1. Data Controller

Pursuant to the Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed as described below by the operator of Flompt, Kubilay Karaçar, an individual based in Istanbul, Türkiye, as data controller ("Flompt"). E-mail for personal data requests: [email protected] ([email protected] is monitored as well). This text will be updated with the company details when the operating entity is incorporated.

2. Purpose of Processing Personal Data

Your personal data is processed for the following purposes:

Performing membership transactions
Providing application services
Improving user experience
Conducting statistical analyses
Fulfilling legal obligations
Managing information security processes
Delivering a personalized content feed based on your in-app activity (can be turned off anytime in app settings)
Sending news about new features and prompt drops by email and push notification, only with your explicit consent

3. Processed Personal Data

The following personal data categories are processed:

Identity: name, surname, username, date of birth (age verification only)
Contact: e-mail address
Visual and audio: profile picture; photos, videos and voice messages you share
Content: prompts, comments, messages, AI Studio prompts and outputs
Transaction security: IP address, device information, log records, push token and per-install device identifier
Usage: in-app interactions, preferences, consent records
Purchases: subscription and credit purchase status reported by the App Store or Google Play (no card data)
Marketing (only with consent): advertising identifiers (IDFA/GAID)
Location: approximate location derived from your IP address (country/city)

4. Collection Method

Your personal data is collected by automated means through the Flompt mobile application and flompt.app: the information you enter when registering and using the app, the data generated by your use of it (interactions, device information, IP address, logs) and, where you choose them, the identity data provided by Google or Apple sign-in and the purchase status reported by the App Store or Google Play through RevenueCat.

5. Transfer of Personal Data

Your personal data may be transferred in accordance with the conditions specified in Articles 8 and 9 of KVKK to:

Authorized public institutions and organizations in case of legal obligation
DigitalOcean LLC (data stored in Frankfurt, Germany): cloud hosting and media storage
Cloudflare Inc. (USA): content delivery network and security services
Google LLC (USA): AdMob advertising services and AI features via the Gemini API (semantic search, automatic topic labeling, AI image generation)
RevenueCat Inc. (USA): subscription and in-app purchase management
650 Industries Inc. / Expo (USA): push notification delivery
OpenAI, L.L.C. (USA): automated content moderation
Replicate, Inc. (USA): AI Studio image generation and editing models
Functional Software Inc. / Sentry (USA): error tracking service
PostHog, Inc. (data processed in the EU region, Frankfurt): product analytics, while signed in only with your explicit consent; before sign-in only if you turn it on in the guest privacy screen
Resend Inc. (USA): transactional email delivery
Google LLC and Apple Inc. (USA): optional sign-in (identity token, account identifier, e-mail)
KLIPY (USA): GIF search terms and app language through our servers; GIFs load from KLIPY's servers
Apple Push Notification service and Firebase Cloud Messaging (via Expo): push delivery
Lawyers for the purpose of following legal processes

International data transfers are carried out with appropriate safeguards under KVKK Article 9 and applicable data protection law.

6. Legal Basis for Data Processing

Your personal data is processed based on the following legal grounds specified in Article 5 of KVKK:

Membership, service delivery, purchases: performance of the contract (Art. 5/2(c))
Age verification, record keeping and responding to authorities: legal obligation (Art. 5/2(ç))
Security, fraud prevention, crash reporting, product improvement, aggregate usage statistics (including those shown to creators about their posts) and feed personalization: legitimate interest (Art. 5/2(f))
Content you publish publicly: made public by you (Art. 5/2(d))
Establishing, exercising or protecting legal claims: Art. 5/2(e)
Analytics, ML training, marketing messages by email and push notification, and personalized advertising: your explicit consent (Art. 5/1), which you can withdraw at any time

Feed personalization relies on the performance of the contract and our legitimate interest (KVKK Art. 5/2(c) and (f)), not on explicit consent; you may object and turn it off at any time in the app under Settings > Data & ML Consent > Personalization. Usage statistics also rely on legitimate interest; you may object under Settings > Data & ML Consent > Object to usage statistics, and the raw records are then deleted.

7. Your Rights Under KVKK

Within the scope of Article 11 of KVKK, you have the following rights:

To learn whether your personal data is processed
To request information if it has been processed
To learn the purpose of processing and whether it is used in accordance with its purpose
To know the third parties to whom it is transferred domestically or abroad
To request correction if it is incomplete or incorrectly processed
To request deletion within the framework of the conditions in Article 7 of KVKK
To request notification of correction and deletion operations to third parties to whom it has been transferred
To object to the emergence of a result against you through the analysis of processed data
To request compensation for damages in case of damage due to unlawful processing

8. Application Method

You can submit requests under Article 11 of KVKK by e-mail to [email protected] from the e-mail address registered to your Flompt account, or with a secure or mobile electronic signature. We conclude requests free of charge as soon as possible and within 30 days at the latest (Communiqué on the Procedures and Principles of Application to the Data Controller, Articles 5 and 6). If your request is rejected, answered insufficiently or not answered in time, you may complain to the Personal Data Protection Board within 30 days of learning our answer and in any case within 60 days of your application (KVKK Article 14).

Email: [email protected]

In your application, you must clearly state which of the rights specified in Article 11 of KVKK you are using, along with information to verify your identity.

KVKK Disclosure Text