Privacy Policy

• Account data: your phone number, your name (if you provide it), your user type (producer/follower).
• Producer profile: brand name, logo, business categories, country and visibility settings.
• Content: product photos (including images of people shown in them), product name, code, price, descriptions, collections and AI-generated images.
• Contacts (only if you allow it): for producers, the names and phone numbers of contacts are uploaded to our servers. If a producer added you from their address book, you will see this when you open the app and can unfollow if you wish.
• Follow requests: when you send a follow request with a producer's join code (QR code, written code or link), your phone number, your name, your company name (if any) and your country are shared with that producer.
• Interactions: brands you follow, your favourites, order requests, collections you view, your reports and blocks.
• Purchase data: subscription status, purchased product identifier and store (App Store / Google Play). Your card or payment details never reach us; the store takes the payment.
• Device and technical data: a device token for push notifications, app version, language preference; IP address when web pages are viewed.
• Consent records: version of the documents you accepted, date, language and app version; AI processing consent.
• Support correspondence: what you send us by email.

We do not collect location data, advertising identifiers (IDFA/AAID), health data or biometric data. The app does not track you for advertising.

Producers can share their collections via links. For visitors who open such a link:

• Page views and product likes are recorded for statistics; records may include the IP address.
• If the producer sent you a personalised link via WhatsApp, the fact that you opened it and which products you liked is shared with the producer who has you in their contacts.
• If you create an order request, your name and phone number are shared with the producer to deliver the request.
• Your likes are also kept in your browser (localStorage). See the Cookie Policy for the cookies used.

For this data, the producer concerned is the data controller and Privyu is the data processor.

• Creating your account and verifying your phone number
• Publishing and sharing collections and showing them to followers
• AI image editing and product analysis
• Enabling producers, where they choose to, to send collections to their customers via WhatsApp
• Delivering order requests to producers and sending notifications
• Managing your subscription, trial and credits
• Providing producers with collection view statistics
• Security, abuse prevention and reviewing reports
• Answering support requests and meeting legal obligations

We do not sell your data or share it with third parties for advertising.

We process your data under Article 5 of the Turkish Personal Data Protection Law (KVKK) and, where applicable, Article 6 GDPR, on the following bases:

• Performance of a contract: account, content, publishing, notifications, subscription.
• Legitimate interests: security, abuse prevention, service improvement, statistics.
• Legal obligation: requests from authorities, record-keeping duties.
• Explicit consent: uploading your contacts, sending your photos to AI providers abroad and (if you give it) marketing messages. You can withdraw consent at any time.

Other users: Privyu is an invitation-only, closed platform. A producer's collections are visible only to their followers (or to people the producer chooses) and in the countries the producer selects; other users cannot find producers through search or discovery. Someone who is not a follower and opens a shared collection link sees only a limited preview and the producer's join code. A producer you follow or send a follow request to can see your name, phone number and company name (if any).

Producers' customer lists: the list of people a producer added from their address book or who follow them is not shown to other producers, Privyu's affiliates or business partners, is not sold, and is not used for marketing.

Our service providers (processors) — only with the data needed to provide the Service:

• Server hosting: [SUNUCU BARINDIRMA SAĞLAYICISI VE ÜLKESİ]
• Cloudflare, Inc. (R2 storage — images) — USA / global
• Cloudinary (image storage and transformation) — USA / Israel
• Google LLC (Firebase Cloud Messaging notifications; Cloud Translation) — USA / EU
• AI service providers (image analysis, image generation and mannequin/try-on images) — USA / EU
• RevenueCat, Inc. (subscription and purchase status) — USA
• Apple Inc. and Google LLC (App Store / Google Play payments)
• Meta Platforms, Inc. (WhatsApp Business Platform) and 360dialog GmbH — verification codes and producers' collection messages — USA / Germany
• Telnyx LLC (USA) and Netgsm (Türkiye) — SMS verification codes

Competent public authorities: where required by law.

Some of the providers above process data outside Türkiye. These transfers are made under Article 9 KVKK, relying on standard contracts or appropriate safeguards where available and otherwise on your explicit consent. For AI features, your explicit consent is requested separately in the app before first use.

When you use AI features, the photos you choose (and images of people in them) are sent to the AI providers listed above for processing. Photos are used only to perform the action you requested; Privyu does not share your photos for model training. If you do not consent, AI features will not work; you can keep using the other features.

• Account and content data are kept while your account is open.
• When you delete your account, your profile, content, images, contacts, follow relationships and notifications are permanently deleted immediately and removed from backups within the normal backup cycle.
• Your view records in other producers' statistics are de-identified.
• To prove that deletion took place, an irreversible hash of your phone number is kept; the number itself is not stored.
• You can delete your uploaded contacts at any time in Settings.
• Purchase records are kept by the relevant store (Apple/Google) under its own policies.
• Records we are legally required to keep are kept for the statutory period.

Under Article 11 KVKK (and the GDPR where applicable) you have the right to learn whether your data is processed, request information and a copy, rectification, erasure, object to processing, withdraw consent and claim compensation.

• You can delete your account in the app under Settings → "Delete My Account" or at https://www.privyu.com/hesap-silme.
• You can delete your uploaded contacts in Settings.
• You can request a copy of your data and make other requests at kvkk@privyu.com. Requests are answered within 30 days.

Detailed application methods are in the KVKK Information Notice.

Your data is encrypted in transit (HTTPS/TLS). We apply technical and organisational measures such as access control, expiring session tokens and phone verification. No system is entirely risk-free; if a breach occurs we will notify the people concerned and the authority as required by law.

The Service is not intended for people under 18 and we do not knowingly collect their data.

We may update this policy. We will notify you of material changes in the app. The current version is always on this page.

[ŞİRKET UNVANI] — [ŞİRKET ADRESİ]

General: destek@privyu.com · Personal data requests: kvkk@privyu.com · KEP: [KEP ADRESİ]