Privacy policy

Who we are

This site is run by BadgerMecX Advanced Engineering Solutions ("BadgerMecX", "we"), an engineering simulation and analysis consultancy. We are the data controller for everything described here — the "veri sorumlusu" under Turkish law.

• Registered address: Maltepe, Istanbul
• For anything in this notice: privacy@badgermecx.com

If you are in Türkiye, this is our disclosure under Article 10 of Law 6698 (KVKK). If you are in the EU, the EEA or the UK, it is our Article 13/14 information under the GDPR. Where the two differ we apply whichever gives you more.

In short

• We do not sell personal data, and we do not use it for advertising.
• Analytics run only if you accept them. Reject — or simply ignore the banner — and no analytics identifier is ever created.
• No third party is contacted to draw a page. Fonts, stylesheets, scripts and images all come from this server, so nobody else learns your IP address because you opened a page here.
• What you type into a form goes to the people who need it to answer you, and nowhere else.
• If you have an account you can delete it yourself, in full, from your settings page.

Reading the site

Our web server keeps a standard access log of every request: the IP address it came from, the date and time, the address requested, the response code, the page that referred you and your browser's user-agent string. This is how we find errors and notice when the site is being attacked or scraped. It is kept for 30 days and then deleted.

Reading pages needs no cookie. The few this site sets, and the one value it keeps in your browser's local storage, are listed in the cookie policy.

Legal basis: our legitimate interest in operating and securing the site (GDPR 6(1)(f); KVKK 5(2)(f)).

Analytics

If you accept in the banner, we load Google Analytics 4 — through Google Tag Manager if we have a container configured. It counts visits, tells a returning visit from a new one, and shows which pages are actually read. IP addresses are truncated before Google stores them (anonymize_ip). We do not use analytics to build a profile of you, and we do not link it to your account.

If you reject, or never answer, the script is not loaded at all — not loaded and then told to stay quiet, but never fetched. You can change your mind at any time on the cookie policy page.

Legal basis: your consent. Withdrawing it is as easy as giving it.

Getting in touch

The contact page has three ways in, and each one asks for only what it needs:

• Discovery call — your name, email, company, the slot you asked for, and anything you write in the message box.
• Project inquiry — the same, plus the physics involved, the standard you are working to, the format your geometry is in, your deadline, whether you want an NDA before you send files, and your description of the problem.
• General message — name, email, company, topic, message.

Each submission is stored in our admin and emailed to our own address. We use it to answer you and to keep a record of the enquiry. Kept for 24 months from the last exchange, then deleted.

Legal basis: taking steps at your request, and our legitimate interest in answering a business enquiry and keeping a record of it (GDPR 6(1)(b) and 6(1)(f); KVKK 5(2)(c) and 5(2)(f)).

Newsletter

We store your email address, the exact consent wording you agreed to, the page you signed up from, and the date. Only addresses that ticked the box are stored at all. Every email carries an unsubscribe link; you can also just ask us. Once you unsubscribe we keep the address marked as unsubscribed, so it does not get added again by mistake.

Legal basis: your consent.

Early access to Tessera

The sign-up on the Tessera page stores your name, email, organisation, role, the analysis types you ticked, whether you would join a pilot, your message, and the consent wording. We use it to write to you personally as each stage opens, and to decide what to build first. Kept until you ask us to remove you, or 24 months after the last contact.

Legal basis: your consent.

Your account

Accounts exist for two things: saving calculator work, and applying for a job. To open one we need an email address. Sign-in is by a single-use code sent to that address; you may set a password as well, and if we have the buttons switched on you can sign in with Google or LinkedIn — in which case the provider passes us your email address, your name and your profile picture, and nothing more. We also record when you joined, when you last signed in, and whether your address is verified.

Deleting your account removes it and everything attached to it — profile, CV files, applications and their history, saved calculations, linked sign-in providers. It is immediate and we cannot undo it.

Legal basis: performance of the terms you accepted when you created the account (GDPR 6(1)(b); KVKK 5(2)(c)).

Applying for a job

Your candidate profile can hold your name, a headline, a photo, city and country, phone number, LinkedIn and website addresses, a summary in your own words, your notice period and whether you would relocate, your work history, your education and your skills — plus a CV file, if the posting asks for one.

An application stores the position, your note, the consent wording you agreed to, and a snapshot of your profile exactly as it stood on the day you applied. The snapshot is there so a later edit does not quietly change what we assessed. As your application moves we record each status change and the message that went with it.

Our internal assessment notes are part of your record. They are not shown on your dashboard, but they are covered by your right of access, subject to the rights of the people who wrote them.

CV files and profile photos are stored outside the public media folder. They have no web address of their own, and a download is checked against who is asking: you, or the staff who assess applications. Nobody else.

Kept for 12 months after the process closes, so we can come back to you about a similar role — or until you delete your account, whichever comes first.

Legal basis: the steps you asked us to take by applying, and our legitimate interest in running a hiring process and defending the decisions in it. Your consent is the basis for keeping your application on file after the role is filled.

The calculators

The numbers you type are sent to our server, calculated there, and sent back. A run is not stored: the values are not written to a log or a database, and they are gone when the response is sent.

If you press save — which needs an account — we store the calculator, the title you gave it, the inputs, and which version of the engine ran them. That is your record, visible only to you, and you can delete any of it or all of it at any time. Up to 200 saved calculations per account.

If you have Pro access we store the plan, the dates it runs between, and the invoice or subscription reference from the payment provider. We never see or store card details — when payments go live, a payment provider handles them and we only receive the reference.

Legal basis: performance of the terms; for a paid plan, also our legal obligation to keep billing records.

Work we do for you

Files and data you send us for an actual engagement — models, drawings, load cases, test data, anything covered by an NDA — are governed by that engagement's contract and NDA, not by this notice. They are not stored on this website and they are never used to train anything.

Who else is involved

Only these, and each of them only for what it is listed for:

• Vultr — runs the server the site and its database sit on.
• Postmark — sends the automated messages: verification codes, sign-in codes, form notifications, application status updates.
• Google Ireland / Google LLC — analytics, and only if you accepted.
• Google / LinkedIn — only if you choose to sign in with one of them.
• Our own staff, and our professional advisers or a public authority where the law obliges us.

We do not sell, rent or trade personal data, and we do not pass it to anyone for their own marketing.

Where it is processed

Our server is located in Frankfurt, Germany. If you accept analytics, analytics data is sent to Google, which processes it in the European Union and the United States. For the EU, this transfer is based on Google's certification under the EU–US Data Privacy Framework and on the standard contractual clauses included in our agreement with Google. For Türkiye, the transfer abroad is based on a standard contract under Article 9 of the Law on the Protection of Personal Data (KVKK), notified to the Personal Data Protection Board.

If you do not accept analytics, none of your personal data leaves the country where our server is located as a result of your use of this site.

How long we keep things

• Server access logs — 30 days.
• Contact and enquiry forms — 24 months from the last exchange.
• Newsletter — until you unsubscribe; the unsubscribed address is kept so it is not re-added.
• Tessera early access — until you ask to be removed, or 24 months after the last contact.
• Account, profile, saved calculations — until you delete the account.
• Applications and CVs — 12 months after the process closes, or until you delete your account.
• Billing records — 10 years, because tax law says so.
• Analytics — 14 months in Google Analytics, then aggregated.

When a period ends the record is deleted, not archived.

How it is protected

• The whole site is served over HTTPS; cookies are marked secure.
• Passwords are stored as salted hashes and cannot be read back. Because sign-in works by one-time code, most accounts have no password at all.
• CVs and candidate photos sit outside the folder the web server publishes and have no URL; they are handed out only by a view that checks who is asking.
• Forms are protected against cross-site submission, and each one has a trap field that catches automated posting.
• The admin is separate from the public site and limited to named staff accounts.
• Access to the server and the database is limited to the people who operate them.

No system is perfect. If something happens that puts your data at risk we will tell the authority and, where the law requires it, you — within 72 hours of becoming aware, for the GDPR, and without delay under the KVKK.

Your rights

Under KVKK Article 11 and GDPR Articles 15–22 you can ask us to tell you whether we hold data about you and what we do with it; give you a copy, in a form you can take elsewhere; correct anything wrong; delete it; stop or limit what we do with it; and you can object to processing we base on our legitimate interest. Where we rely on consent, you can withdraw it at any time without giving a reason.

Nothing on this site makes an automated decision about you. No profiling, no scoring, no algorithm deciding on an application or an enquiry. A person reads everything.

Some of this you can do yourself, straight away:

• Delete your account — sign in, then Settings & privacy. Everything goes with it, immediately.
• Change your analytics choice — the control on the cookie policy page.
• Leave the newsletter — the unsubscribe link in any newsletter.

For anything else, write to privacy@badgermecx.com. We answer within 30 days (KVKK) or one month (GDPR), and we will tell you if we need longer. There is no charge unless a request is repetitive or excessive. If you are not satisfied you can complain to the Turkish authority at kvkk.gov.tr or, in the EU/EEA, to the supervisory authority where you live.

Children

This is a professional site and its accounts are for adults. We do not knowingly collect data from anyone under 18. If you think a child has created an account here, write to us and we will delete it.

Changes

We update this notice when the site changes. The date at the top is the last change. If a change matters — a new purpose, a new processor, a new transfer — we will say so on the site, and we will email account holders before it takes effect.

Contact: BadgerMecX Advanced Engineering Solutions, Maltepe, Istanbul, privacy@badgermecx.com.