Last updated: 20.09.2026

1. Data Controller

The data controller is Santral Mimarlık Mob. Tas. İnş. Tic. Ltd. Şti. (“ARCHBOX”), address: İstasyon Mah. Hatboyu Cad. No: 99, Tuzla / İstanbul, Türkiye, MERSİS (Turkish central registry) no: 0744046539900012, tax no: 7440465399 (Tuzla), email: info@archbox.app. This policy explains how personal data is processed when you use the ARCHBOX service (https://archbox.app).

2. Data We Process

Account data: name and email address.

Sign-in method: you can sign in with email/password or with “Sign in with Google”. With Google sign-in we receive from Google only what is needed to create and recognize your account (email address, name and Google user ID); your password is never shared with us.

Usage data: session records, projects you create, credit transactions and error logs.

Content: images you upload and designs you generate.

Technical data: IP address, browser and device information, approximate location (country level) and diagnostic logs.

Support communications: emails and support messages you send us.

Payment data: payments are processed through Paddle.com Market Ltd (“Paddle”). ARCHBOX never stores or processes any card number on its servers; all financial transactions take place directly on Paddle’s servers (the Paddle checkout window), and Paddle processes this data as the Merchant of Record and an independent controller. We only receive payment summary information such as the transaction ID, amount and invoice status.

3. Purposes and Legal Bases

Account data → creating and managing your account, providing the service. Legal basis: performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c).

Usage data and content → generating images/videos, storing your projects, keeping your credit balance, improving the service. Legal basis: performance of a contract; legitimate interests for improvement (GDPR Art. 6(1)(f); KVKK Art. 5/2-f).

Technical data → security, fraud and abuse prevention, troubleshooting, language and currency selection. Legal basis: legitimate interests (keeping the service secure and working correctly).

Support communications → answering and keeping a record of your requests. Legal basis: performance of a contract and legitimate interests.

Invoice and transaction records → obligations under tax and commercial law. Legal basis: legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5/2-ç).

Marketing emails → sent only with your consent (GDPR Art. 6(1)(a); KVKK Art. 5/1). You can withdraw consent at any time via the link in every email or by contacting us.

4. Service Providers & International Transfers

To provide the service, your data may be shared with the providers below. Some are located outside your country, so your data may be transferred internationally:

• Google (Firebase — authentication, database and file storage; Gemini — image-processing AI),

• Fal.ai and Meshy (image/3D generation AI — uploaded images are sent for processing),

• Paddle (merchant of record — sale of the service, subscription management, payments, tax and invoicing),

• Resend (transactional email),

• our legal, accounting and audit advisers (only to the extent necessary),

• public authorities where required by law or to protect rights and safety.

AI providers receive only what is needed to fulfil your request: the image you upload, your prompt and the generation settings. Your name, email address and account details are not sent to them.

Most of these providers are based in the United States. International transfers are made in line with KVKK Art. 9 and, where applicable, Chapter V of the GDPR, relying on data processing agreements with each provider and safeguards such as the EU Standard Contractual Clauses (SCCs) or adequacy decisions.

No model training: ARCHBOX does not use your uploaded images, prompts or generated outputs to train or improve AI models. Our AI providers process your content under commercial API agreements and solely to fulfil your request. Your projects stay confidential.

5. Retention

Your personal data is retained while your account is active and for any applicable legal retention periods. When you delete your account, or when storage trial/subscription terms expire, your cloud data is deleted under the relevant policies.

Images you upload, outputs you generate and your projects are permanently deleted when you delete your account or when your storage period ends; no anonymization is applied to this content. Only aggregate usage statistics that cannot be linked to you (for example the total number of generations per month) may be retained. Invoice and transaction records are kept for the period required by law (as a rule 10 years in Türkiye). Technical logs are deleted automatically after no more than 12 months.

6. Security

We apply reasonable technical and organizational measures — including encrypted connections and access controls — to prevent unauthorized access to data.

7. Your Rights

Under the GDPR (where it applies to you, Art. 15-22) and Türkiye’s data protection law (KVKK Art. 11), you have the right to access, rectify, erase, restrict the processing of, port and object to the processing of your personal data, and to withdraw any consent you have given. To exercise these rights, contact info@archbox.app.

We respond free of charge within 30 days (one month under the GDPR, extendable where the law allows). We may ask for information needed to verify that a request comes from you. You also have the right to lodge a complaint with the Turkish Personal Data Protection Board (KVKK) or, under the GDPR, with the data protection authority of your country of residence.

7A. Children

The service is not directed at persons under 18, and under our Terms of Service you must be at least 18 to open an account. If we learn that we have processed a child’s personal data without appropriate authorization, we will delete it.

8. Cookies

We use only cookies strictly necessary for the service to function: a session cookie and a language-preference cookie (“LOCALE”). We do not use marketing or third-party tracking cookies.

9. Changes & Contact

This policy may be updated from time to time; the current version is always published on this page. For questions, contact info@archbox.app.