MATERIALHAUS Privacy Rev. 12.10.2026
What is stored, where, and who else sees it.
Last updated 28 October 2026. This describes the MATERIALHAUS service at materialhaus.com as it runs today, not an intention.
Who is responsible
MATERIALHAUS is run by Serdar Aydın, an individual based in Türkiye, who decides what is collected and why (the data controller). For anything on this page, write to support@materialhaus.com
The short version
No analytics, no advertising and no tracking of any kind, and nothing is sold. What we hold is what it takes to run your account and your materials. Every cookie here is needed for something you asked for, which is why there is no cookie banner.
What is stored with your account
| What | Where | Why |
|---|---|---|
| Email address | Supabase | Your sign-in, and where account emails are sent. |
| Password | Supabase | Kept only as a hash by Supabase's sign-in service; nobody at MATERIALHAUS can read it. There is none if you sign in with Google. |
| Name and profile | Supabase | Your name, which sign-up asks for, and optionally your company, discipline and the addresses receipts should go to. |
| Google account | Supabase | Only if you sign in with Google: the name, email address and profile picture link Google shares, and that the account is linked to Google. |
| Email preference | Supabase | Whether you agreed to receive announcements. Off unless you tick it on your account page. |
| Materials and projects | Supabase | The materials you save, the projects they sit in, and your favourites and collections. |
| Uploaded images | Supabase Storage | Private to you, kept with the material they produced so it can be reopened and exported again. Up to 4 MB each. |
| Generated files | Supabase Storage | Private to you: maps, patterns and packages, downloaded through links that stop working after five minutes. |
| Generation jobs | Supabase | The state of each job and where its output is, so the daily allowance can be counted. |
| Manufacturer submissions | Supabase | Only if you submit products: company and product details, one image and one PDF per product, and the review note. |
| Account status | Supabase | When the account was created and last signed in, and whether it is confirmed or suspended. The MATERIALHAUS team sees this in its admin panel. |
| Where and how you use it | Supabase | When you use the site or a plug-in while signed in: the country, region and city our host derives from your IP address (the address itself is not stored), your interface language, whether you used the website or which plug-in, when you were first and last seen and how many sessions, and — once — the site or campaign tag (utm_) that first brought you and the first page you opened. It shows the team where members are and which channels and plug-ins they use. The MATERIALHAUS team sees it in its admin panel; it is part of your data download and is deleted with your account. |
| Signed-in devices | Supabase | An account is open on at most three devices. For each plug-in sign-in we keep which plug-in it was, when it signed in and when it was last used (to the hour), so that a fourth sign-in can sign out the device used longest ago. Browser sign-ins are Supabase sessions. A plug-in that signs out, or “Disconnect plug-ins” on the account page, ends its record; all of it is deleted with the account. |
| Team actions | Supabase | Every change the team makes to an account is logged permanently, with the email address of the account it concerned. |
| Subscription | Supabase | If you buy Pro or Team: the plan, its status, the billing period and its end, and Paddle's ids for the subscription, the customer and the price. Never a card number or a billing address. If you buy Team, also the seat count and the email addresses you give seats to, with when each was added; a colleague whose address you remove loses the seat and the address is deleted. A colleague with a seat sees your email address as the Team's owner. |
What stays on your device
| What | Name | Why, and for how long |
|---|---|---|
| Session | sb-…-auth-token | Cookie that keeps you signed in, until you sign out and for at most 400 days. |
| Confirmation | sb-…-code-verifier | Cookie used only while you confirm a sign-up, a change of email address or a password reset. |
| Google sign-in | materialhaus_google_nonce | Cookie set only when you sign in with Google. It protects that sign-in and expires after ten minutes. |
| Language | materialhaus_locale | Cookie holding your language, for one year. |
| Preferences | localStorage | Light or dark theme, drawing unit and the last project you opened. |
| First visit | localStorage | The site that linked to us, any utm_ tags and the first page, kept in this browser from your first visit and sent once, after you sign in. |
| Editor drafts | IndexedDB | Unsaved work in the editor, including an image you added to it. It stays in this browser; we keep nothing of it until you save. |
Who processes it for us
| Company | Where | What for |
|---|---|---|
| Supabase | EU · Ireland | Accounts, database and file storage. |
| Vercel | Dublin | Serves the site and runs its server functions; pages are delivered from its worldwide network. |
| Render | Frankfurt | Generates materials. |
| Resend | — | Sends account and service emails. |
| — | Only if you choose to sign in with Google. Its sign-in script loads on the sign-in screen and nowhere else. | |
| Poly Haven | — | The scanned catalogue. Your browser loads its thumbnails and scan files straight from Poly Haven, which sees your IP address as any website would; our server only says which files to load. |
| Cloudflare | — | Runs the domain name, and forwards mail sent to support@materialhaus.com. It also counts visits without cookies (Cloudflare Web Analytics): the page, the site you came from, your country, browser and device type, and load times. Nothing is stored on your device and no profile of you is made. |
| Paddle | United Kingdom | Our reseller and merchant of record (Paddle.com Market Limited): takes the payment, issues the invoice, collects the tax and makes refunds. Your card and billing details go to Paddle, never to us. Its checkout script loads only when you press a buy button on the pricing page. |
Several of these companies are based in the United States, so your data may be processed outside Türkiye and the European Union. Each is given only what the service needs.
What happens to your image
The live preview in the editor sends your image to the generation server, which works on it in memory and keeps nothing. When you generate, the source image is saved in your private workspace; the server fetches it from there, builds the package in a temporary folder that is deleted afterwards, and puts the result back in your workspace. No image is sent to an AI or image-generation service.
Like any web service, Vercel and Render keep request logs — IP address, time and the address requested — to run the service and keep it secure. The generation server also holds visitors' IP addresses briefly in memory, to rate-limit previews.
Emails
- The link that confirms your sign-up or a change of email address.
- A password-reset link, only when you ask for one.
- Service notices that concern every account, such as a change to these pages or an outage.
- Announcements about new features, only if you ticked the box on your account page. Each one carries a one-click unsubscribe link.
- If you submitted products as a manufacturer, the review decision.
All of them are sent through Resend.
Payments
Pro is sold by Paddle, our reseller and merchant of record. The card, billing address and email you enter in the checkout go to Paddle and never reach us. After a purchase Paddle tells us which account bought which plan, and the subscription's status and period; that is the “Subscription” row in the table above. Paddle handles its own data under its own privacy notice. paddle.com/legal/privacy
How long it is kept
Your account and everything in it are kept while the account exists. There is no automatic clean-up of old uploads or generated files. You can select materials in your library and delete them: each one's maps, packages and every version go; the source images you uploaded stay. You can delete the account yourself from your account page: its files go first, then the account and all its records.
One thing survives: the team's log of account changes keeps the email address of an account it acted on. That log cannot be edited or deleted — it is how we can show what was done, and when.
Your rights
On your account page you can change your name, profile, email address and password, turn announcements off, download a copy of your data and delete your account; every announcement also carries an unsubscribe link. The copy is one JSON file: your account, projects, materials, generations and the list of your stored files. The files themselves are downloaded from your library.
Depending on where you live — under Türkiye's personal data law (KVKK) or the EU's GDPR, for example — you can also ask what we hold about you, have it corrected, object to its use, and complain to your data protection authority.
What is not built yet
Automatic clean-up of old uploads, and a single download of every stored file. Until they exist, write to support@materialhaus.com