Privacy / KVKK

This Privacy Policy explains how MarbleMap processes personal data when you use our marketplace, website, and AI assistant connectors. We are committed to protecting your data and complying with the EU General Data Protection Regulation (GDPR) and Türkiye's Law on the Protection of Personal Data No. 6698 (KVKK).

1. Who we are

MarbleMap is a commission-free, sealed-bid B2B marketplace for natural stone, operated by Fusapp OÜ, a company registered in Estonia (the "data controller"). You can reach us at [email protected] for any privacy request.

2. Data we collect

• Account & identity: name, business e-mail, password (stored hashed), preferred language, and role within your company.
• Company & verification (KYB): company name, tax/registration details, country, and documents you provide to verify your business.
• Marketplace content: the requests (RFQs), offers, order details, attachments, and messages you create on the platform.
• Billing: subscription and invoice records. Card payments are handled by our payment processor — we do not store full card numbers.
• Usage, device & log data: IP address, browser/device type, pages viewed, and security logs, used to operate and protect the service.
• Connector data: when you connect MarbleMap to an AI assistant (see §9), the authorization and the requests you make through it.

3. Why we process it, and our legal bases

We process your data to provide and secure the marketplace, verify businesses (KYB), match buyers and suppliers, handle billing, comply with legal and tax obligations, and improve the service. Our legal bases are the performance of our contract with you, our legitimate interests in running a safe marketplace, compliance with legal obligations, and your consent where required (e.g. non-essential cookies).

4. Who we share it with

We never sell your personal data. We share it only with:

• The other party to a deal — a buyer sees the offers on their own request; a supplier sees only their own offer. Under our sealed-bid design, competing offers and the number of offers are never disclosed.
• Service providers (processors) acting on our instructions: payment/billing (FlexPrice and Stripe), cloud hosting (Hetzner, EU), network & security (Cloudflare), database hosting (MongoDB), and the providers described in §12: Google Firebase Cloud Messaging (push notifications), Microsoft Azure (file storage and AI Content Safety) and DeepSeek (machine translation and the automated company pre-check).
• AI assistant providers — only when you choose to connect MarbleMap to ChatGPT or Claude, and only the data you request through that connector (see §9).
• Advertising measurement provider — Meta Platforms Ireland Ltd. Only if you have given cookie consent: when you submit a form, an irreversible SHA-256 hash of your email and phone number, your IP address, your browser user agent and Meta's cookie identifiers. See the Cookie Policy for detail and withdrawal.
• Advertising measurement provider (ChatGPT ads) — OpenAI Ireland Limited. Only if you have given cookie consent: the page you visit, the ad click reference and OpenAI's cookie identifiers, your IP address, your browser user agent, and the fact that an action such as registering or opening a request on the portal took place. OpenAI's measurement tool may convert information entered into forms on the page, such as your email address, into an irreversible SHA-256 hash in your browser before sending it. OpenAI processes this data as an independent controller for ad measurement, reporting, audience building and improving its own services. See the Cookie Policy for detail and withdrawal.
• Authorities where required by law.

5. International transfers

Your data is primarily hosted in the EU. Where a processor other than DeepSeek is located outside the EU/EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

DeepSeek processes the texts and company details described in §12 in the People's Republic of China. Information on the mechanism used for this transfer is available on request from [email protected].

Advertising measurement data is sent to Meta Platforms Ireland Ltd. (Ireland, EU), which transfers it onward to its group company Meta Platforms, Inc. (USA). That transfer relies on the Standard Contractual Clauses and the EU–US Data Privacy Framework, and happens only if you have given consent.

ChatGPT ad measurement data is sent to OpenAI Ireland Limited (Ireland, EU). For any onward transfer outside the EU/EEA (for example to its group companies in the USA), OpenAI uses a valid transfer mechanism. This happens only if you have given consent.

6. How long we keep it

We keep your data for as long as your account is active and as needed to provide the service. Invoicing and tax records are kept for the period required by law. When data is no longer needed, we delete or anonymize it.

7. How we protect it

Access requires authentication over OAuth 2.0; data is encrypted in transit; access is restricted on a need-to-know basis; and the sealed-bid architecture structurally isolates competing offers so they can never leak between parties.

8. Your rights

Under GDPR and KVKK you have the right to access, rectify, erase, restrict, and port your data, to object to processing, and to withdraw consent at any time. You may also lodge a complaint with your data protection authority. To exercise any right, contact [email protected]; we respond within the timeframes required by law.

9. AI assistants & connectors

MarbleMap offers connectors that let you use the marketplace from AI assistants such as ChatGPT and Claude. Connecting is optional and initiated by you through a secure sign-in (OAuth). The assistant can then act on your behalf, accessing only your own company's data through the same permissions and sealed-bid rules as the website — it never sees other companies' offers or reads your unrelated conversations. Your use of the assistant is also subject to that provider's own privacy policy.

10. Cookies

We use essential cookies to run the site; with your consent, analytics cookies to improve it and Meta Pixel and OpenAI (ChatGPT ads) measurement cookies to measure the effect of our ads. Analytics and advertising cookies run only with your consent, and you can withdraw that consent at any time. See our Cookie Policy for details and choices.

11. Children

MarbleMap is a business-to-business service intended for companies and users aged 18 or over. We do not knowingly collect data from children.

12. MarbleMap mobile apps

The MarbleMap apps for Android and iOS use the same MarbleMap account as the web portal; the sections above apply to them as well. The list below adds what is specific to the apps; the points on chat messages and attachments, content moderation, message translation and the automated company pre-check apply in the same way when you use the web portal.

• Account data: when you register or sign in through the app, we process the account and company data described in §2, such as your name, business e-mail, password (stored as a hash), preferred language, company and role.
• Device and push notification data: if you allow notifications, the app obtains a push token from Google Firebase Cloud Messaging (on iOS together with Apple's push notification service), and we link it to your account so that we can notify you about activity such as new offers and messages. Firebase uses an app installation identifier for this. You can turn notifications off in your device settings at any time; when you sign out, the app deletes its token.
• Chat messages and attachments: the messages you send in conversations about requests and offers, and the files you attach (images, PDF, Word, Excel, text and CSV files of up to 10 MB), are stored on our servers and in our file storage (Microsoft Azure) and are visible to the participants of the conversation. If you block or report a user or a message, we keep a record of the block or report and of the related content so that our moderators can review it.
• Content moderation: the text you publish or send (requests, offers, chat messages and your company profile) and the images you upload (including your company logo) are automatically screened by Microsoft Azure AI Content Safety for harmful content (sexual, violent, hateful or self-harm content). Content that is flagged may be blocked.
• Message translation: where automatic translation is included in a participant's plan, the text of chat messages, requests, offer notes and the questions and answers on a request is sent to DeepSeek for machine translation. DeepSeek's privacy policy states that it processes and stores data in the People's Republic of China, which is outside the EU/EEA. Please do not include personal data in messages that the conversation does not need.
• Automated company pre-check: when you register a company through the web portal or the apps, the company details you submit (company name, country and region, website, VAT number, company phone, description and selected product categories), the domain of your e-mail address (not the full address) and your preferred language are sent to DeepSeek for an automated pre-check of the application. The pre-check may also visit your company website to check that it is reachable and matches the application; the content it reads there is also sent to DeepSeek. If the pre-check recommends approval with a confidence score at or above a threshold we set, and none of its website, e-mail-domain, VAT-number or website-content checks fails or remains inconclusive, your application can be approved automatically. The pre-check never rejects an application on its own: all other applications are reviewed by our team, and you can ask for a person to review a decision about your application by writing to [email protected]. DeepSeek processes this data in the People's Republic of China (see §5).
• Account deletion: you can request deletion in the app (Account > Delete account) or by e-mail. Recording a request does not mean data has been deleted; our team reviews the verified request. Invoices and transaction records may be retained only where a legal reason and retention period or criteria apply. The steps and possible retention exceptions are explained on the account deletion page.
• Contact: for any question about the apps and your data, write to [email protected].

13. Changes to this policy

We may update this policy from time to time. Material changes will be announced on this page, and the "last updated" date below will change.

Last updated: 7 October 2026 · MarbleMap · Fusapp OÜ · [email protected]