Privacy Policy

1) Scope and User Acknowledgement

This Policy explains data processing in our AI photo transformation Service. By using Camyvex, you expressly acknowledge and agree that: (i) you use the Service entirely at your own risk, (ii) you bear full responsibility for all content you upload, (iii) you waive any claims against us to the maximum extent permitted by law, and (iv) you indemnify us against all claims, damages, losses, and expenses arising from your use.

2) Data Categories

• Account: email, authentication, payment metadata (no card storage by us)
• Content: uploaded images, AI outputs, preferences
• Technical: device info, IP (anonymized), logs (PII-redacted), usage analytics
• Legal: consents, policy acceptances, DSAR requests

3) Processing Purposes & Legal Bases

• Service Provision: Contract + Explicit Consent for AI processing and international transfers
• Account/Support: Contract + Legitimate Interest
• Security/Fraud Prevention: Legitimate Interest + Legal Obligation
• Payments: Contract + Legal Obligation
• Legal Compliance: Legal Obligation + Legitimate Interest

AI Processing: NOT automated decision-making under GDPR Art. 22 - purely technical image transformation service.

5) Data Retention

• Original uploads: deleted within 30 minutes (processing only)
• Generated outputs: last 10 kept, all deleted after 30 days (user experience purposes per GDPR Art. 6(1)(f) legitimate interest)
• Account data: while active, deleted upon closure unless legally required
• Technical logs: minimal retention for security/legal compliance

Third-party retention: UNCONTROLLABLE and subject to their policies.

7) Age Restrictions

Service intended for 18+ users. Users under 18 require verified parental consent. We immediately remove minors' data upon notice.

8) Security Measures

We implement: TLS encryption, secure authentication, access controls, monitoring, and incident response. However, no security is 100% effective. We disclaim liability for any security breaches or data compromises.

9) Data Breach Notification

In case of data breach affecting your rights/freedoms: we notify relevant authorities within 72 hours (GDPR/KVKK requirement) and affected users within 30 days via email/in-app notification, unless encryption renders data unintelligible.

10) Your Rights (KVKK/GDPR)

• Access, rectify, delete, port your data
• Object/restrict processing (legitimate interest basis only)
• Withdraw consent (prospective only, doesn't affect third-party processing already completed)
• Complain to authorities (Turkish DPA/KVKK or EU supervisory authority)

Exercise via in-app tools or support@camyvex.com. Identity verification required. Response within 30 days.

11) Data Controller Details

Individual Developer based in Istanbul, Turkey. All disputes subject to EXCLUSIVE jurisdiction of Istanbul Çağlayan Courts and Enforcement Offices, Turkey, under Turkish Law. Service provided "AS IS" without warranties.

12) Limitation of Liability

To the maximum extent permitted by law: (i) we provide Service "as is" with no warranties, (ii) our liability is limited to the amount paid by you in the 12 months preceding the claim (if any), (iii) we are not liable for indirect, consequential, punitive, or special damages, (iv) you waive all claims against us, and (v) you indemnify us against all third-party claims.

13) Policy Updates

We may update this Policy. Material changes communicated via email/in-app notification. Continued use after effective date constitutes acceptance. If you disagree, discontinue use immediately.

14) Time Limitations

Any claim arising from or related to data processing or privacy violations must be filed within 6 months after it arises, or it is permanently barred. This limitation applies regardless of the form of action.