# Privacy Policy
**Last updated: 24 July 2026**
This Privacy Policy explains how CBM3 collects, uses, stores, discloses and protects personal data when you visit cbm3.net or use the CBM3 calculators, 3D loading tools, account features, saved plans, public shares and related services (collectively, the “Service”).
## 1. Data Controller
CBM3 is operated by **Hasan Fatih Duyar**, trading under the brand **CBM3**.
– Brand: CBM3
– Legal name: Hasan Fatih Duyar
– Country: Turkiye
– Email: admin@cbm3.net
For the processing described in this policy, CBM3 is generally the data controller. A third-party provider may be an independent controller for its own service, such as Google authentication or a historical Paddle transaction.
## 2. Scope
This policy applies when you:
– visit or interact with cbm3.net;
– use the calculator, 3D planner, import, export, PDF, quotation or sharing features;
– use CBM3 as a guest;
– register or sign in with email or Google;
– save plans to an account, use a dashboard or participate in a workspace;
– create or open a plan code or public share;
– contact CBM3; or
– ask about a historical purchase, invoice or refund.
It does not replace the privacy notice of an independent third-party website or service.
## 3. Data We Collect
### 3.1 Account and contact data
Depending on how you use the Service, this may include:
– name, display name and email address;
– WordPress account identifier and account status;
– authentication-provider identifier;
– profile image URL, if supplied by the authentication provider;
– support messages and other communications; and
– security information associated with sign-in, password reset and account activity.
CBM3 does not receive your Google password. Google Sign-In supplies a signed credential that may contain your Google account identifier, name, email address and profile picture. CBM3 validates that credential and manages the CBM3 session separately.
### 3.2 Cargo, calculation and project data
This may include:
– product or item names, dimensions, quantities and weights;
– packaging, pallet, container, vehicle, load-space and equipment selections;
– cargo rules, loading notes, stop order, restrictions and scenario choices;
– costs, currencies, quotation fields and operational notes;
– imported files and exported results;
– calculated outputs, 3D placements, reports and saved plans; and
– project, customer, tag, workspace and sharing information you choose to provide.
Cargo planning generally does not require personal data. Do not enter personal, special-category, confidential or security-sensitive information unless it is necessary and you are authorized to do so.
### 3.3 Guest and browser-local data
Guest calculations, local save codes, history, templates, interface settings and similar records may be stored in your browser using local storage or related browser technologies. This information ordinarily remains on that browser and is not linked to a CBM3 account.
Browser-local information may be deleted by you, your browser, private-browsing settings, storage limits, device management or browser cleanup. CBM3 cannot restore a browser-local record that was never saved to an account or transmitted through a server-based feature.
If you deliberately create a public share, the plan data needed for that share may be transmitted to and stored on CBM3 systems even while you are signed out.
### 3.4 Public share and plan-code data
Public share URLs and public plan codes may be opened without authentication. The shared record may include cargo and project information selected for the share. Anyone with the URL or code may be able to access it.
Do not place personal or confidential information in a public share. CBM3 may record creation, access, abuse-prevention and technical log information associated with a share.
### 3.5 Technical, usage and security data
This may include:
– IP address and approximate location derived from it;
– browser, device, operating system and language;
– referring page, requested URL and timestamps;
– pages viewed, feature interactions and consent choices;
– session, authentication and anti-abuse events;
– network, performance, error and diagnostic information; and
– server, firewall, security and audit logs.
### 3.6 Cookie and consent data
CBM3 may store your privacy choices, consent categories, consent version and related timestamps in a first-party cookie or local storage so the site can respect your selection.
The available categories may include Necessary, Preferences, Analytics and Advertising. Necessary technologies support security and core operation and cannot always be disabled through the preference panel.
### 3.7 Historical transaction data
CBM3 does not currently require payment for its normal end-user features. However, historical purchase records may still include:
– order, transaction, invoice or subscription identifier;
– transaction status and date;
– product or entitlement information;
– billing country, currency, tax or VAT information; and
– limited support, refund, dispute or fraud-prevention metadata.
Full payment-card details are normally processed by the payment provider, not stored by CBM3. Where Paddle processed a transaction, Paddle may act as the seller or Merchant of Record and an independent controller under its own notices.
## 4. How and Why We Use Data
CBM3 may process personal data to:
– provide calculations, simulations, imports, exports, reports and shares you request;
– create and secure accounts and authenticate users;
– maintain account-linked cloud plans, dashboards, workspaces and project ownership;
– provide public sharing or code-based access at your request;
– remember interface and privacy preferences;
– respond to support, privacy and legal requests;
– operate, troubleshoot, secure and improve the Service;
– detect abuse, fraud, malware, unauthorized access and technical failures;
– understand aggregate usage and performance where permitted;
– maintain historical transaction, accounting and support records;
– send essential service, security or account communications; and
– comply with legal obligations and establish, exercise or defend legal claims.
CBM3 may produce aggregated or de-identified statistics that do not reasonably identify a person or reveal an identifiable user’s cargo plan.
## 5. Legal Bases
Where a legal basis is required, CBM3 relies on one or more of the following:
– **Contract or steps at your request:** to provide the Service, account, saved plan, share or support you request.
– **Legitimate interests:** to operate, secure, troubleshoot and improve the Service, prevent abuse, maintain records and communicate about the Service, balanced against your rights.
– **Consent:** for non-essential cookies, analytics, advertising, optional personalization or communications where consent is required.
– **Legal obligation:** for tax, accounting, regulatory, court, law-enforcement or data-protection duties.
– **Legal claims and vital interests:** where processing is necessary to protect users, systems or rights in circumstances recognized by applicable law.
If processing is based on consent, you may withdraw that consent at any time through the site’s Privacy Settings control or by contacting CBM3. Withdrawal does not affect processing that was lawful before withdrawal.
## 6. Cookies, Local Storage and Google Consent Mode
CBM3 uses a privacy preference manager to record category choices and send consent signals to consent-aware services. You can reopen the controls through the site’s **Privacy Settings** button.
Where Google tags are enabled, CBM3 may use Google Consent Mode v2. In Advanced Consent Mode, Google tags can load with storage consent set to denied. While consent is denied, consent-aware Google tags may send limited measurements without setting analytics or advertising cookies. If you grant the relevant category, the tags may use cookies and send fuller measurement data. Your selection can be changed later.
Depending on configuration and consent, Google measurements may include technical information such as consent status, timestamp, user agent, referrer, page URL, approximate location derived from IP and event information. Analytics and advertising are not necessary to perform a CBM calculation.
Blocking or clearing technologies through the browser may remove saved preferences and browser-local calculations. Essential authentication, security and local calculation functions may require first-party storage.
## 7. Analytics and Advertising
Where enabled and lawfully permitted, CBM3 may use Google Analytics, Google Tag Manager, Google Ads or Google AdSense to measure site performance, understand use, protect advertising systems or fund the free Service.
CBM3 does not sell personal data for money. However, analytics or advertising providers may process online identifiers and usage data for measurement, fraud prevention, ad delivery or personalization when enabled and permitted by your choices and applicable law. You can use Privacy Settings to withdraw optional consent.
If CBM3 serves advertising in a region that requires a certified consent management platform or a particular consent framework, CBM3 will use the required solution before enabling the affected advertising use. The presence of a Google tag does not by itself mean that personalized advertising is active for every visitor.
## 8. Google Sign-In
CBM3 may offer Google Sign-In, a Google-rendered sign-in button or Google One Tap. When you choose to continue, Google may share a signed credential containing your account identifier, name, email and profile picture so CBM3 can create or open your account.
Google and CBM3 manage their own sessions separately. Signing out of one does not necessarily sign you out of the other. Google processes information under its own terms and privacy notice.
## 9. Recipients of Personal Data
CBM3 discloses personal data only as reasonably necessary, including to:
– hosting, infrastructure, storage, content-delivery and security providers;
– WordPress and technical service providers used to operate the site;
– Google for authentication and, where enabled and permitted, analytics, tag management or advertising;
– email, support and communications providers;
– professional advisers, auditors, insurers and authorities where legally necessary;
– Paddle or another payment provider for historical transaction support, refund, tax, fraud or legal duties; and
– a buyer, successor or adviser involved in a proposed or completed business reorganization, subject to appropriate confidentiality and legal safeguards.
Service providers are permitted to process data only for the relevant service or under their own disclosed legal responsibilities.
## 10. International Transfers
CBM3 is operated from Turkiye and uses providers that may process data in other countries. Those countries may have different data-protection laws.
Where required, transfers will rely on an applicable legal mechanism, such as an adequacy decision, standard contractual clauses, contractual safeguards, explicit consent or another lawful transfer basis. Providers may also be subject to lawful access requests in the countries where they operate.
## 11. Retention
CBM3 keeps personal data only for as long as needed for the purpose for which it was collected, taking account of account status, user instructions, security, backup cycles, dispute periods and legal, tax or accounting obligations.
The following criteria apply:
– browser-local guest records remain until you or the browser deletes them;
– account data and cloud plans remain while the account or record is active and are deleted or de-identified after a valid deletion request or account closure, subject to backup cycles and lawful exceptions;
– public shares and server-based plan records remain until deleted, expired, removed for inactivity or abuse, or no longer required to provide the feature;
– security, authentication and technical logs are retained for a limited period proportionate to troubleshooting, fraud prevention and legal-claim needs;
– support communications remain while the matter is active and for a reasonable follow-up or legal period; and
– historical billing, tax, invoice, refund and dispute records remain for the period required by applicable law and the relevant Merchant of Record.
CBM3 may retain a minimal record where necessary to document a deletion request, prevent fraud, enforce a restriction or comply with law. Backup copies are deleted as they age out under the relevant backup schedule.
## 12. Security
CBM3 uses reasonable technical and organizational safeguards designed to protect personal data, including access controls, authentication checks, ownership checks, input validation, rate limiting, transport security, logging and backups where appropriate.
No internet or storage system is completely secure. You are responsible for protecting your account credentials, devices, public links and save codes. Contact admin@cbm3.net if you believe an account or shared record has been compromised.
## 13. Your Rights
Depending on applicable law, you may have the right to:
– learn whether CBM3 processes your personal data and obtain information about that processing;
– access a copy of your personal data;
– correct incomplete or inaccurate data;
– request deletion, destruction or anonymization;
– request restriction of processing;
– object to certain processing, including processing based on legitimate interests;
– receive portable data where the right applies;
– withdraw consent at any time;
– object to a result produced solely by automated processing where applicable;
– ask that correction or deletion be notified to recipients where required; and
– complain to a competent data-protection authority or seek another available remedy.
To exercise a right, email **admin@cbm3.net**. Describe your request and the account or email concerned. CBM3 may request proportionate information to verify identity and authority before acting.
Residents of Turkiye may also have the rights listed in Article 11 of Law No. 6698 on the Protection of Personal Data (KVKK). Individuals in the EEA or United Kingdom may have rights under the GDPR or UK GDPR. Other jurisdictions may provide additional rights, including rights concerning targeted advertising or certain disclosures.
## 14. Choices
You can:
– use many core functions without creating an account;
– avoid placing personal data in cargo fields;
– clear browser-local calculations through the Service or browser controls;
– choose whether to create a public share;
– use Privacy Settings to change optional consent categories;
– sign out or request account closure; and
– contact CBM3 about access, correction or deletion.
Some security, account and requested-service processing is necessary to provide the feature and cannot be disabled while that feature is used.
## 15. Children’s Privacy
The Service is intended for adults and business users. CBM3 does not knowingly collect personal data from anyone under 18. If you believe a child has provided personal data, contact admin@cbm3.net so appropriate action can be taken.
## 16. Automated Decisions
CBM3’s calculators and planning engines generate automated mathematical and placement outputs from the inputs and rules you provide. These outputs support cargo-planning decisions but do not make legal or similarly significant decisions about individuals.
## 17. Third-Party Links
The Service may link to third-party sites. Their privacy practices are governed by their own notices. Review those notices before sending personal data to them.
## 18. Changes to This Policy
CBM3 may update this Privacy Policy to reflect changes in the Service, providers, law or processing. The updated version will be posted with a new “Last updated” date. Material changes may also be communicated through the Service or by email where appropriate.
## 19. Contact and Complaints
Questions, requests and complaints may be sent to:
**CBM3 / Hasan Fatih Duyar**
Turkiye
Email: admin@cbm3.net
You may also complain to the competent data-protection authority in your jurisdiction. In Turkiye, the competent authority is the Personal Data Protection Authority (Kisisel Verileri Koruma Kurumu).