KVKK · Law No. 6698, Article 10
This notice has been prepared by Fırat Erol, acting as data controller, pursuant to Article 10 of Turkish Personal Data Protection Law No. 6698 (the "Law") and the Communiqué on the Procedures and Principles for Fulfilling the Disclosure Obligation.
| Category | Data processed |
|---|---|
| Identity | Nickname, profile picture, app-generated identifier, system-assigned unique user identifier |
| Contact | Email address, phone number — only for accounts created in earlier versions of the App; no longer collected |
| Visual records | Hand photos (up to 4), AI-generated design images |
| Transaction security | Secret key hash (SHA-256), session token hash (earlier versions), IP address, device identifier, client information (user-agent) |
| Customer transaction | Subscription status and dates, product identifier, entitlement identifier, store information |
| Marketing / usage | Like records, favorite themes, generation history, free-text design requests |
Your personal data is collected electronically, through the mobile application, by fully automated means and based on your own declaration.
| Data / activity | Legal ground (Law, Art. 5) |
|---|---|
| Account creation via device identifier; identity, contact, and subscription data | Directly related to the conclusion or performance of a contract (Art. 5/2-c) |
| Secret key hash, session token, IP address | Legitimate interests of the data controller (Art. 5/2-f) and performance of a contract (Art. 5/2-c) |
| Processing hand photos and generating designs with AI | Explicit consent (Art. 5/1) |
| Transferring hand photos and design requests to an AI provider located abroad | Explicit consent (Art. 9) and/or standard contractual clauses notified to the Authority |
| Retention of billing and transaction records | Compliance with a legal obligation (Art. 5/2-ç) |
| Keeping usage statistics and improving service quality | Legitimate interests (Art. 5/2-f) |
A note about hand photos: Your hand photos are processed solely so that nail art can be rendered on your nails. They are not used for identity verification or person recognition. Nevertheless, to ensure the highest level of data protection, we treat this data as subject to explicit consent and do not process it without your consent.
| Recipient group | Data transferred | Purpose | Location |
|---|---|---|---|
| AI service providers (Features & Labels, Inc. — fal.ai; Google LLC — Gemini API) |
Hand photos, free-text design requests, reference design and theme images | Generating the design image (fal.ai); verifying uploads and describing reference designs (Gemini) | Abroad (United States) |
| Subscription infrastructure provider (RevenueCat, Inc.) |
Unique user identifier, subscription and purchase data | Validating and managing subscription status | Abroad (United States) |
| App marketplace (Apple Inc.) |
Purchase and payment data | Subscription sales and billing | Abroad (United States / Ireland) |
| Hosting service provider | All application data | Server and database hosting | Abroad — Hetzner Online GmbH, Finland (EU) |
| Authorized public institutions | Requested data | Statutory duty to provide information | Domestic |
| Legal, accounting, and audit service providers | Relevant transaction records | Fulfilling legal obligations and protecting legal rights | Domestic |
Transfers abroad. Under Article 9 of the Law, transfers to countries without an adequacy decision are carried out on the basis of your explicit consent and/or appropriate safeguards such as standard contractual clauses notified to the Turkish Data Protection Authority.
| Data | Retention period |
|---|---|
| Account and contact data | For the duration of membership; destroyed within 30 days of account deletion |
| Hand photos | Until deleted by the user or the account is closed; destroyed immediately upon withdrawal of consent |
| Generated design images | For the duration of membership |
| Session tokens (earlier versions of the App only) | 30 days (invalidated automatically thereafter) |
| Rate-limit records | 60 seconds |
| Billing and financial records | 5 years under the Tax Procedure Law; 10 years under the Turkish Commercial Code |
Personal data whose retention period has expired is deleted, destroyed, or anonymized, either on our own initiative or upon your request, in accordance with the Regulation on Deletion, Destruction or Anonymization of Personal Data.
Under Article 11 of the Law, by applying to the data controller you have the right to:
You may submit requests concerning the rights above, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, through any of the following channels:
Depending on the nature of the request, your application is concluded free of charge within 30 days at the latest. If the process requires an additional cost, a fee set in the tariff determined by the Board may be charged.
If your application is rejected, if you find our response insufficient, or if we fail to respond in time, you may file a complaint with the Turkish Data Protection Board within 30 days of learning our response and, in any case, within 60 days of your application date. See kvkk.gov.tr.
This document is provided for information purposes only and contains no declaration of consent. For processing activities that require consent, please see the separate Explicit Consent Statement.