Last updated: 13 October 2026
1. Who is responsible
The data controller is Marine Interior Hub. This policy is our information notice under the Turkish Personal Data Protection Law No. 6698 (KVKK) and, for members in the European Economic Area and the United Kingdom, the General Data Protection Regulation (GDPR). For any privacy question or request, write to info@marineinteriorhub.com.
2. What we process
- Account data: email address, password (stored only as a secure hash by our authentication provider), sign-in times, and the date and version of the Terms you accepted.
- Professional profile: name, job title, company, country, commercial role, profile photograph, sectors and interests, and your visibility and contact preferences.
- Networking activity: connections, introduction and meeting requests, messages, follows, saved opportunities and notes, event attendance, meeting times you offer or book, blocks and reports.
- Community content: posts, photographs, comments, likes and saved posts.
- Company representation: requests to represent a company and the information you give to support them; for approved representatives, the company description, images, catalogues and project references you publish.
- Payments: if you buy a plan, your plan, its status and renewal date, and the identifiers our payment partner gives us. We never receive or store card numbers.
- Product and technical data: in-app events such as opening Radar or sending a request, used to understand which features work; problem reports and feedback you send; and technical logs (such as IP address and browser type) kept by our hosting provider for security.
- Mobile app: if you turn on notifications, a push token that lets us send notifications to your device, and the device platform (iOS or Android); it is deleted when you sign out or delete your account. The camera is used only while you scan a QR code or take a photograph you choose to upload; we do not store camera images other than the photographs you upload. The app does not access your location or contacts.
- Public business information: the company directory, events and news are compiled from public sources, such as company websites, exhibitor lists and trade press. It can include the names and roles of people publicly associated with a company.
3. Why we process it, and on what legal basis
- To provide the service you signed up for: your account, profile, discovery, Radar matches, messaging, events, meetings and company pages. Legal basis: performance of our contract with you (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).
- To keep the platform safe: preventing spam, abuse and fraud, handling reports and enforcing the Terms. Legal basis: our legitimate interests (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
- To improve the product, using the in-app events and feedback described above. Legal basis: our legitimate interests. These events are not used for advertising and are not shared with advertisers.
- To run the public directory of companies, events and news, and to show what is publicly known about a company. Legal basis: our legitimate interest in providing an industry directory, based on information that is already public (KVKK Art. 5(2)(d) and (f); GDPR Art. 6(1)(f)).
- To bill paid plans and meet legal obligations, such as tax and accounting records and requests from authorities. Legal basis: contract and legal obligation (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)).
- To send service emails, such as account confirmation, password reset and notices about your requests. These are part of the service. We do not send marketing emails without asking you first.
4. What other people can see
Your profile visibility setting (public, members only, connections only or hidden) and your contact preference control what other members and visitors see. Messages are visible only to the two people in the conversation. Community posts are visible to members. Catalogues and project references published on a company page are public. Relationship data such as connections, requests and event attendance does not become public because a company or event is public.
5. Who helps us
We use a small number of service providers who process data on our behalf and under our instructions:
- Supabase: database, authentication and file storage. Our database is hosted in London, United Kingdom.
- Vercel: website hosting and delivery. Our application runs in London, United Kingdom; static content is delivered from Vercel’s global network.
- Email delivery provider: sends the service emails described above.
- Expo (650 Industries, Inc.) and, through it, Google Firebase Cloud Messaging and Apple Push Notification service: deliver push notifications to the mobile app. They receive the push token and the notification text.
Polar (Polar Software, Inc.) sells our paid plans as Merchant of Record. When you buy a plan, you enter your payment details on Polar’s checkout page, and Polar processes them as an independent controller under its own privacy policy. We share with Polar only what a purchase needs: an internal member reference, the plan you chose and, for company plans, the company it is for.
We do not sell personal data, and we do not share it with advertisers. We may disclose data where the law requires it, for example to a court or a public authority.
6. Transfers outside Türkiye
Because the providers above store and process data in the United Kingdom and, for some services, other countries, your personal data is transferred outside Türkiye. We make these transfers under Article 9 of the KVKK and, where the GDPR applies, under Chapter V of the GDPR, using the safeguards those laws provide, such as standard contractual clauses. You can ask us for more information about the safeguards used.
7. How long we keep it
- Account, profile and networking data: for as long as your account exists. You can delete your account yourself at any time, on your profile on the website or in the app. Your account and the personal data linked to it are then deleted straight away, including your profile, photos and posts, and any paid plan you pay for is cancelled. Billing records we must keep by law are kept without your name or email. If you ask us by email instead, we do the same within 30 days.
- Messages: for as long as both participants’ accounts exist. When either account is deleted, the connection and the whole conversation are deleted for both people.
- Product events, feedback and problem reports: up to 24 months.
- Billing records: for the periods required by Turkish tax and commercial law.
- Technical logs: for the short period set by our hosting provider.
Backups are overwritten on a rolling basis, so deleted data disappears from them over time.
8. Your rights
Under Article 11 of the KVKK, and Articles 15 to 22 of the GDPR where they apply, you can ask us:
- whether we process your personal data, and for a copy of it;
- for the purposes of processing, and whether data is used for those purposes;
- which third parties, in Türkiye or abroad, receive it;
- to correct inaccurate or incomplete data, and to have that correction passed on to those third parties;
- to delete or anonymise your data, and to have that passed on to those third parties;
- to object to a result that affects you and that comes only from automated analysis;
- for compensation if unlawful processing has caused you damage;
- under the GDPR: to restrict processing, to receive your data in a portable format, and to object to processing based on our legitimate interests.
You can change most profile data and visibility settings yourself on your profile. You can delete your account yourself at any time in the Delete account section of your profile, or in the app under Me › Delete account (step by step). For any other request, or if you prefer us to delete your account for you, write to info@marineinteriorhub.com from the email address of your account. We answer within 30 days, free of charge. You can also complain to the Personal Data Protection Authority of Türkiye (Kişisel Verileri Koruma Kurumu) or, in the EEA or United Kingdom, to your local data protection authority.
9. Cookies and similar technologies
We use only what the site needs to work. There are no advertising or cross-site tracking cookies and no third-party analytics, so we do not show a cookie consent banner.
| Name | Purpose | Duration |
|---|
sb-…-auth-token | Keeps you signed in (authentication session). | Until you sign out, or the session expires. |
mmr_auth_draft | Keeps the email you typed if a sign-in or sign-up attempt fails, so you do not have to retype it. It never contains your password. | 10 minutes. |
| Browser session storage | Keeps an unfinished onboarding form, and avoids counting the same page view twice. | Cleared when you close the tab. |
You can delete cookies in your browser settings at any time. If you block the authentication cookie, you will not be able to sign in.
10. Links to other websites
Company, event and news records link to third-party websites. Those websites have their own privacy practices, which this policy does not cover.
11. Changes to this policy
If we change this policy in a way that matters for you, we will tell members by email or on the site before the change takes effect. The date at the top always shows the current version.