Version: 1.0 Effective date: 06.11.2026 Last updated: 6 November 2026

​

This policy applies across three properties: shapelid.com (the marketing and content site), app.shapelid.com (the Client Portal, for buyers) and partner.shapelid.com (the Partner Portal, for manufacturers). Together these are referred to as the "Platform". The main site and the portals run on separate technical systems, but the data controller is the same and this policy covers all of them under a single framework; sections that do not apply to a given property are not applied to that property.

​

1. DATA CONTROLLER

Under Law No. 6698 on the Protection of Personal Data ("KVKK"), your personal data is processed by the company identified below as data controller:

​

Legal entity name: Shapelid

Address: 472 Street, Ankara

Tax office and number: Keçiören Vergi Dairesi / 9490501385

Email: info@shapelid.com Phone: +90 543 100 02 60

​

In this policy, "Shapelid", "we" and "the Platform" refer to the company identified above.

​

The Platform is a business to business (B2B) manufacturing sourcing service. Accounts are expected to be held by legal entities or sole proprietorships, and the Platform is not directed at anyone under 18 (see Section 14).

​

2. SCOPE AND CORE PRINCIPLES

This policy covers all personal data processed through the Platform: buyers and manufacturers who hold accounts, the employees, authorised representatives and sub users who use the Platform on behalf of those businesses, visitors who request a quote or submit a contact form, newsletter and notification subscribers, and business partners, suppliers and site visitors.

​

Our principles: processing in compliance with the law and the rules of good faith; keeping data accurate and, where necessary, up to date; processing for specific, legitimate and explicit purposes; keeping processing relevant, limited and proportionate to purpose; retaining data only as long as required by applicable law; transparency.

​

Architectural note: Shapelid is a platform that brings a buyer and a manufacturer together for production. Manufacturers are independent businesses and are data controllers in their own right for the transactions they conclude. When a buyer's request is shared with matched manufacturers, the scope of what is shared is set out in Section 7.2.

​

3. PERSONAL DATA WE COLLECT

​

The sub sections below describe the data processed in each category and where it comes from. Required fields are marked on the relevant form. You may choose not to complete optional fields, but some services may then be unavailable.

​

3.1 Account and identity data

 

• First name, last name, job title and role (registration and profile forms)

• Email address and phone number (registration, verification, communication)

• Password hash and session information (generated by the system)

• Preferred language, time zone and notification preferences (profile and usage)

• Profile photo, optional (user upload)

​

3.2 Business and verification data

 

• Company name, trading name and entity type (onboarding form)

• MERSİS number, tax office, tax number or national ID number (onboarding, verification)

• Trade registry details, activity and incorporation information (onboarding)

• Tax certificate, trade registry gazette, signature declaration or signature circular, authorisation documents (document upload for verification)

• Registered address and production site address where different (onboarding)

• IBAN and bank account details for manufacturer payouts (onboarding, finance settings)

• Certifications, capacity and machine park details for manufacturers (profile and capability forms)

​

Identity documents or signature declarations may be uploaded as part of verification. These documents are processed solely to verify business status and signing authority. Access is restricted once verification is complete and the documents are deleted at the end of the retention periods in Section 9. We do not request special categories of personal data (health, biometrics, religion, ethnic origin, political opinion, trade union membership, sex life, criminal convictions and similar). Please do not upload this kind of information to the Platform.

​

3.3 Technical production data

 

• CAD and 3D model files: STL, STEP, IGES, OBJ, 3MF, DXF and similar (user upload)

• 2D drawings, PDFs, specification and tolerance documents (user upload) • Material, colour, surface finish, resolution, hardness, tolerance and certification selections (configurator)

• Quantity, lead time, delivery country and city, budget range (RFQ form)

• Bill of materials, revisions, project and part data (portal modules)

• Production notes, quality and inspection records, production status (portal workflows)

​

This data often contains no personal data, but file contents, file names or production notes may include names, contact details or trade secrets. Technical data therefore receives the same protection standards as personal data.

​

3.4 Quote, order and commercial transaction data

 

• RFQ, quote, counter offer, revision and messaging records (portal workflows)

• Order, production and delivery status, order history (portal workflows)

• Disputes, returns and support requests (support channels)

• Pricing outputs, calculation inputs and model versions (pricing engine)

​

3.5 Payment and invoicing data

 

• Transaction amount, currency, transaction ID and transaction status (payment provider)

• Invoice details: company name, tax details, address (billing form)

• Bank account details for manufacturer payouts (onboarding)

• Card details are not stored by Shapelid and are processed by the payment institution

​

Card numbers, CVV codes and full card data never enter Shapelid systems and are never stored by Shapelid. Payments are taken on the payment institution's own secure payment page, and only the transaction result and masked details are returned to us.

​

3.6 Delivery and shipping data

 

• Recipient name, delivery address, phone and email (order form)

• Carrier, tracking number and shipment status (carrier integration)

• Customs and export documentation data for international shipments (order and shipping workflows)

​

3.7 Communication and support data Contents of emails, in platform messages, calls, forms and support requests, together with their date and time records.

​

3.8 AI and automation data

 

• Agent definition, instruction text, permissions and tool scope (user configuration)

•Agent run records: input, output, tools used, duration and errors (system)

• Provider API key reference (BYOK): stored encrypted, never displayed and never logged (user)

​

3.9 Technical, security and usage data IP address, browser and device information, operating system, language, session and login records, error logs, transaction and audit trails, page view and click data, cookie identifiers.

​

3.10 Marketing data Newsletter subscription, open and click records, campaign participation, communication preferences and information request forms.

​

4. HOW WE COLLECT DATA

We collect personal data in three ways. First, directly from you: registration, onboarding, profile, RFQ and order forms, file uploads, support requests, emails and in platform messages. Second, automatically: cookies, server and application logs, session and security records, and records generated by the pricing and analysis engines. Third, from third parties: payment institutions (transaction results), carriers (tracking status), e-invoicing providers, email and marketing infrastructure (delivery and open status), and publicly available registry sources consulted during verification.

​

5. PURPOSES AND LEGAL BASES

​

Each processing purpose is listed below with its legal basis under Article 5 of the KVKK. Where a purpose relies solely on explicit consent, you may withdraw that consent at any time; withdrawal does not affect the lawfulness of processing carried out before withdrawal.

​

1. Account creation, identity verification and session management. Legal basis: performance of a contract or steps prior to entering one (Art. 5/2-c).

2. Verification of a manufacturer's business status and signing authority. Legal basis: legal obligation (Art. 5/2-ç) and performance of a contract (Art. 5/2-c).

3. Creating RFQs, matching manufacturers, collecting and comparing quotes. Legal basis: performance of a contract (Art. 5/2-c).

4. Automated pricing and manufacturability analysis. Legal basis: performance of a contract (Art. 5/2-c).

5. Running order, production, quality and delivery processes. Legal basis: performance of a contract (Art. 5/2-c).

6. Collecting payments, paying manufacturers, issuing invoices and e-invoices. Legal basis: performance of a contract (Art. 5/2-c) and legal obligation (Art. 5/2-ç).

7. Accounting, tax and statutory record keeping. Legal basis: legal obligation (Art. 5/2-ç).

8. Shipping and logistics, customs and export processes. Legal basis: performance of a contract (Art. 5/2-c) and legal obligation (Art. 5/2-ç).

9. Customer support, complaint handling and dispute resolution. Legal basis: performance of a contract (Art. 5/2-c) and legitimate interest (Art. 5/2-f).

10. Information security, preventing unauthorised access, detecting fraud and abuse, audit trails. Legal basis: legitimate interest (Art. 5/2-f) and legal obligation (Art. 5/2-ç).

11. System maintenance, debugging, performance and service quality measurement. Legal basis: legitimate interest (Art. 5/2-f).

12. Service notifications about orders, quotes, production and security. Legal basis: performance of a contract (Art. 5/2-c) and legitimate interest (Art. 5/2-f).

13. Commercial electronic messages: newsletters, campaigns and product announcements. Legal basis: explicit consent (Art. 5/1) and Law No. 6563.

14. Cookie based analytics and marketing measurement. Legal basis: explicit consent (Art. 5/1).

15. Asserting and defending legal claims, responding to competent authorities. Legal basis: establishment, exercise or protection of a right (Art. 5/2-e) and legal obligation (Art. 5/2-ç).

16. Anonymised statistics, market analysis and model improvement. Legal basis: anonymised data, which loses the character of personal data under Art. 28/1-ç of the KVKK.

​

Profiling and automated decisions: pricing and manufacturer matching are performed automatically. These processes do not produce legal effects and do not amount to an evaluation of an individual solely by automated means; the final quote and order decision rests on the parties' approval. To object or request human review of an automated calculation, see Section 12.

​

6. COOKIES AND SIMILAR TECHNOLOGIES

​

On the main site (shapelid.com) we use three cookie types. Strictly necessary cookies support site functionality, security, load balancing and storage of your consent choice, and require no consent. Analytics cookies measure visit counts, page views and traffic sources and require consent. Marketing cookies support campaign measurement and retargeting and require consent.

​

On the portals (app.shapelid.com and partner.shapelid.com) strictly necessary cookies support sign in, authentication, security (CSRF) and language and theme preferences, and require no consent. Functional cookies support recently viewed records, form drafts and dashboard preferences, and require consent at your option. Analytics cookies support usage measurement and error monitoring and require consent.

​

You can manage cookie preferences from the cookie banner or settings panel on the site, and you can delete or block cookies in your browser settings. If strictly necessary cookies are blocked, the portals may not work properly. Detailed lists and durations are published in the Cookie Policy.

​

7. SHARING PERSONAL DATA

​

7.1 General principle We do not sell your personal data. Your data is transferred only for the purposes in Section 5, to the recipient groups below, and only to the extent necessary. We enter into confidentiality and data processing agreements with all of our service providers.

​

7.2 Sharing between buyer and manufacturer When a buyer creates an RFQ, the request is sent to matched manufacturers. That transfer includes the part or 3D model and technical drawings, material and process requirements, quantity, lead time, delivery country and city, and any quality or certification expectations. The buyer's name, email address, phone number, full address, tax details and internal notes are not shared unless the buyer explicitly chooses to share them. When an order is placed between a buyer and a manufacturer, identity, contact and delivery details are disclosed to the other party to the extent required to fulfil the order; this sharing is necessary for performance of the contract. You may request that access to your files be subject to a non disclosure agreement (NDA); on request, sensitive technical files are not shared until the manufacturer has signed a confidentiality undertaking.

​

7.3 Service providers

 

• Cloud application and database infrastructure (Base44): portal hosting, authentication, database and file storage. Data transferred: all portal data.

• Cloud hosting and deployment (Railway): pricing and analysis service, application runtime. Data transferred: uploaded CAD files and calculation parameters.

• Content management and site hosting (Wix): the shapelid.com site, forms and content. Data transferred: site visit and form data.

• Payment institutions (PayTR and similar authorised payment institutions): payment acceptance, card storage on their own infrastructure, and refunds. Data transferred: transaction amount, identity and contact details, invoice details.

• E-invoice and e-archive provider: statutory invoice issuance and delivery. Data transferred: invoice and tax details.

• Email and marketing infrastructure (Klaviyo): transactional email, verification and newsletters. Data transferred: name, email address and transaction status. • Carriers and logistics providers: domestic and international shipments, tracking. Data transferred: recipient name, address, phone and parcel details.

• Customs brokerage and export services: international shipment documentation. Data transferred: shipment and invoice details.

• AI model providers (Anthropic, OpenAI, Google and similar): text and file processing only where the user uses an agent or analysis feature. Data transferred: the content of that run. • Email, calendar and file infrastructure (Google Workspace and similar): corporate communication and operations. Data transferred: communication records.

• Error monitoring, logging and security services: outage and intrusion detection, auditing. Data transferred: technical log data.

• Accounting and financial advisory: statutory bookkeeping and filings. Data transferred: invoice, payment and tax details.

• Professional advisers (legal, audit): legal and financial advice. Data transferred: data limited to the matter at hand.

​

The current sub processor list and any changes are published on the Platform. Where the list changes materially, we notify you as described in Section 17. On AI providers specifically: your data is not sent to model providers unless you use an agent feature or request an analysis. If you connect your own API key (BYOK), that provider's own privacy terms also apply.

​

7.4 Other disclosures

 

• Competent public authorities: lawful requests from courts, prosecutors, tax authorities, the Personal Data Protection Board, law enforcement and other competent bodies. • Legal protection: lawyers, experts and mediators where necessary to establish, exercise or protect a right.

• Corporate transactions: in a merger, transfer, demerger or asset sale, data may be transferred to the acquirer under confidentiality obligations; this policy remains in force.

• Your explicit consent: any other sharing is carried out only with your separate explicit consent.

​

8. INTERNATIONAL TRANSFERS

​

Our technical infrastructure and some service providers may operate servers and operations outside Türkiye. Under Article 9 of the KVKK, transfers abroad are made on the basis of an adequacy decision of the Board or, absent an adequacy decision, appropriate safeguards such as the standard contractual clauses published by the Board or binding corporate rules. Where standard contractual clauses are signed, the agreement is notified to the Board after signature.

​

In exceptional cases where neither an adequacy decision nor appropriate safeguards exist, transfers may occur only within the exceptions set out in the law and, where required, with your explicit consent. You may withdraw consent given for such a transfer; if you do, we will tell you if the relevant service can no longer be provided.

​

If we establish a scope directed at individuals resident in the European Union, we will assess the appointment of an EU representative and the application of Standard Contractual Clauses for GDPR compliance, and this section will be updated once those arrangements are in place.

​

9. RETENTION AND DISPOSAL

​

We retain personal data for as long as the processing purpose requires and for the statutory periods set by applicable law. The principal periods are:

​

• Account and profile data: 12 months after the account ends (account recovery, disputes and legitimate interest).

• Business verification documents: 10 years from completion of verification (burden of proof, commercial law and disputes).

• RFQ, quote, order and production records: 10 years from the transaction (Turkish Commercial Code Art. 82, Tax Procedure Law and limitation periods).

• Invoice, payment and accounting records: 10 years from issue (Turkish Commercial Code Art. 82, Tax Procedure Law Art. 253 and e-invoicing rules).

• Bank, IBAN and payment instruction records: 10 years after the relationship ends (financial legislation).

• Shipping and customs documents: 10 years from the transaction (customs and commercial legislation).

• Support and complaint records: 3 years from closure (disputes and quality follow up). • Agent run records: 12 months (debugging and usage oversight).

• Security and access logs: 2 years (information security, auditing and Law No. 5651). • Newsletter and marketing consents: 1 year of proof records after withdrawal (proof of consent).

• Cookie preferences: 12 months (preference continuity).

• Uploaded CAD and technical files: during the relationship and 12 months after; if the user deletes them, they are permanently deleted within 30 days and removed from backups within 90 days.

​

At the end of the period, data is deleted, destroyed or anonymised. If deletion is impossible because of a legal obligation or an ongoing legal process, the data is retained only for that purpose with access restricted. You may submit a deletion request using the method in Section 13; data that cannot be deleted is removed from our systems within 90 days at the latest.

​

10. DATA SECURITY

We apply appropriate technical and organisational measures under Article 12 of the KVKK.

Technical measures: TLS and HTTPS encryption on all traffic; passwords stored as strong hashes; role and object based authorisation so that one workspace's CAD files, RFQs, quotes and order data cannot be seen by another workspace; private files served only through short lived signed links rather than public paths; file type, size and MIME validation with malware scanning; authentication, origin restriction, rate limiting and request validation on service to service calls; API keys and secrets held only in managed secret stores and never leaked to logs or the browser; access and transaction audit trails with anomalous access detection; regular backups and restore testing.

​

Organisational measures: access to data limited by job role; confidentiality and data processing agreements with service providers; confidentiality undertakings and awareness training for staff and contractors; an incident response and data breach notification procedure.

​

Data breach notification: where a personal data breach is identified, we notify affected individuals and the Personal Data Protection Board within the period required by law, in line with Board practice as soon as possible and within 72 hours, describing the nature of the breach, the categories of data affected and the measures taken and planned.

​

No system can provide absolute security. If you have a security concern, contact info@shapelid.com.

​

11. YOUR RIGHTS

​

Under Article 11 of the KVKK you have the right to: learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether it is used in line with that purpose; know the third parties to whom data is transferred domestically or abroad; request correction if data is incomplete or inaccurate; request deletion or destruction under Article 7 of the KVKK; request that correction, deletion and destruction be notified to third parties to whom the data was transferred; object to a result arising against you through analysis exclusively by automated systems; and request compensation for damage suffered as a result of unlawful processing.

​

You may also withdraw your explicit consent for processing at any time, unsubscribe from marketing with a single click, change your cookie preferences, and request a portable copy of your data.

​

If you are resident in the European Union, the GDPR also gives you the right to know the legal basis for processing, to restrict processing, to object, to data portability, and to lodge a complaint with a supervisory authority, meaning the data protection authority in your country. Your right to complain to the Personal Data Protection Board in Türkiye is reserved, but we ask you to contact us first.

​

12. AUTOMATED PROCESSING AND AI FEATURES

The pricing engine analyses the geometry of the model you upload and the parameters you select to produce an estimated price and a manufacturability result. The output is not a binding offer; the final price is set during the quotation stage.

​

Manufacturer matching applies weighted scoring based on capacity, technology, location and historical performance. You may object to a matching result and request human review.

Calibration runs in aggregate and anonymised form to improve price accuracy using real production outcomes; it does not produce decisions about any individual.

​

Agents: you may create your own AI agents on the Platform. Agent instructions and run records are stored in association with your account. Actions with consequences, such as price, supplier assignment, order status, payment or customer facing communication, require your explicit approval. Agent run records are kept for debugging and audit purposes; where these records are used for product development they are anonymised or your separate explicit consent is obtained.

​

13. HOW TO SUBMIT A REQUEST

You may submit requests under Article 13 of the KVKK: in writing by signed petition to 472 Street, Ankara by email signed with a secure electronic signature to info@shapelid.com; or from the email address registered in our systems to info@shapelid.com.

​

Your request must state your name, contact details and the subject of the request clearly. We may ask for additional information to verify your identity.

​

Requests are answered free of charge as soon as possible according to their nature and within 30 days at the latest. Where the request involves an additional cost, the fee in the tariff set by the Board may be charged. If a request is refused, the reasons are given in writing and you may complain to the Personal Data Protection Board.

​

Data controller contact person: Mertcan Yenidoğan

​

14. CHILDREN'S DATA

The Platform is a business to business service and is not directed at anyone under 18. We do not knowingly collect personal data from minors. If we become aware that such data has been processed, we delete it within a reasonable period. If you believe a child's data is on the Platform, contact info@shapelid.com.

​

15. THIRD PARTY LINKS AND INTEGRATIONS

​

The Platform links to third party services such as payment institutions, carriers, e-invoicing providers, cloud storage and AI providers. Those services' own privacy policies apply, and Shapelid is not responsible for their data processing practices. Shapelid transfers your data only to the extent the service requires and only to providers bound by contract. Where your business connects its own account (OAuth or API key), data sent to that service is subject to that provider's terms.

​

16. COMMERCIAL ELECTRONIC MESSAGES

​

Commercial messages such as newsletters, campaigns and product announcements are sent only with your consent, in line with Law No. 6563 and the Regulation on Commercial Communication and Commercial Electronic Messages. You can withdraw consent with a single action using the link in each message or from your account settings. Transactional notifications such as orders, quotes, invoices, production and security notices are necessary for performance of the service and are independent of consent.

​

17. CHANGES TO THIS POLICY

​

We may update this policy due to changes in legislation, new features or changes in our data processing practices. The current version is always published on the Platform with a version number and last updated date.

​

For changes that materially affect the purpose, scope or transfer conditions of processing, we notify you before the effective date by email to your registered address or through an in Platform notification. Where required, we also obtain your separate explicit consent to the change.

​

18. EFFECTIVE DATE

​

This policy takes effect on the effective date stated above across all three properties (shapelid.com, app.shapelid.com, partner.shapelid.com) and replaces all previous privacy statements.

​

Version 1.0 - 06.11.2026 - First publication; single policy for all three properties.