Who holds this data
FabSync is operated by Okan Kurt. The data controller, in the sense of Turkish data protection law (KVKK) and the GDPR, is:
- Okan Kurt
- Çınar Mah. Rıfkı Tongsir Cad., Nidapark Küçükyalı Sitesi, Burgaz Etabı, Blok 3 Daire 78, Maltepe / İstanbul, Türkiye
- support@getfabsync.com
What we collect
When you open an account: your e-mail address. We keep no password — you sign in through a one-time link sent to your e-mail.
While you work: the files you upload to your project (STEP/CAD files, drawing PDFs), the 3D models and images generated from them, part lists, supplier names and e-mail addresses, the quotes suppliers send, and the notes and photos that come from the shop floor.
Automatically: who downloaded which file and when, who revoked which link, who changed which status — the audit trail. Plus request counters, to keep the service from being abused.
We collect no payment details. Your card never reaches us; payment happens at Lemon Squeezy.
What we use it for
To read the files you upload and pull out the part list, the 3D views and the information on the drawings. To generate supplier links, collect quotes and pass shop-floor reports to you. To run your account and sort out problems.
There is no other purpose. We show no ads, sell no data and build no profiles.
The AI side — plainly
Drawings and the 3D images of parts are sent to an AI provider to be read. The STEP/CAD files themselves are not sent — only the images generated from them and the drawing PDF.
- Google (Gemini API, paid tier). Google's terms state that on paid use the content you send and the responses are not used to improve Google's products. Google logs them only briefly, for abuse detection and legal obligations.
So your drawings are not used to train AI models.
So that the same file is not processed twice, we cache the AI responses together with a digest of the file in our own database. When your account is deleted, that cache goes with it.
Where it sits, and for how long
Files are on Cloudflare R2, the database is on Neon (Frankfurt), the application runs on Vercel. Vercel's edge servers are in Frankfurt; in some cases the processing functions can run in a region in the United States. That is a transfer of data abroad, and you accept it when you open an account.
No file is served from a public address. Files are reached through short-lived signed links.
| What | How long |
|---|---|
| Your project files | As long as your account is open |
| If your paid subscription ends | Warning e-mail on day 76; on day 90 the files of every project except the one you used most recently are deleted (details below) |
| If you delete a project | It waits 30 days in the trash — you can restore it in that window; after that it is deleted with its files |
| If you delete your account | Deleted at once — files, database records and the AI cache included |
| Audit trail | Shown for 30 days / 1 year / indefinitely, depending on your plan; the records are not deleted automatically |
| Database backups | 14 days |
Deleting means deleting. We do not mark a record “deleted” and keep it.
When a paid subscription (Pro or Team) ends, your account goes back to the Free plan. 76 days after it ends we send the account owner a warning e-mail naming the projects whose files will be deleted and the exact date. 90 days after it ends — and at least 14 days after that warning — the project you used most recently stays exactly as it is; every other project is archived and its files (STEP, drawings, images, stamped copies, cut outputs, field photos) are permanently deleted and cannot be restored. Your project records (parts, packages, quotes, history) are not deleted in this step. If you subscribe again before day 90, the deletion is cancelled. The 14-day trial, when it ends without a payment, is not covered by this rule.
History (audit-trail) records are not deleted automatically; but deleting a project or a package deletes its records, and closing the account deletes all of them.
Who we share it with
The providers we need to run the service — every one of them is listed, country included, on the subprocessor page. Nobody else. If we are ever legally required to hand something over, we will tell you, unless we are forbidden to.
Your rights
Under Article 11 of the KVKK and under the GDPR you can find out what data of yours is processed, have it corrected or deleted, learn where it has been transferred, and object to the processing. You can do most of this yourself by deleting your account in the settings; for the rest, write to support@getfabsync.com.
If this changes
If we change this text we update the date; if the change is substantial we tell you by e-mail.