Privacy Policy

Last updated: 18 October 2026

Draft text — legal review required before publication.

This policy explains which personal data the IFCNexus service processes, for what purpose, with whom it is shared and what your rights are (GDPR and the Turkish Data Protection Law, KVKK).

1. Controller

MARFEN Mühendislik Tasarım ve Danışmanlık – Mahmut TARI · Şehitler Mah. 416. Sk. No: 2 İç Kapı No: 1, 41650 Gölcük / Kocaeli, Türkiye · info@marfen.com.tr

2. Data we process

Account: the e-mail address, name, profile picture link and Google user ID of your Google account.
Drive connection: if you use the Drive feature, the refresh token issued by Google is stored encrypted on our server and used only to read the IFC files you pick and to write outputs to your "IFCNexus" folder (drive.file scope). We cannot see the rest of your Drive.
Content: IFC files you upload or pick from Drive, generated DXF/PDF files, assembly selections and job records (assembly marks, counts, dates, paper/scale).
Subscription: customer and subscription IDs, plan, status and period dates received from Paddle. Card details never reach us; they are processed by Paddle.
Technical: IP address, browser information and request times (server logs), error reports.
Correspondence: e-mails you send to support.

3. Purposes and legal bases

Providing the service, managing your account, generating and delivering sheets — performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c).
Account security, abuse prevention, troubleshooting and service improvement — legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5/2-f).
Invoicing, accounting and legal obligations — legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5/2-ç).
Drive connection and, if any, product announcement e-mails — consent (GDPR Art. 6(1)(a); KVKK Art. 5/1), which you can withdraw at any time.

4. Google user data and Limited Use

IFCNexus' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use Google user data for advertising, do not sell it, do not allow humans to read it (except for security, legal compliance or with your explicit consent) and do not use it to train AI or machine-learning models. You can disconnect Drive at any time with the "Disconnect Drive" button in the app or from your Google account's permissions page.

5. Retention

IFC files and generated outputs: deleted from the server automatically after 7 days (files you save to Drive remain under your control).
Account data: until you delete your account.
Job records (assembly marks, counts, dates): until account deletion, at most 24 months.
Subscription and invoice records: for the period required by tax law (10 years in Türkiye) at Paddle and in our accounting records.
Server logs: 30 days.

6. Recipients and transfers

Google LLC (USA): sign-in and Drive, under the EU-US Data Privacy Framework and standard contractual clauses.
Paddle.com Market Limited (United Kingdom): payment, invoicing and tax; Paddle is an independent controller under its own privacy policy.
Hosting: servers are located in the European Union (Hetzner Online GmbH, Germany/Finland).

Data is not otherwise sold or shared; it may be disclosed to competent authorities where legally required.

7. Cookies

Only a session cookie ("oturum", strictly necessary, 30 days) and a short-lived state cookie during sign-in are used. There are no analytics or advertising cookies. Your language preference is stored in your browser. The Google Drive picker is served by Google, which may set its own cookies.

8. Security

Communication is encrypted with TLS; Drive tokens are stored encrypted on the server; access is restricted; files are deleted automatically after 7 days. Absolute security cannot be guaranteed; in the event of a data breach we notify within the statutory periods.

9. Your rights

Under GDPR Art. 15–22 and KVKK Art. 11 you have the right to access, rectify and erase your data, to restrict processing, to data portability, to object and to withdraw consent. Requests go to info@marfen.com.tr and are answered within 30 days. You may lodge a complaint with your local supervisory authority (GDPR) or the Turkish Personal Data Protection Authority (KVKK).

10. Children

The service is not directed at persons under 18 and we do not knowingly collect data from children.

11. Changes

We may update this policy; material changes are announced by e-mail or in-app notice.