KVKK Privacy Notice

1. Data Controller

Under Law No. 6698 on the Protection of Personal Data ("KVKK"), your personal data is processed by Artolume Yapay Zeka Teknolojileri Anonim Şirketi ("Artolume" or the "Company") in its capacity as data controller.

Trade Name: Artolume Yapay Zeka Teknolojileri Anonim Şirketi
MERSIS No: 0085147337600001
Tax Office / No: Şirinyer / 0851473376
Address: Adatepe Mahallesi Doğuş Caddesi No: 207 AG İç Kapı No: 1, Buca / İzmir
E-mail: destek@artolume.com
Phone: 0 232 700 28 88

2. Personal Data Processed

Data Category	Example Data
Identity	First name, last name
Contact	E-mail address, phone number
Financial	Order number, payment amount (card details are not stored); in the iOS app, App Store transaction number, subscription plan, purchase and renewal dates
Financial (Android)	In the Android app: Google Play order number, subscription plan, purchase and renewal dates
App and device	"Sign in with Apple" user identifier, notification identifier (push token), device language, app version
Transaction Security	IP address, session information, log records
Usage	Generated image/video content, preferences

3. Purposes of Processing Personal Data

• Carrying out membership and authentication processes
• Carrying out purchase, order and invoicing transactions
• Sign-in, verification of subscriptions and purchases in the iOS app, and sending creation notifications
• Improving service quality and providing technical support
• Fulfilling legal obligations (tax and consumer legislation)
• Company security and fraud prevention

Showcase (Discover): Under the Membership Agreement, the images and videos you generate may be shown publicly, together with their prompts and the name of the model used, on the Discover page, in model page examples and in home page examples; your name, e-mail address and account details are not shown. If you mark a generation as "Private", it is not shown in the showcase, and if it is already there it is removed immediately; with the "Make my new generations private" setting on your profile, your subsequent generations start as private. We recommend that you do not write personal data in your prompts.

4. Legal Grounds for Processing (KVKK Art. 5)

• Establishment and performance of a contract: Membership and purchase transactions
• Legal obligation: Records required under tax and consumer legislation
• Legitimate interest: Security logs and protection of system integrity
• Explicit consent: Marketing communications (on request and confirmed separately)

Collection method: Your data is collected electronically and automatically through the sign-up, payment, creation and contact forms on the website and in the iOS app, Sign in with Apple and App Store purchase records, and cookies and server logs.

5. Transfer of Personal Data

Within Türkiye: It may be transferred to iyzico Ödeme Hizmetleri A.Ş. for payment services and, where legally required, to authorised public institutions and organisations.

Abroad: To provide the service, part of your data is transferred to the following service providers whose servers are located abroad. These providers process the data on behalf of the Company solely to provide the service.

These transfers are made under Article 9 of the KVKK, with the appropriate safeguards provided for by the Law (standard contracts) or, pursuant to Art. 9/6, where they are necessary for the establishment and performance of a contract. Using the AI features requires the content you enter to be sent to these providers; we therefore recommend that you do not include personal data in your prompts and uploaded files.

6. Retention Periods

• Account data: while the account is active + 3 years
• Invoice and order records: 10 years (Turkish Commercial Code)
• Security logs: 2 years

7. Rights of the Data Subject (KVKK Art. 11)

You may exercise the following rights regarding your personal data by submitting a written application via the contact form or to destek@artolume.com:

• To learn whether your personal data is processed
• To request information if it has been processed
• To learn the purpose of processing and whether the data is used in accordance with that purpose
• To know the third parties in Türkiye or abroad to whom the data is transferred
• To request the correction of incomplete or inaccurately processed data
• To request erasure or destruction under Article 7 of the KVKK
• To request that correction/erasure operations be notified to the third parties to whom the data was transferred
• To object to a result to your detriment arising from the analysis of the processed data exclusively by automated systems
• To claim compensation if you suffer damage due to unlawful processing

8. Application

Your applications will be answered within 30 days at the latest, after identity verification. Your right to file a complaint with the Personal Data Protection Board is reserved.