Privacy Policy

Heppio 3D Studio is provided by [Company name] A.Ş., [Adres]. This policy explains what data we process, why, and how long we keep it. [Counsel to confirm GDPR controller details and, if required, an EU representative.]

Data we collect

• Account: email address, an irreversible hash of your password (Argon2id), language and time zone preference, sign-up date and the date you accepted the privacy notice.
• Session: a hash of the random session token, IP address and browser information — up to 14 days.
• Security: sign-in attempts (email, IP, time) — 1 day; logs of account and admin actions (including IP) — [retention period to be set by counsel; currently kept indefinitely].
• Design history: the outputs of designs you convert (SVG, 3D model, settings, text you typed) — your last 30 designs; deletable one by one or with your account.
• Drafts: when you click "Save", the editor's elements and the images you uploaded — up to 20 drafts; deletable.
• Usage: your daily conversion count and a fingerprint (SHA-256) of files processed that day. Uploaded images are kept only while processing and deleted when it finishes.
• Visit statistics (no account needed): the page viewed, the referring site (domain only) and a short fingerprint made with a secret key that changes daily — 400 days. IP address and browser details are not stored; the fingerprint can't be linked to a person or to another day, and no cookies are used.
• Payments (once enabled): order number, plan, amount, date and the payment provider's transaction ID. Card details never reach us. Kept after account deletion where the law requires, but unlinked from the account.

Your uploads and designs

Images you upload are processed only for conversion and deleted when it finishes. The models you make are yours; we don't use them for our own purposes, sell them or use them to train AI.

Legal bases

• Providing the service and your account — performance of a contract.
• Security, abuse prevention and rate limits — legitimate interests.
• Payments and invoicing — contract and legal obligations.

Cookies

• svgs_session — keeps you signed in; 14 days; not readable by JavaScript (HttpOnly), HTTPS only.
• lang — your chosen interface language; 1 year.

We use no advertising, social media or tracking cookies; visits are counted without cookies and without personal data.

Service providers

• Hosting: Hetzner Online GmbH (Germany) — server and database.
• Email (once enabled): Brevo (sending) and ImprovMX (forwarding incoming mail).
• Payments (once enabled): [payment provider].

Security

All connections are encrypted with HTTPS. Passwords are stored as irreversible hashes (Argon2id). Conversions run in isolated processes with memory and time limits.

Your rights

You can access, correct, delete and object to the processing of your data, and complain to your data protection authority. Delete your account completely from the Account page; for other requests, write to [destek@heppio.com].

Changes

If we update this policy we change the date on this page and notify you by email of significant changes.