Privacy Policy

Anyone who browses our Application, creates an account, or uses our Services is concerned by the collection and processing of their personal data described here.

Our Application and Services are not intended for and should not be used by children under the age of 13. We do not knowingly collect personal data from children under 13. Users under 18 must have permission from their parent or guardian to use our Services.

Under the European General Data Protection Regulation (“GDPR”) No. 2016/679, in force since 25 May 2018, personal data means any information relating to an identified or identifiable natural person, such as a name, email address, telephone number, or IP address.

In order to provide access to and use of the Application and the Services, Crevo processes several categories of personal data, for different purposes, legal bases and retention periods, as described in the table below.

Crevo indicates to you at the time of collection which personal data is mandatory in order to benefit from the Application and the Services. The others are optional.

In any event, Crevo undertakes to delete personal data at the end of the retention periods above.

Additional information about training our AI models

By using Crevo, you acknowledge that we process and use the images you upload to improve, train, and develop Crevo’s products, services, and models. You can opt out of this at any time by changing the settings on your account. The opt-out has no retroactive effect on processing already carried out.

Crevo limits the data used to what is strictly necessary for this purpose. Images used for training and improving the models are selected and annotated without any additional information about your identity; for this purpose we do not collect your name, contact details, identity, location, or any other personal data.

4.1. Crevo personnel

Only authorised Crevo personnel may access your personal data, and only to ensure the proper functioning of the Application, to provide you with the Services, and to respond to your requests.

4.2. Sub-processors

Your personal data may be transmitted to third-party processors involved in the provision of the Services — hosting and technical providers, notification and email delivery, product analytics, subscription management, and security incident handling. The processors we currently rely on are:

• Google (Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Storage) — Account creation and sign-in, storage of your account record and generated images, and the server-side functions that run the AI tools. Processing region: United States and other regions where Google operates.
• RevenueCat — Subscription state and entitlements, and reconciliation of purchases made through the App Store, Google Play, and on the web. Processing region: United States.
• Polar — Payment processing for subscriptions purchased on the web — Polar is the merchant of record, collects your payment details, and charges your chosen payment method. Processing region: United States.
• PostHog — Product analytics — which features are used, and where flows fail — so the product can be improved. Processing region: United States or European Union, depending on the deployment region.
• Meta Platforms and Google Ads — Advertising measurement and audience building, only where you have consented to advertising cookies and identifiers. Processing region: United States.
• Adjust — Attribution — establishing which campaign an install or sign-up came from. Processing region: European Union.

Each processor acts on our documented instructions under a contract that requires it to keep your data confidential and to use it only to provide the service we have engaged it for.

4.3. Cookie providers

Your personal data is transmitted to third parties placing cookies on the Services according to the choices you make in the cookie banner and subject to your consent. Analytics, advertising, and attribution cookies are not set before you consent to them.

4.4. Disclosure for legal reasons

Personal data may be disclosed to a third party if Crevo is required to do so by law, regulation, or court order, or if such disclosure is necessary for the purposes of an investigation, injunction, or legal process, whether domestically or abroad.

Crevo is established in Türkiye, and your personal data is processed there and by the service providers listed in section 4.2, several of which are established in the United States. Personal data is therefore routinely transferred across borders in both directions.

If you are in the European Economic Area or the United Kingdom, your personal data leaves the EEA when it reaches us. Türkiye is not the subject of a European Commission adequacy decision, so we rely on appropriate safeguards under Chapter V of the GDPR — ordinarily the European Commission’s Standard Contractual Clauses, together with the supplementary measures those clauses require — to ensure a level of protection essentially equivalent to that guaranteed within the EEA. The same applies to onward transfers to our processors.

Transfers out of Türkiye are governed by article 9 of Law No. 6698. We carry them out on the basis of an adequacy decision of the Personal Data Protection Board where one covers the recipient country, and otherwise on the basis of a standard contract notified to the Board, binding corporate rules, or another lawful ground provided by that article.

You may request a copy of the safeguards we rely on for a particular transfer by writing to privacy@senal.software.

Under the GDPR you have rights over your personal data. In particular:

• Right of access: you can request access to the personal data we process about you.
• Right to rectification: you can ask us to correct or modify personal data about you that we process.
• Right to erasure (right to be forgotten): you can request deletion of your personal data, in particular where it is no longer needed by Crevo, where you have withdrawn your consent, or where you have objected to the processing.
• Right to restriction of processing: you can request that we restrict processing of your personal data. Note that this may affect the quality or level of the Services.
• Right to data portability: you can request the transfer of your personal data to another provider, where technically feasible.
• Right to object: you can object to processing based on our legitimate interest, for reasons relating to your particular situation.
• Right to determine what happens to your data after your death, or to nominate a trusted third party to whom Crevo can entrust your personal data.
• Right to withdraw your consent at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.

Before we can respond to a request to exercise one or more of your rights, we may ask you to confirm some of your account information in order to verify your identity.

Crevo undertakes to respond to requests concerning this Privacy Policy or the exercise of your rights as soon as possible and within one calendar month of receipt, as provided by the GDPR. If your request is complex, or if you have made several requests, the response time may extend to three calendar months from the date of receipt. Where Law No. 6698 applies to your request, we will respond within thirty days at the latest.

If you believe that the processing of your personal data is unlawful, you have the right to lodge a complaint with the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) under Law No. 6698. If you are in the European Economic Area or the United Kingdom, you may instead complain to the supervisory authority of your own country of residence or place of work — because we are not established in the Union, no single lead authority handles complaints about us, and your national authority is competent to receive yours.

This Privacy Policy may be amended and updated to reflect changes in Crevo’s data protection practices, or to remain compliant with regulations as they change.

Where a change is material, we will inform you of it before it takes effect — by email to the address on your account, or by a notice in the Application.

We provide this California Privacy Notice to comply with applicable privacy laws in the State of California, including the California Consumer Privacy Act of 2018 and its amendment, the California Privacy Rights Act of 2020 (together, the “CCPA”). Any capitalised term used and not otherwise defined below has the meaning assigned to it in this Privacy Policy.

This notice supplements the information in this Privacy Policy and applies to any California resident about whom we have collected Personal Data from any source, including offline and through your use of our Services.

The CCPA provides California residents with rights to receive certain disclosures regarding the collection, use, and sharing of Personal Data, as well as rights to access, delete, correct, limit, and opt out of the sale of certain Personal Data we collect about them, and to opt out of the sharing of certain Personal Data for purposes of cross-context behavioural advertising (called “sharing” under California law). California residents also have the right not to receive discriminatory treatment for exercising their privacy rights under the CCPA.

For the purposes of this notice, except where a different definition is noted, “Personal Data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household. Personal Data does not include publicly available information; lawfully obtained, truthful information that is a matter of public concern; information that has been de-identified; or information that has been aggregated.

The Personal Data we may collect from California residents within the last twelve months is listed in section 3 of this Privacy Policy. Because of the overlapping nature of the categories required by state law, some of the Personal Data we collect may reasonably be classified under multiple categories.

i. Uses of Personal Data

Crevo may collect, use, or disclose Personal Data about California residents for the purposes set out in this Privacy Policy.

ii. Sources of Personal Data

• From you — when you register for a Crevo account, when you contact us, and automatically as you use the Services.
• Through our service providers — the third-party companies listed in section 4.2, which help us provide the Services consistently with the purposes detailed in this Privacy Policy.
• From our business partners and others, including those that may promote or offer products and services that may be of interest to you.

iii. Disclosure of Personal Data

We may disclose your Personal Data to service providers and third parties as described in section 4 of this Privacy Policy. This includes disclosure for a business purpose — the reasonably necessary and proportionate use of personal information for our operational purposes, the operational purposes of our service providers and contractors, and other purposes compatible with the context in which the Personal Data was collected.

When we disclose Personal Data for a business purpose, we enter into a contract that describes the purpose and requires the recipient both to keep that Personal Data confidential and not to use it for any purpose except performing the contract.

Crevo does not “sell” or “share” Personal Data as those terms are defined by the CCPA.

iv. Your privacy rights

If you are a California resident, you have the right to make the following requests in relation to your Personal Data, subject to certain exceptions:

• Right to know (or access). Up to twice in a 12-month period, you may request what Personal Data we collect, use, and disclose, and to whom. You may request either a report disclosing the general categories of Personal Data we collect, or one disclosing the specific pieces of personal information.
• Right to delete. You may request, in certain circumstances and subject to exceptions, deletion of the Personal Data we collect.
• Right to opt out of sale or sharing. You may opt out of the “sale” or “sharing” of your Personal Data as those terms are defined under the CCPA. As noted above, Crevo is not currently engaged in such activity.
• Right to limit use and disclosure. You may limit the use or disclosure of your sensitive personal information to the uses necessary to provide the Services reasonably expected by the average user, or for certain other authorised purposes.
• Right to correct. You may request correction of inaccurate Personal Data we maintain about you, subject to our ability to reasonably verify its accuracy.
• Right to non-discrimination. You have the right not to receive discriminatory treatment for exercising these rights.

How to submit a request

To exercise any of the rights described above, submit a verifiable consumer request to us by email at privacy@senal.software, or by post to ŞENAL YAZILIM DANIŞMANLIK TİCARET VE İTHALAT İHRACAT LİMİTED ŞİRKETİ, Gülbahçe Mah. İçmeler Cad. No: 14 /1 İç Kapı No: B05 35433, Urla / İzmir / Türkiye.

Any request is subject to an identification and residency verification process (a “Verifiable Consumer Request”) as permitted by the CCPA. We will not fulfil a request unless you have provided sufficient information to let us reasonably verify that you are the consumer about whom we collected the Personal Data. To verify you, we will ask for your first and last name and the email address associated with your Crevo account, in addition to any further information we reasonably request.

Requests by authorised agents

You may designate an authorised agent, in writing or through a power of attorney, to exercise these rights on your behalf. We may require that you provide your agent with written permission and that you verify your own identity with us. If your agent does not submit proof of authorisation, we reserve the right to deny the request and will explain why. An authorised agent may submit a request by emailing the letter of authorisation or power of attorney to privacy@senal.software.

Responses

We will respond to a Verifiable Consumer Request within forty-five (45) days of receipt, for a period covering twelve (12) months and no more than twice in a twelve-month period. We reserve the right to extend the response time by a further forty-five (45) days where reasonably necessary, provided we notify you of the extension within the first forty-five days.

These rights are subject to exclusions and exceptions under California and other applicable law. If we are unable to verify your identity to the degree of certainty required by the CCPA through any reasonable method, we will say so in a written response and explain why no reasonable method of verification is available.

Household data

Accounts on our Application are maintained on an individual-by-individual basis, and we do not currently collect Personal Data at the household level. If we receive a request submitted by all members of a household, we will respond to each request individually. We cannot comply with a request by a member of a household under the age of 13, as we do not collect Personal Data from any person under 13.

Direct marketing by third parties

Crevo does not disclose personal information to third parties for their own direct marketing purposes. California residents nonetheless have the right to request information regarding such practices under California’s “Shine the Light” law; to enquire, email privacy@senal.software.

We will continue to update our business practices as direct regulatory guidance becomes available.

This section is the disclosure required by article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”). It supplements the rest of this Privacy Policy and applies to everyone whose personal data we process, since we are established in Türkiye. Where this section and an earlier one differ in detail, this section governs for the purposes of the KVKK.

i. The data controller

The data controller (veri sorumlusu) is ŞENAL YAZILIM DANIŞMANLIK TİCARET VE İTHALAT İHRACAT LİMİTED ŞİRKETİ, a Turkish limited liability company registered under company number 250843, with its registered office at Gülbahçe Mah. İçmeler Cad. No: 14 /1 İç Kapı No: B05 35433, Urla / İzmir / Türkiye. You can reach us about this notice at privacy@senal.software.

ii. How we collect your personal data

We collect personal data by automated and partly automated means through the Application — when you create an account or sign in, when you upload images and generate results, when you subscribe, when you contact support, and through the cookies and SDKs described in this policy. We do not collect personal data about you from data brokers.

iii. Purposes and legal grounds under article 5

The purposes for which we process personal data are the ones set out in the table in section 3. The legal grounds relied on under article 5 of the KVKK are:

• Necessity for the performance of a contract (art. 5/2-c) — creating and operating your account, generating and storing the images you ask for, and taking and reconciling payment.
• Compliance with a legal obligation (art. 5/2-ç) — retaining accounting and transaction records, and moderating content where the law requires it.
• Establishment, exercise, or protection of a right (art. 5/2-e) — retaining records needed to defend or bring a claim.
• Our legitimate interests, where your fundamental rights and freedoms are not harmed (art. 5/2-f) — keeping the Services functional and secure, product analytics, preventing refund fraud, and improving and training our models.
• Your explicit consent (açık rıza, art. 5/1) — optional profile data, marketing email, and the advertising and attribution cookies and identifiers described in section 4.3. Consent can be withdrawn at any time, and withdrawal does not affect processing already carried out on that basis.

We do not ask for and do not knowingly process special categories of personal data within the meaning of article 6. Please do not upload images or text revealing health, biometric or genetic data, religious or philosophical belief, political opinion, trade union membership, criminal convictions, or similar.

iv. Recipients and transfers abroad

The recipients of your personal data, and the purposes for which they receive it, are listed in section 4. Transfers outside Türkiye are made under article 9 of the KVKK, on the grounds described in section 5.

v. Your rights under article 11

As a data subject (ilgili kişi), you have the right to:

1. 1.learn whether your personal data is being processed;
2. 2.request information about it if it has been processed;
3. 3.learn the purpose of the processing and whether the data is used in accordance with that purpose;
4. 4.know the third parties in Türkiye and abroad to whom your personal data has been transferred;
5. 5.request that incomplete or inaccurate personal data be corrected;
6. 6.request that your personal data be erased or destroyed under the conditions of article 7;
7. 7.request that a correction, erasure, or destruction be notified to the third parties to whom the data has been transferred;
8. 8.object to a result reached against you by the exclusively automated analysis of your personal data; and
9. 9.claim compensation for damage suffered as a result of unlawful processing of your personal data.

vi. How to exercise them

Under article 13 of the KVKK and the Communiqué on the Procedures and Principles of Application to the Data Controller, you may apply to us in writing at the registered office above, or electronically through your registered electronic mail (KEP) address, a secure electronic signature, a mobile signature, or the email address you have already notified to us and which is registered in our systems — in practice, the address on your Crevo account, writing to privacy@senal.software.

Your application must state your name, nationality or identification number, address or the email address registered with us, and the subject of your request, together with any supporting information. We will conclude the request free of charge and as soon as possible, and within thirty (30) days at the latest. Where the request requires additional cost, we may charge the tariff set by the Personal Data Protection Board.

If we reject your application, our answer is unsatisfactory, or we do not respond in time, you may lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) under article 14 — within thirty (30) days of learning our response and in any event within sixty (60) days of the date of your application.