Privacy Policy

Heppio 3D Studio is a venture of Solaris Yenilenebilir Enerji Üretimi Pet. Müh. Tur. İnş. San. ve Tic. A.Ş. (the data controller), a joint-stock company registered in Türkiye. This policy explains what data we process, why, and how long we keep it. Users in the EU/EEA and the UK can exercise their rights under the GDPR by contacting us at the address below.

Registered address: Alparslan Mahallesi Mehmet Yazar Caddesi No:78/A Özvatan / Kayseri, Türkiye
MERSIS No: 0773 0346 4550 0001 · Trade Registry No: 42400
Phone: +90 352 222 38 64
Email: destek@heppio.com

Data we collect

Account: email address, an irreversible hash of your password (Argon2id), language and time zone preference, sign-up date and the date you accepted the privacy notice.
Session: a hash of the random session token, IP address and browser information — up to 14 days.
Security: sign-in attempts (email, IP, time) — 1 day; logs of account and admin actions (including IP) — the IP address is deleted after 2 years; the record itself (what was done, when) is kept as a business record.
Design history: the outputs of designs you convert (SVG, 3D model, settings, text you typed) — your last 30 designs; deletable one by one or with your account.
Drafts: when you click "Save", the editor's elements and the images you uploaded — up to 20 drafts; deletable.
Usage: your daily conversion count and a fingerprint (SHA-256) of files processed that day. Uploaded images are kept only while processing and deleted when it finishes.
AI figures (top plan): the photo you upload is processed only on machines we operate ourselves; it is never sent to an AI company or any other third party and is not used to train models. The photo and its small preview are kept only while generation runs and are deleted when it finishes, fails or you cancel it. What remains is the generated figure (in your design history, under the rules above).
Community: your username, your profile (profile and cover image, short bio, location and links, if you add them) and the designs you share (title, description, tags, watermarked preview, low-detail 3D) are public. Uploaded images are re-processed on our server and hidden data such as location is removed. Posts are kept until you delete them or your account. Your likes, collections, downloads and reports are private; a reporter's identity is never shown to the design's owner.
Visit statistics (no account needed): the page viewed, the referring site (domain only) and a short fingerprint made with a secret key that changes daily — 400 days. IP address and browser details are not stored; the fingerprint can't be linked to a person or to another day, and no cookies are used.
Payments (once enabled): order number, plan, amount, date and the payment provider's transaction ID; the billing details you enter at checkout (name, phone, address; for businesses company name, tax office and number) and a copy of the Preliminary Information Form and Distance Sales Agreement you accepted, with the time and IP address of acceptance. Card details never reach us. Kept after account deletion because tax and commercial law require it (10 years), but unlinked from the account.

Your uploads and designs

Images you upload are processed only for conversion and deleted when it finishes. The models you make are yours; we don't use them for our own purposes, sell them or use them to train AI.

Legal bases

Providing the service and your account — performance of a contract.
Security, abuse prevention and rate limits — legitimate interests.
Payments and invoicing — contract and legal obligations.

Cookies

svgs_session — keeps you signed in; 14 days; not readable by JavaScript (HttpOnly), HTTPS only.
lang — your chosen interface language; 1 year.

We use no advertising, social media or tracking cookies; visits are counted without cookies and without personal data.

Service providers

Hosting: Hetzner Online GmbH (Germany) — server and database.
Email (once enabled): Brevo (sending) and ImprovMX (forwarding incoming mail).
Payments (once enabled): a licensed payment institution, named on this page before payments start.

Security

All connections are encrypted with HTTPS. Passwords are stored as irreversible hashes (Argon2id). Conversions run in isolated processes with memory and time limits.

Your rights

You can access, correct, delete and object to the processing of your data, and complain to your data protection authority. Delete your account completely from the Account page; for other requests, write to destek@heppio.com.

Changes

If we update this policy we change the date on this page and notify you by email of significant changes.