Privacy Policy

1. Data we collect

• Account data: your email address, name and profile picture (for example from Google, if you sign in with Google), your language and your account settings. Passwords are handled by our authentication provider and stored only in hashed form.
• Your content: the files, designs, documents and assets you create or upload, with their names, tags and folders.
• Payment data: payments are processed by Paddle.com, our merchant of record. We receive your Paddle customer and subscription identifiers, plan, billing period, payment status, amounts, currency and invoice numbers. We never receive or store your card details.
• Usage and device data: IP address and the approximate location derived from it, browser and device type, sign-in events and security logs, and how you use features, such as AI usage and storage used.
• Communications: the messages you send to our support.

2. How we use your data and why

Under KVKK, we process your data because it is necessary for the establishment or performance of a contract, to comply with our legal obligations, to establish, exercise or protect a right, and for our legitimate interests without harming your fundamental rights (Article 5(2) of KVKK).

• To provide the Service, your account and your plan (performance of a contract).
• To process payments, keep billing records and meet our tax and accounting duties (performance of a contract and legal obligation).
• To keep the Service and your account secure, detect abuse and fraud, and enforce limits and our Terms (legitimate interests, and legal obligation where it applies).
• To send service emails such as sign-in codes, security alerts and billing notices (performance of a contract and legitimate interests).
• To understand and improve the Service using aggregated usage data (legitimate interests).
• To train and improve our AI models with de-identified content while content training is on (legitimate interests). You can turn it off at any time (see section 3).

3. AI features

When you use an AI feature, the image you send is first checked by an automated content moderation service and then processed by an AI service provider. Providers delete these images within one hour. The result is saved to your files like any other asset, and we record which feature you used, when, and how many credits it used.

Content training: to improve Karbasa's AI features, we may use your content to train and improve our AI models. Before training, we take steps to de-identify it and remove personal and sensitive information from text and images; the models learn general design patterns, not your specific content. Content training is on by default. You can turn it off at any time with the Content training switch in Admin > Settings; from then on, your content is not used in new training, and models trained earlier are not changed.

4. Who we share data with

We share personal data only with service providers that help us run the Service, under contracts that limit how they may use it, and with authorities where the law requires. Our providers are:

• Supabase: database and authentication (Frankfurt, Germany)
• Fly.io: application servers (Frankfurt, Germany)
• Upstash: temporary data for rate limiting and caching
• Cloudflare: file storage and content delivery
• Vercel: website hosting, cookieless analytics and performance measurement
• Paddle: payments, taxes and invoices, as merchant of record
• Resend: delivery of service emails
• Sentry: error monitoring
• Amazon Web Services: content moderation for AI features (Frankfurt, Germany)
• Replicate: AI image processing
• Google: sign-in with Google, if you choose it

5. Paddle

Paddle is an independent controller for the payment data it collects at checkout. Its privacy notice explains how it uses that data.

6. International transfers

Our database and application servers are in the European Union. Some providers, such as Paddle, Resend, Sentry, Replicate and Vercel, may process data in other countries, including the United States. Where the law requires, we protect these transfers with standard contractual clauses, the standard contracts provided for under KVKK or other lawful safeguards.

7. How long we keep data

• Account data and your content: while your account is active. If you delete your account, we keep it for 30 days so that it can be restored, and then delete it permanently.
• Files in the trash: deleted permanently after 30 days.
• Billing records: as long as tax and commercial laws require.
• Security logs: for the limited period needed to protect the Service.
• Records of AI usage: kept for accounting and abuse prevention, without your identity once your account is deleted.

8. Your rights

Depending on where you live, you can ask us to:

• tell you whether we process your data, and give you a copy of it;
• correct inaccurate data, and delete data we no longer need;
• restrict or object to certain processing, including processing based on legitimate interests;
• give you your data in a portable format;
• tell you which third parties received your data, and compensate damage caused by unlawful processing (your rights under Article 11 of KVKK).

9. How to use your rights

Send your request to support@karbasa.com from the email address on your account. We will reply within 30 days. If you are not satisfied with our reply, you can complain to the Personal Data Protection Authority in Türkiye or to your local data protection authority.

10. Cookies and local storage

We use only what the Service needs to work:

• a cookie that tells the website you are signed in, and a cookie that remembers your language;
• your browser's local storage, which keeps your sign-in session and, in the editor, the document you are working on;
• Vercel Web Analytics and Speed Insights, which measure visits and page performance without cookies and without identifying you across websites.

11. Security

We protect your data with encryption in transit, access controls and signed, time-limited links to your files. No system is completely secure; if you find a security problem, tell us at support@karbasa.com.

12. Children

The Service is not directed to children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy. If a change materially affects you, we will tell you by email or in the Service. The date at the top of this page shows the latest version.

14. Contact

TAKIM48 MEDYA REKLAM TASARIM YAPIM EGITIM VE TICARET LTD STI

Email: support@karbasa.com