CEVIZ 3D VIEWER & CONVERTER PRIVACY POLICY AND PERSONAL DATA PROCESSING DISCLOSURE

Effective Date: 26 October 2026 Last Updated: 26 October 2026 Version: 1.3

1. IDENTITY OF THE DATA CONTROLLER

In the capacity of data controller under the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the EU General Data Protection Regulation ("GDPR"):

2. PURPOSE AND SCOPE

This Privacy Policy ("Policy") has been prepared to fulfil our disclosure obligations regarding personal data processed through the Ceviz 3D Viewer & Converter application ("Application") developed by Ceviz.

Ceviz 3D Viewer & Converter supports direct viewing and inspection of STL, OBJ, PLY, GLB and GLTF files, and conversion of STL, OBJ, PLY, GLB, GLTF, 3MF and DAE mesh files to STL. 3MF and DAE files are first converted to STL for viewing. The Application is accessible through a web browser, the App Store (iOS), and Google Play Store (Android).

This Policy applies in accordance with KVKK, GDPR, Turkish Electronic Commerce Regulation Law No. 6563, and related secondary legislation.

By using the Application, creating an account, or accessing the Application in guest mode, you acknowledge that you have read and understood the data processing activities described in this Policy. This acknowledgement does not replace the separate choices for optional Firebase Analytics or advertising consent.

3. DEFINITIONS

4. CATEGORIES OF PERSONAL DATA PROCESSED

Ceviz processes the following categories of data to deliver the Application's functionality:

4.1. Account and Identity Data (Registered Users)

• First name, last name
• E-mail address
• Password (cryptographically hashed by Firebase Authentication; Ceviz cannot access the plain-text form of your password)
• Google or Apple account identifier (when social sign-in is used)
• Profile photo (optional)

Username and Firebase user ID (UID), associated with account, quota and sharing operations.

4.2. Guest Session Data

Firebase Anonymous Authentication creates a user ID (UID); quota and operation records linked to that ID, and file data depending on the feature used, are processed.

Guest use does not require a name or e-mail address. However, a UID and SDK identifiers may constitute personal data; guest use is not necessarily anonymous or free of data collection. Closing the Application or returning to the sign-in screen does not automatically delete the guest account or server records. Sections 9 and 16 explain retention and deletion.

4.3. 3D File Data

• Mesh files opened on the device for viewing or uploaded for conversion/sharing (STL, OBJ, PLY, GLB, GLTF, 3MF, DAE)
• STL output files produced by conversion
• File name, size, format and upload date

Important: Files are processed for viewing, conversion and user-initiated sharing. Cloud operations transfer files to Google/Firebase infrastructure, and initiating a share gives the chosen recipient access. File contents are not used for classification or machine learning training outside these functions.

4.4. Sharing Data

Sharing processes sender and recipient user IDs/usernames, sender display name, file name, size, format, download link, sharing date and expiry date. Standard sharing periods are 1 day for Free, 3 days for Plus, 14 days for Pro and 90 days for Enterprise (see Section 9).

4.5. Subscription and Payment Data

• Subscription plan (Free, Plus, Pro, Enterprise) and status
• Subscription start and end dates
• Platform, product ID and transaction/subscription identifiers for purchase verification

Important: Payments are handled through Apple App Store and Google Play Store. Ceviz does not collect credit card numbers or bank account details; it processes transaction/subscription data supplied by the stores to verify entitlement and manage the plan.

4.6. Technical and Device Data

• Device model, operating system version, app version and browser information for web use
• IP address and App Check verification information for security and app integrity
• Data the AdMob advertising SDK may process: device identifiers (Android advertising ID/GAID, on iOS the advertising identifier/IDFA only when App Tracking Transparency permission is granted, and app- or developer-scoped identifiers), IP-derived approximate location, advertising impressions/interactions, crash and performance data
• When explicit consent is given for Firebase Analytics: app instance ID, an available advertising ID, automatic usage events and IP-derived approximate location

Ceviz uses Firebase Crashlytics on Android/iOS (Section 8). It processes crash stacks, app state, device/OS/build metadata and SDK installation/session IDs. On iOS, the advertising identifier (IDFA) may be used by AdMob if you allow tracking in Apple’s App Tracking Transparency (ATT) prompt; if you do not allow it, the IDFA is not used. AdMob diagnostics are separate from Crashlytics reports.

4.7. Notification Data

• Firebase Cloud Messaging (FCM) push notification token — stored to deliver conversion status and account update notifications

4.8. Usage Data

Viewing, conversion and sharing counters are linked to the account/UID for service delivery and quota management. Rewarded ads use the UID and advertising transaction records for server verification of the reward.

Firebase Analytics is off by default and requires explicit consent. After the first successful model load, a one-time screen asks everyone, including guests, with equal “Allow” / “Do not allow” choices. After an answer it is not asked again; Profile allows changes. If another screen or the background state prevents the question, its pending status is stored on the device and rechecked on a suitable viewer screen, on resume or at the next launch. The preference is restored without opening Profile. Declining does not remove features or change UMP/Crashlytics choices.

With consent, Firebase receives account/guest creation, successful model loads, conversion starts/completions/failures, successful AR launcher requests, rewarded-ad completion and subscription-screen visits, plus automatic SDK events. Parameters contain fixed categories such as sign-in method, format, operation, technical error category and entry source. File names/contents/paths, names, e-mail and UID are excluded from app event parameters. Ceviz does not send server purchase/subscription events in this release. Only the creation event for a new account in the current session is held in device memory and sent once after consent. Declining, signing out, switching accounts or closing the process discards that pending event. Other past events are not backfilled; already-submitted SDK requests cannot be recalled. Analytics measurement is not used for ad personalization.

5. PURPOSES AND LEGAL BASES FOR PROCESSING

This policy is an information notice. Explicit consent for Firebase Analytics, any consent required for advertising, and the legal basis for international transfer are assessed separately. Giving or withdrawing consent does not itself establish a legal safeguard for international transfers.

6. FILE SECURITY AND CONFIDENTIALITY

Ceviz applies the following principles to protect the security and confidentiality of uploaded 3D files:

6.1. File Isolation: Files are stored in user-specific Firebase Storage directories at users/{uid}/uploads/ and users/{uid}/conversions/. User-initiated shares are stored under shares/{senderUid}/{shareId}/, and recipients receive access through a download link. Firestore and Storage security rules control access; a shared download link grants access and should be kept confidential.

6.2. Encryption in Transit: All data traffic, including file uploads and downloads, is encrypted using TLS 1.2+ protocol.

6.3. Encryption at Rest: All files on Firebase Storage are encrypted at rest using AES-256.

6.4. Automatic Deletion: Conversion input deletion is attempted after successful completion. Outputs and shares are scheduled for cleanup after the periods in Section 9 expire. Deletion may fail or be delayed; an expiry time is not a guarantee that a file is erased at that exact second.

6.5. No Content Analysis: Ceviz does not analyse, scan, classify, or use uploaded files for machine learning model training for any purpose other than viewing and conversion.

Important — Medical and Industrial Files: Ceviz 3D Viewer & Converter is not a medical device and should not be used for medical diagnosis, treatment, or surgical planning purposes. Ceviz provides no guarantee regarding the accuracy or clinical suitability of files viewed or converted through the Application. The confidentiality and intellectual property rights of industrial CAD files are entirely the User's responsibility.

7. DEVICE PERMISSIONS

The Application requests the following device permissions to deliver its functionality:

Android SDKs may add android.permission.ACCESS_ADSERVICES_AD_ID, android.permission.ACCESS_ADSERVICES_ATTRIBUTION and android.permission.ACCESS_ADSERVICES_TOPICS to the merged application manifest for advertising identifier, attribution and advertising topics capabilities. These SDK permissions are separate from camera/notification prompts and the Analytics choice. A manifest permission alone does not establish that every related API is used; the final release permission list and SDK data flows must be verified before publication.

About AR Mode: Camera permission is only requested when the AR feature is used. Camera footage is not recorded, sent to any server, or processed. All AR processing takes place on-device.

8. DATA SECURITY MEASURES

Ceviz implements the following administrative and technical measures to ensure the security of personal data:

Technical Measures:

• Encryption in transit: All data traffic is encrypted using TLS 1.2+ protocol

• Encryption at rest: All data on Firebase Storage and Firestore is encrypted at rest using AES-256

• Firebase App Check: Play Integrity on Android and App Attest on iOS provide app/device integrity signals. Their use does not mean mandatory verification is enforced for every request.

• Firestore Security Rules and Storage Security Rules: Layered access control ensures each user can only access their own data

• Password security: Passwords are hashed by Firebase Authentication using the scrypt algorithm; Ceviz cannot access passwords in plain text

Firebase Crashlytics (Android/iOS): Reporting is on by default for service reliability. Ceviz selected legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6/1-f) as a business decision, not lawyer approval. Recipient: Google Firebase. Crash stacks, app state, device/OS/build and SDK installation/session IDs support diagnosis. Ceviz does not attach account IDs, e-mail or file names/paths; Dart messages are reduced to technical type and stack. Native reports bypass that filter; SDK IDs prevent a guarantee of anonymity. With Analytics enabled, SDK breadcrumbs may include permitted usage events.

Profile > “Crash reports” turns reporting off on this device independently of Analytics/UMP. The Dart gate closes after saving; native SDK opt-out applies at the next launch. Native reports may remain locally while disabled and be sent if re-enabled. Already-sent reports are not deleted. Retention is in Section 9.

Administrative Measures:

• Data access is regulated on a need-to-know basis
• A data breach response procedure has been established

9. DATA RETENTION PERIODS

Standard plan periods are listed above. Scheduled deletion can finish later because of technical errors, workload or cleanup delays. Account deletion does not automatically erase copies on a device or held by recipients.

10. TRANSFER OF PERSONAL DATA

10.1. Domestic Transfer

Authorized people within Ceviz may access data as needed for service delivery. A user-initiated share provides the selected recipient with the file and sharing information. Transfers to Google/Firebase and AdMob are explained in Sections 10.2 and 11; a statement that no data is transferred to third parties cannot cover these services.

10.2. International Transfer

Personal data may be transferred outside Türkiye through Google/Firebase infrastructure, consented Firebase Analytics and Google AdMob. Cloud Functions uses Frankfurt, Germany (europe-west3). Cloud Firestore and Firebase Storage data is also stored in Frankfurt, Germany (europe-west3); this does not mean every Google service runs in that region. Firebase Authentication processes data in the United States; FCM, App Check, Crashlytics, Analytics and AdMob may process data on Google global infrastructure, including in the United States.

Recipients are Google, for Firebase/Google Cloud services (authentication, profiles, files, notifications, integrity, diagnostics and consented analytics), and Google AdMob/UMP (advertising and consent management). International transfers are carried out under standard contracts pursuant to Article 9 of the KVKK and the providers’ data processing terms. Analytics and advertising consent does not replace international-transfer safeguards.

11. THIRD-PARTY SERVICE PROVIDERS

Google/Firebase services are used for the purposes below. Provider roles are determined by the data processing terms of each service.

Google privacy policy: Google

Firebase data processing terms: Firebase

11.1. Advertising Services (Free Plan)

The Free plan requires completing a rewarded AdMob ad for viewing, conversion and AR; watching is an operation condition, not an optional extra. Paid plans (Plus, Pro, Enterprise) have no ads. Ads are non-personalized (npa). If ads cannot be requested, limited compensation credits apply; exhaustion/connectivity may prevent operations.

AdMob may process device identifiers (GAID on Android and app/developer-scoped identifiers), device/app information, IP address and IP-derived approximate location, advertising views/interactions, and crash/performance data. Identifiers may still be used for frequency capping and aggregate reporting with non-personalized ads. Reward verification sends the Ceviz UID to Google as server verification information. These data are transferred to Google for ad delivery, reward verification, measurement and SDK diagnostics; Section 10.2 addresses international transfer conditions.

UMP updates consent at startup and shows Google’s form when required in EU/EEA, UK and Switzerland. It manages device-storage/identifier consent, not whether the Free plan displays ads. If Google’s canRequestAds() is false, no new ad is requested. Refusal does not necessarily mean false; update failure can rely on earlier valid information. On iOS, on first launch and before any ad is requested, a short Google explainer screen is followed by Apple’s ATT permission prompt (in the EU/EEA, UK and Switzerland, Google’s consent form is shown first). You can change your ATT choice at any time in iOS Settings > Privacy & Security > Tracking. Ads are shown regardless of the ATT choice and remain npa.

Profile > “Ad privacy options” appears when UMP requires it and allows changing/withdrawing choices. If eligibility becomes false, the next load is blocked. An ad loaded earlier can still be shown once; cached/in-flight ads are not immediately cancelled. Analytics and Crashlytics settings are independent.

11.2. Meta Advertising Measurement

Ceviz sends no personal data to Meta and has no Meta SDK/CAPI. On iOS, Apple SKAdNetwork delivers identifier-free installation/conversion postbacks to the ad network for aggregate reporting. The device updates a limited stage: install, first successful model load, first completed conversion or paid-plan transition. Apple timing/privacy thresholds may suppress detail. Android uses only a campaign tag (UTM) in the Play Store ad link; Play Store and consenting users’ Firebase can see it. No app-event feed or Android installs are sent back to Meta Ads Manager by this integration.

12. USER RESPONSIBILITIES

By using the Application, the User accepts the following obligations:

12.1. File Content Responsibility: The User represents and warrants that they own the intellectual property rights to the 3D files they upload or are authorised to upload such files. Liability arising from copyright infringement or unauthorised file upload rests exclusively with the User.

12.2. Industrial Confidentiality: If confidential or trade-secret CAD files are uploaded to the Application, maintaining the confidentiality of such files is the User's responsibility. Ceviz applies the security measures described in Section 6; however, Users should evaluate their own corporate confidentiality policies before uploading sensitive industrial data.

12.3. Medical File Disclaimer: Ceviz 3D Viewer & Converter is not a medical device. The User should not use the Application for medical diagnosis, treatment, or surgical planning purposes. For medical-purpose 3D model needs, the Ceviz App platform should be used.

12.4. Account Security: The User is obliged to keep their account password confidential, not share it with third parties, and immediately change their password in case of suspected unauthorised access.

12.5. Lawful Use: The User is exclusively responsible for the content and legality of files uploaded to the Application.

Legal liability arising from breach of these obligations rests exclusively with the User; Ceviz bears no responsibility.

13. CHILDREN'S PERSONAL DATA

The Application is not directed at children under 13, and persons under 13 should not create an account. In the EU/EEA, the digital age of consent of the relevant Member State applies. Users under 18 are deemed to use the Application with the knowledge and consent of their parent or guardian. If we become aware that data of a child under 13 has been processed, the account and data will be deleted; you may report such cases to info@cevizbiotech.com. Guest use may also involve the data described in Sections 4.2, 4.6 and 11.1.

14. DATA SUBJECT RIGHTS (KVKK ART. 11 AND GDPR)

Under KVKK Article 11 and GDPR, you have the following rights as a data subject:

1. To learn whether your personal data is being processed
2. To request information if your personal data has been processed
3. To learn the purpose of processing and whether data is being used in accordance with its purpose
4. To know the third parties to whom your personal data has been transferred, domestically or internationally
5. To request correction of your personal data if it has been processed incompletely or inaccurately
6. To request deletion or destruction of your personal data under the conditions set out in KVKK Article 7
7. To request that operations carried out under points (5) and (6) be notified to third parties to whom your personal data has been transferred
8. To object to the emergence of a result against you through the exclusive analysis of processed data by automated systems
9. To claim compensation for damages arising from the unlawful processing of your personal data

Additionally under GDPR:

1. Right to data portability — receiving your data in a structured format
2. Right to object
3. Right to restriction of processing
4. Right to lodge a complaint with a supervisory authority — for Türkiye: Personal Data Protection Authority (KVKK); for EU: the relevant national supervisory authority

How to Apply

You may exercise these rights through any of the following channels:

• E-mail: info@cevizbiotech.com (subject: "KVKK Data Subject Request")

• Written application: Çalca OSB Mahallesi, 1. Cadde, Tasarım Teknokent A.Ş. No:1 Unit 3, Merkez/Kütahya

• In-app: Profile > Edit profile > Delete my account

Your request will be responded to free of charge within 30 days at the latest.

15. DATA BREACH NOTIFICATION

In the event that your personal data is subject to a data breach such as unauthorised access, disclosure, alteration, loss, or destruction, Ceviz will:

• Notify the Personal Data Protection Board within 72 hours in accordance with KVKK Article 12/5
• Notify the competent supervisory authority within 72 hours in accordance with GDPR Article 33
• Where the breach poses a high risk to your rights and freedoms, inform you without delay via in-app notification and e-mail

16. ACCOUNT AND DATA DELETION

You have full control over your data:

16.1. In-App Account Deletion: Submit a request through Profile > Edit profile > Delete my account after completing the required verification and confirmation. The server initiates the operations below; successful completion is required. A network or server error may leave the operation partially completed, requiring another request or support:

1. User Storage uploads, conversion outputs, profile files and sent sharing files are deleted.
2. Firestore records for sent shares and corresponding recipient inbox records are removed.
3. Username reservation deletion is attempted; the user profile document and subcollections are deleted.
4. The Firebase Authentication account is deleted.
5. After a successful server call, the app session is closed.

16.2. Request via E-mail: If you cannot access the in-app deletion method, you can initiate the deletion process by sending a request to info@cevizbiotech.com. Your request will be processed within 7 days at the latest.

16.3. Provider Records and Backups: Account deletion does not include an immediate deletion command for Google Analytics/AdMob records or all provider backups. Google specifies up to 180 days for Firebase Authentication removal from live and backup systems; other services’ deletion and backup periods are subject to the respective provider’s policies. Account deletion does not erase copies downloaded to the user’s or recipient’s device.

16.4. Irreversibility: Account deletion is irreversible. Deleted files and conversion history cannot be recovered under any circumstances. We recommend downloading any files you need to your own device before initiating the process. Purchase and advertising transaction records are not removed immediately upon account deletion; they are deleted at the end of the period stated in Section 9 (up to 2 years).

17. COOKIES AND SIMILAR TECHNOLOGIES

Session/UID and App Check IDs support functionality/security; FCM tokens route notifications. AdMob may use Android GAID and app/developer IDs for npa ads/reporting; On iOS, the IDFA may be used by AdMob only when ATT permission is granted. Analytics IDs require separate opt-in. Crashlytics installation/session IDs support diagnosis with device opt-out. Consent/milestone preferences are stored locally. UMP manages storage/identifier consent; current Google eligibility gates the next ad load (Section 11.1). SKAdNetwork requires no user/device ID from Ceviz. Not all identifiers are anonymous or unrelated to advertising.

Web session storage is processed with Google/Firebase for authentication. Advertising/analytics scope depends on platform and choices; mobile SDK behavior does not imply the same SDKs run on web.

18. APP STORES

Ceviz 3D Viewer & Converter is distributed through Apple App Store and Google Play Store, and is also accessible via web browser at viewer.cevizbiotech.com. When you download the Application, the relevant store's privacy policy and terms of service also apply:

• Apple Privacy Policy: https://www.apple.com/legal/privacy/
• Google Play Privacy Policy: https://policies.google.com/privacy

Store account data are processed directly by Apple/Google. Ceviz does not access credit card or bank account details; it processes store-provided transaction/subscription identifiers and status information for subscription verification and plan management (Section 4.5).

19. CHANGES TO THIS POLICY

Ceviz may update this Policy from time to time. When material changes are made:

• The new version will be published in the Application and at cevizbiotech.com/privacy/viewer-en.html
• Users will be informed via in-app notice, push notification and/or e-mail
• If new consent-based processing is added, your consent will be obtained separately before that processing begins

It is the User's responsibility to follow the current version of the Policy.

20. GOVERNING LAW AND JURISDICTION

The interpretation and application of this Policy shall be governed by the laws of the Republic of Türkiye. The Courts and Enforcement Offices of Kütahya shall have jurisdiction over any disputes arising hereunder. Data subjects residing in the EU reserve their right to lodge a complaint with the supervisory authority of their member state.

21. CONTACT

For any questions, requests, and complaints regarding this Policy or your personal data:

Ceviz Biyoteknoloji A.Ş. Çalca OSB Mahallesi, 1. Cadde, Tasarım Teknokent A.Ş. No:1 Unit 3, Merkez/Kütahya, Türkiye E-mail: info@cevizbiotech.com

Version 1.3 of this Policy took effect on 26 October 2026.

© 2026 Ceviz Biyoteknoloji A.Ş. — All rights reserved.

This page has been prepared to fulfil our disclosure obligations under the Turkish Personal Data Protection Law No. 6698 and the EU General Data Protection Regulation.

by Ozyurt