Data protection notice (KVKK)

This notice is prepared under Article 10 of Turkish Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.

1. Data controller

Your personal data is processed by Eren Gürbüz (Kuşadası, Aydın, Türkiye) as data controller. Contact: therisyy@gmail.com.

2. Personal data processed

• Visual data: The photos you upload, the face region cropped from them and the generated results
• Special category personal data: Biometric data calculated for a moment from every face in the photo and the result (face vector, facial landmarks and the head angle, eyes, iris and skin color measured from these landmarks); in the Background Cleaner, only for the main people (see “Other people in the photo”)
• Customer transaction data: Randomly generated user ID (a pseudonym), subscription plan, credit balance and history, sales and refund records, the repeated refund flag, generation records, consent records and history, support requests
• Transaction security data: App and device verification details, error logs, server request logs that contain the IP address, a hash of the IP address created with a secret key on web forms
• Device data: If you allow notifications, your device's notification token and language preference
• Marketing and usage data: Usage analytics and the campaign and announcement notification subscription, based on your explicit consent
• Contact data: The email address you write on the support or data deletion form

3. Purposes of processing and legal grounds

Why biometric data matters and its risks: Biometric data is special category personal data. It cannot be changed like a password; if it were obtained by someone else, it could be misused to recognize or impersonate you. To keep this risk as low as possible, the face vector and landmarks are held in server memory only for the duration of the operation, are never written to disk, a database or logs, and are not used for identification. If you do not consent, you cannot use the AI styles and tools (e.g. the Background Cleaner). Filters keep working.

Repeated refund flag: If the number of refunds the store has made on your account reaches three, the account is automatically flagged, and on later refund requests we tell the store that we prefer no refund. The store always makes the refund decision. You can object to this outcome under KVKK Article 11 (section 9).

Other people in the photo: Because the verification checks that every face in the photo did not change, the same biometric data is processed from the faces of other people in the photo, for the same purposes and under the same rules. In the Background Cleaner tool, face data is calculated only for the main people in the photo (the largest one or two faces). The faces of other people in the background are only detected on the server; their position and size are used in memory during the operation to check that no new face appears in the result. No face vector is calculated for them and no iris or skin color is measured; the rough eye, nose and mouth points that the face detector finds along with each face are not used and are discarded when the operation ends. The user who uploads the photo declares that they have these people's explicit consent. In the Background Cleaner, this consent is not required for the people in the background whom the user wants removed from the photo; their image is processed only to remove them from the photo, and no face vectors are calculated for them. The user must have the consent of the main people who remain in the photo. A person who appears in a photo can use the rights in section 8 through the channels in section 9, even without an account.

4. Collection method and legal grounds

Your data is collected electronically and by automated means through the app, website and forms. The legal grounds used in the table in section 3 are:

• Your explicit consent (KVKK Art. 5/1): usage analytics and campaign and announcement notifications
• Direct relevance to the formation or performance of a contract (KVKK Art. 5/2-c)
• Fulfilment of the controller's legal obligation (KVKK Art. 5/2-ç)
• Legitimate interest, provided your fundamental rights and freedoms are not harmed (KVKK Art. 5/2-f)
• Your explicit consent for biometric data (KVKK Art. 6/3-a)

5. Transfers

To deliver the service, your data is transferred to suppliers such as Google (hosting the app, website and face verification service, storage, AI generation, error logs), RevenueCat (subscription tracking, answering refund requests and passing on our view on refunds), PostHog (EU, analytics only with your explicit consent), Expo (app updates), and Apple and Google (store, payment, refund requests, notifications and device checks). Biometric data is processed only in memory on the servers in Belgium of Google, the hosting provider working on our behalf; it is not sent to the AI generation service (Gemini API) or to other suppliers. Your photo and the face region cropped from it are sent to the AI generation service. In the Background Cleaner, the photo sent to this service also contains the image of the people in the background; the face region is cropped only from the main people. This image is processed only to remove them from the photo and is deleted on the same schedule as the photo. Where the law requires, data may also be shared with competent authorities and courts.

6. Transfers abroad

Servers are in Belgium (Google, europe-west1) and the analytics infrastructure is in the EU. AI generation runs on Google's Gemini API: the photo may be processed, only to apply the style or tool, on Google's infrastructure outside the EU (including the United States). Biometric data is always processed only on the servers in Belgium, in memory. Firebase's session, crash reporting, notification, device check and configuration services and server logs are processed on Google's global infrastructure (including the United States). RevenueCat and Expo (app updates) are based in the United States. These transfers are subject to the conditions and safeguards set out in KVKK Article 9.

7. Retention

Photos and results are deleted from our servers right after delivery, within 24 hours at the latest. Under its own policy, Google may keep a photo sent to the Gemini API for 55 days, only to detect abuse; a photo sent to Vertex AI before version 2 of this notice may be logged to examine suspected abuse and kept for up to 90 days. Google does not use these records to improve its products or to train its general models. Biometric data is held in memory only for the duration of the operation. Sales and refund records, the repeated refund flag and consent records are kept until your account is deleted. Other periods are listed in the privacy policy.

8. Your rights under KVKK Article 11

By applying to the data controller, you can:

• Learn whether your personal data is processed
• Request information if it has been processed
• Learn the purpose of processing and whether it is used accordingly
• Know the third parties it is transferred to in Türkiye or abroad
• Ask for it to be corrected if it is incomplete or wrong
• Ask for it to be deleted or destroyed under the conditions of KVKK Article 7
• Ask for these actions to be notified to the third parties it was transferred to
• Object to an outcome against you that results from analysis by automated systems (such as the repeated refund flag)
• Claim compensation if you suffer damage because of unlawful processing

9. How to apply

Send your application through the support form by choosing the “Privacy and data request” topic, or write to therisyy@gmail.com. Because your account is anonymous, add your diagnostic code (at the bottom of Settings) and your store order number if you have one, so that we can verify you. Your application is concluded free of charge within 30 days at the latest.

You must apply to the data controller before complaining to the Personal Data Protection Board (KVKK Article 14). If your application is rejected, if you find the answer insufficient or if no answer arrives in time, you can complain to the Board within thirty days of learning the answer and in any case within sixty days of the application date.

To delete your data directly, use Settings > Delete my data in the app or the data deletion form.