Privacy Policy and KVKK Information Notice

Last updated: October 1, 2026 · Effective: October 1, 2026

1. Data Controller

This information notice has been prepared by the data controller named below under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and related legislation. For users in the EU and the UK, it is also our notice under the General Data Protection Regulation (GDPR). dotAI ("App") is an app that creates photos, videos and audio with artificial intelligence.

2. In Short

• You can use dotAI without giving us your name, email address or phone number; a device account is created automatically the first time you open the App.
• We use your photos and prompts only to create the results you ask for, keep them in your Library and keep the Service safe.
• There is no public feed in dotAI; your work is not shown to other users unless you share it.
• We do not sell your data and we do not track you for advertising.
• You can delete your account at any time in Settings › Delete account.

3. Personal Data We Process

dotAI is not designed to collect health data or other special categories of personal data (KVKK Art. 6). We do not use your photos to recognize the people in them, and we do not extract face templates or biometric identifiers.

What we don't collect: your name, phone number, contacts, location or advertising identifier (IDFA). We don't read your photo library: you pick each photo yourself, and saving to your library uses "add only" access.

4. Purposes of Processing

• Creating and running your account and, if you linked it, restoring it on another device — performance of a contract.
• Creating the photos, videos and audio you ask for, keeping them in your Library and letting you download and share them — performance of a contract.
• Adding, spending and refunding credits; running your subscription — performance of a contract and legal obligation.
• Reviewing "Report a problem" reports and deciding on credit refunds — performance of a contract and legitimate interest.
• Preventing abuse of usage limits and offers, fraud and prohibited content, including automated content filters — legitimate interest.
• Letting you know that a job is ready or that your report has been resolved — consent.

5. Photos and AI Processing

When you confirm a job, the photos, prompt and settings you chose for it are sent through our servers to fal.ai and its model partners (Google, ByteDance, Kling, MiniMax, ElevenLabs) and are processed only to provide the Service to you, under those providers' terms.

• Model training: fal.ai does not use your photos, prompts or results to train models; only anonymized or aggregated usage data may be used.
• Copies at providers: These providers may keep copies of a job's inputs and outputs for a limited time.
• If another person can be recognized in a photo, you confirm under the Terms of Use that you have that person's consent.

6. Transfers Abroad (KVKK Art. 9)

AI generation and some infrastructure services require your data to be transferred to recipients outside Türkiye. These transfers are made in line with KVKK Art. 9. For data covered by the GDPR, transfers outside the EU/EEA rely on an adequacy decision or the EU Standard Contractual Clauses; fal.ai's data processing agreement includes the EU/UK Standard Contractual Clauses.

7. Service Providers (Processors)

We may also disclose data where the law requires it (for example, under a court order) and to report child sexual abuse material to the authorities.

8. Retention and Deletion (KVKK Art. 7)

• Your personal data is kept for as long as your account is active and as needed for the purposes above.
• Results are kept until you delete them from your Library or delete your account.
• Photos you upload are kept only as long as needed to provide the Service and are deleted from our storage at the latest when you delete your account.
• Agent chat messages (once available) are deleted 12 months after they are sent.
• When you delete your account (Settings › Delete account), deletion takes effect immediately: your account, sign-in data, the photos and results in our storage, your jobs, chats, routines, your own agents, your credit history and your remaining credits (which are not refunded) are deleted; your customer record at RevenueCat is deleted; and if you linked Apple, dotAI's access to your Apple ID is revoked. If you used an older version of the App, purchase data at Adapty is kept under Adapty's retention rules; you can ask us to request its deletion.
• Kept after account deletion, only for as long as needed for these purposes:
  • App Store transaction IDs and the credits they added, with your user ID removed (so the same purchase is never credited twice), and transaction records for as long as tax and accounting law requires;
  • abuse-prevention data (a hash of the device identifier and the DeviceCheck marker), so that limits cannot be reset by deleting the account;
  • a technical record of the deletion request and its outcome;
  • our hosting provider's request logs, for their standard retention period.
• Copies held by fal.ai and its model partners are deleted when their retention period ends (see Section 5); deleting your account may not reach them.
• Deleting your account does not cancel an App Store subscription, and deleting only the App does not delete your account.

9. Your Rights (KVKK Art. 11)

Under KVKK Art. 11, you have the right to learn whether your personal data is processed and, if so, to request information about it; to learn the purpose of the processing and whether the data is used accordingly; to know the third parties in Türkiye or abroad to whom it is transferred; to ask for it to be corrected if it is incomplete or inaccurate, and to be deleted or destroyed, and for these actions to be notified to the third parties to whom it was transferred; to object to a result against you that arises solely from automated analysis; and to claim compensation for damage caused by unlawful processing. If the GDPR applies to you, you also have the right to restrict processing, the right to data portability and the right to object to processing based on legitimate interest. In the App you can:

• delete your account and the data linked to it — Settings › Delete account;
• withdraw notification permission — iOS Settings › Notifications.

Send other requests to support@dotaiapp.com or in writing to the address in Section 1. We may ask for information to confirm that the account is yours, and we respond within the period set by KVKK (at most 30 days). You can complain to the Turkish Personal Data Protection Board (kvkk.gov.tr) or, if you live in the EU or the UK, to your local data protection authority.

10. Cookies and Tracking

dotAI is a mobile app. It does not track you across apps or websites for advertising, does not ask for Apple's App Tracking Transparency permission and does not collect the advertising identifier (IDFA). The App contains no third-party analytics or advertising SDK; the purchase SDK only handles purchases.

11. Children's Privacy

dotAI is not intended for children under 13 and does not knowingly collect personal data from anyone under 13. If you are under 18, or under the age at which you can consent to digital services on your own in your country (16 in some EU countries), you may use dotAI only with the consent of a parent or legal guardian. If we learn, or are told at support@dotaiapp.com, that a child has given us data without permission, we delete it.

12. Security

We keep data in systems with row-level access control and encrypt data in transit; service keys are kept on our servers, not in the App. No system is perfectly secure. If a breach affects you, we will notify you and the authorities as the law requires.

13. Changes

We may update this policy from time to time. We will inform you in the App about significant changes; the latest version is always published on this page.

14. Contact

For anything about privacy: support@dotaiapp.com · Berk Demir, Nevşehir / Merkez, Türkiye.