executes EU Standard Contractual Clauses (Commission Decision 2021/914) and the UK International Data Transfer Addendum where DPF coverage does not apply.
  • Polar relies on EU Standard Contractual Clauses (with the UK IDTA and Swiss supplementary clauses) for any transfer of personal data originating in the EEA/UK/Switzerland, together with the additional safeguards described in Polar's privacy policy.
• Tax processing: Polar (using Stripe Tax) calculates, collects, files and remits applicable VAT, GST, sales tax, digital service tax, and similar consumption taxes globally, on our behalf. The amount of tax collected is determined by your billing country and the rules in force there. Your tax invoice is issued by Polar and is available from Polar's customer portal.
• Retention: Polar and Stripe retain transaction records for as long as required by statutory accounting, tax, anti-money-laundering, fraud-prevention and consumer-protection obligations (typically multiple years; the exact retention period is determined by their own policies and applicable law). Our records of your subscription metadata (status, plan, model capacity, billing period) are retained for the lifetime of your BASE account plus a residual period required for our own audit and compliance obligations.
• Polar's subprocessors: Polar engages Stripe (payment processing), Google (analytics, where applicable), and other vendors as documented in Polar's own privacy policy. Stripe's current list of sub-processors is published at stripe.com/service-providers/legal.
• Independent privacy notices: Polar's and Stripe's own privacy notices govern their processing of your payment data and apply in addition to this Privacy Policy. We strongly recommend reading them before completing a payment:
  • Polar - polar.sh/legal/privacy
  • Stripe - stripe.com/privacy
• Exercising your rights with respect to payment data: If you wish to exercise data-subject rights (access, rectification, erasure, restriction, portability, objection - see Section 9) over information held by Polar or Stripe, you may contact us at info@basebros.com and we will forward your request to Polar where appropriate. You may also contact Polar's privacy team directly at privacy@polar.sh, or Stripe via the contact channels in Stripe's privacy notice. Note that statutory record-keeping obligations may limit erasure of certain payment records.

5.3 Legal Requirements

We may disclose personal data when required to do so by law, regulation, or valid legal process (e.g., court order, subpoena, or government request), or when we believe in good faith that disclosure is necessary to protect our rights, your safety, the safety of others, or to investigate fraud.

5.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal data may be transferred as part of that transaction. We will notify you of any such change and ensure the successor entity is bound by at least equivalent privacy obligations.

5.5 Published Content

When you publish a 3D viewer page, AR experience, or other content through the Studio, that content becomes publicly accessible via the generated URL. Any information contained in published content is visible to anyone with the link.

6. International Data Transfers

Your personal data may be processed and stored in countries other than your country of residence, including but not limited to the United States and European Union member states, where our infrastructure providers maintain their data centers. If you allow Analytics or Marketing on basebros.com, the data collected by Google Analytics or Google Ads is processed by Google, including in the United States (Section 2.6).

For transfers of personal data outside of Turkey, we comply with KVKK requirements, including obtaining necessary approvals from the Personal Data Protection Board where required. For transfers from the EEA, we rely on:

• Adequacy decisions by the European Commission
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Other appropriate safeguards as permitted under applicable law

You may request information about the specific safeguards in place for international transfers by contacting us.

7. Data Security

We implement comprehensive technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including but not limited to:

• Encryption of all data in transit using TLS/SSL protocols
• Encryption of sensitive data at rest
• Cryptographic hashing of passwords using industry-standard algorithms (bcrypt)
• JWT-based authentication with configurable token expiration
• Role-based access control and principle of least privilege
• Regular security assessments and code reviews
• Comprehensive audit logging of administrative actions
• Secure, isolated cloud infrastructure with firewall protection
• Rate limiting and abuse detection mechanisms

While we implement industry-standard security practices, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security, and you acknowledge this inherent risk when using any internet-based service.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law. Specific retention periods are as follows:

Upon account deletion, we will erase or irreversibly anonymize your personal data within 30 days, except for data that must be retained to comply with legal obligations or to establish, exercise, or defend legal claims.

9. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

9.1 Rights Under KVKK (Turkey)

In accordance with Article 11 of Law No. 6698, you have the right to:

• Learn whether your personal data is being processed
• Request information about the processing of your personal data
• Learn the purpose of processing and whether it is used in accordance with its purpose
• Know the third parties to whom your personal data has been transferred domestically or abroad
• Request correction of incomplete or inaccurate data
• Request deletion or destruction of your personal data under conditions set forth in Article 7
• Object to results against you arising from the analysis of your data exclusively through automated systems
• Claim compensation for damages arising from unlawful processing of your personal data

Our information notice under Article 10 of Law No. 6698, in Turkish (Kişisel Verilerin Korunması Hakkında Aydınlatma Metni), is available as our KVKK Notice. By accepting the Terms of Use and this Privacy Policy, you confirm that you have read the KVKK Notice. It also explains how to apply to us under KVKK, including in writing to our registered office or by KEP.

9.2 Rights Under GDPR (EEA Residents)

If you are located in the European Economic Area, you additionally have the right to:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Restriction: Request restriction of processing in certain circumstances
• Data Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests or direct marketing
• Automated Decision-Making: Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects
• Withdraw Consent: Withdraw previously given consent at any time
• Lodge a Complaint: File a complaint with your local supervisory authority

9.3 Rights Under CCPA (California Residents)

If you are a California resident, you have the right to:

• Know: Request disclosure of the categories and specific pieces of personal information we have collected
• Delete: Request deletion of your personal information
• Opt-Out: Opt out of the sale or sharing of personal information. We do not sell personal information. Google Ads on basebros.com, which may count as sharing for cross-context behavioral advertising, runs only if you allow Marketing, and you can turn it off at any time in Cookie settings.
• Non-Discrimination: Not receive discriminatory treatment for exercising your privacy rights

California residents may also designate an authorized agent to make requests on their behalf.

9.4 How to Exercise Your Rights

To exercise any of the above rights, please contact us at info@basebros.com with the subject line "Data Subject Request." We will verify your identity and respond within the legally required timeframe (30 days under KVKK, 30 days under GDPR, 45 days under CCPA). Where requests are manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act.

10. Children's Privacy

The Studio is not directed at, and is not intended for use by, individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided personal data to us, please contact us immediately at info@basebros.com. Upon verification, we will promptly delete such data.

11. Third-Party Services and Links

The Studio may contain links to, or integrations with, third-party websites and services (including Google Sign-In, payment processors, and cloud storage providers). This Privacy Policy does not apply to third-party services. We strongly encourage you to review the privacy policies of any third-party services you access through the Studio. We are not responsible for the privacy practices, content, or security of third-party services.

12. AI Services and Third-Party AI Providers

When you use our AI-powered features (text-to-3D generation, single-image-to-3D, multi-view image-to-3D, AI-assisted editing), the Studio acts as an interface that orchestrates the request, while the actual 3D generation is performed by independent third-party AI providers acting as our data sub-processors. The following applies:

12.1 AI Generation Sub-Processors

To deliver AI 3D generation features, we transmit your inputs to one of the following providers, depending on the model you select in the Generator interface:

The list of AI providers may be expanded, replaced, or discontinued at our discretion as we evaluate model quality, performance, and compliance posture. Material changes will be reflected by an updated version of this Policy.

12.2 What Is Sent and What Is Not

• Sent to the AI provider: the text prompt you typed and/or the reference image(s) you uploaded - transmitted either as a temporary, expiring (≤ 30 minutes) URL or as the image file itself, depending on the selected provider's API - plus the generation parameters you chose.
• NOT sent to the AI provider: your account email, username, payment data, or any other personal account information. The provider receives only the inputs strictly necessary to fulfill the generation.
• Storage on our side: the source image(s) you uploaded are stored on our DigitalOcean Spaces infrastructure under your account so that you and our administrators can review, re-download, or delete them later.
• Provider's own retention: third-party providers may retain prompts, reference images, and generated outputs in accordance with their own privacy policies and terms of service. We strongly recommend that you review them: Meshy Privacy Policy, Tripo Privacy Policy, fal.ai Privacy Policy (Rodin, TRELLIS and Pixal3D), Tencent Cloud Privacy Policy (Hunyuan).

12.3 Functional Equivalence

Because we integrate with the official APIs of these engines (directly for Meshy, Tripo and Hunyuan, and through fal.ai's hosted API for Rodin, TRELLIS and Pixal3D), the core generation modes of each engine can also be used through our Studio - including text-to-3D (Meshy, Tripo, Rodin and Hunyuan), image-to-3D (all six engines), multi-view-to-3D (up to five reference images, depending on engine), PBR / non-PBR textures, multiple polycount tiers, and quad/triangle topology options where the engine offers them. We expose these capabilities through a unified interface that adds project management, model library, AR publishing, and analytics on top.

12.4 International Data Transfers for AI Processing

Use of these AI services necessarily involves transferring your inputs to processing infrastructure located outside of Turkey and outside of the European Economic Area. Depending on the engine you select, the processing location is the United States (Meshy, and fal.ai for Rodin, TRELLIS and Pixal3D), Singapore (Tencent Cloud for Hunyuan), or provider cloud regions that may include the People's Republic of China (Tripo, and Rodin where fal.ai relies on its developer), as set out in Section 12.1. By using AI features, you acknowledge and consent to such international transfers. Where required, we rely on Standard Contractual Clauses or other appropriate safeguards permitted under KVKK and GDPR. If you do not wish your inputs to be transferred to a particular jurisdiction, you may simply refrain from using AI generation features - all non-AI Studio features (manual GLB upload, scene editing, page designer, AR publishing, analytics) operate entirely on our own infrastructure.

12.5 Outputs and Your Rights

• AI-generated 3D models are stored as part of your User Content and are subject to the same access, export, and deletion rights described in Section 9.
• Source images you uploaded for image-to-3D generation are retained alongside the resulting model so that the link between input and output remains traceable. Deleting the model also deletes its associated source images from our storage.
• We may use anonymized and aggregated usage patterns (e.g., success rates, average generation duration, popular generation types) to improve the Studio; we do not share individual prompts, images, or outputs with third parties beyond the AI sub-processors named above and the AI assistant provider named in Section 5.1.
• You retain the rights described in our Terms of Use regarding ownership and licensing of AI-generated content.
• No human pre-screening: generation requests are forwarded directly to the selected provider's API and the resulting model is returned to your account without human review on our side. The applicable provider's content rules and acceptable-use policies (Meshy, Tripo, Tencent Cloud for Hunyuan, and fal.ai for Rodin, TRELLIS and Pixal3D) apply with equal force in the Studio - see Section 8 of our Terms of Use for the full incorporation by reference.

13. Published 3D Viewer Analytics

When you publish a 3D viewer page or AR experience, we collect analytics data from visitors to your published pages so that we can show you how they are used, including:

• Page view counts and unique visitor counts
• Geographic distribution of visitors (country/city level, derived from the IP address)
• Device and browser types used to access the content
• Interaction metrics (e.g., 3D rotation, AR activation, session duration)
• Referral sources and how the page was opened (for example from a QR code)

To count unique visitors, the published page sets one first-party cookie, bb_sid, holding a random ID for 12 months. With each view we store the visitor's IP address, browser user agent, referring page, time zone offset, approximate location (city and country, derived from the IP address) and that random ID. These view records are kept for up to 24 months and then deleted automatically.

The Studio's analytics dashboard shows you these statistics only in aggregated form; it does not show you the IP address or other details of individual visitors. We use the view records only for these statistics, including the overall usage statistics our own team reviews, and not to build visitor profiles or for advertising. Published pages show no cookie banner and load no Mixpanel, Google Analytics or advertising tags; visitors can block or delete the bb_sid cookie in their browser settings and the page keeps working.

14. Do Not Track Signals

Some web browsers transmit "Do Not Track" (DNT) signals to websites. Because there is no universally accepted standard for how companies should respond to DNT signals, we do not generally respond to DNT signals, with one exception: our product analytics in the browser (Mixpanel, Section 2.5) is turned off when your browser sends a DNT signal. Google Analytics and Google Ads on basebros.com do not respond to DNT signals; they run only if you allow them in Cookie settings. You can also manage tracking preferences through cookie settings and browser controls as described in Section 2.4.

15. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority (including the Turkish Personal Data Protection Authority, "KVKK Board") within 72 hours of becoming aware of the breach, as required by applicable law
• Notify affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms
• Document the breach, its effects, and remedial actions taken

16. Automated Decision-Making

The Studio does not engage in fully automated decision-making that produces legal effects or similarly significantly affects you. Certain automated processes are used for:

• Fraud detection and security monitoring
• Plan limit enforcement (live models and new models per month), including keeping your most recently added models live and archiving the rest when you do not choose which models stay live by the deadline shown in the Studio
• AI content generation based on your inputs

You have the right to request human review of any automated decisions that materially affect you.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be communicated to registered users via email or through an in-Studio notification at least 15 days prior to the effective date of the changes.

We encourage you to review this Policy periodically. The "Last Updated" date at the top of this page indicates when the Policy was last revised, and the "Effective Date" indicates when that version takes effect. Your continued use of the Studio after any changes constitutes your acceptance of the updated Policy.

18. Contact Information

For any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us at:

BASE BROS Bilişim Hizmetleri A.Ş.
Registered office: Sanayi Mahallesi, Teknopark Bulvarı, No:1/4C Blok, Kat:3, İç Kapı No:307, 34906 Pendik / İstanbul, Türkiye
Headquarters: Girne Mah. Girne Cd. No: 125/2, 34852 Maltepe / İstanbul, Türkiye
MERSİS No: 0892078506200001

General Inquiries: info@basebros.com
KEP (registered electronic mail): basebrosbilisim@hs01.kep.tr
Technical & R&D: support@basebros.com
Web: basebros.com

For complaints regarding the processing of your personal data in Turkey, you may also apply to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu - www.kvkk.gov.tr). For EEA residents, you may lodge a complaint with your local data protection supervisory authority.