Privacy Policy

1. Who is responsible

Kolayza is the data controller (“veri sorumlusu” under KVKK) for the personal data described here. Kolayza is run by its founder as an individual. It is not yet a registered company. Email: info@kolayza.com.

For any privacy question or request, write to info@kolayza.com.

2. The short version

• We use your data to run Kolayza for you: your account, your credits and the images and videos you make.
• To make images and videos, we send your prompts and files to AI providers (Google, OpenAI and BytePlus). They process them to do the job. We send them no name or email address.
• Your files are stored at long links that are hard to guess, but anyone who has a link can open the file.
• We do not sell your data, show ads or send marketing emails, and we do not use your content to train AI models.
• You can delete chats, images, videos, designs, brand kits and Creators in the app, and ask us by email for a copy of your data or to delete your account.

3. What we collect

Account data. Your email address, your name, a hash of your password (never the password itself), your language, your account type, the features turned on for you, your credit balance, and dates such as when the account was made, when you last signed in and when you were last active.

What you give us. Prompts and chat messages, notes and product facts you type, the photos, videos, audio and logos you upload, brand kits (logos, colours, font names), editor designs, and the details of the UGC presenters (“Creators”) you set up: a name, gender, age (18 or over), hair and style words.

What we make for you. Images, videos, video stills, voice samples, captions, ad texts, video plans, and the prompts our system writes from your request.

Usage and billing records. What you made and when, the feature and model, credits charged or refunded, errors, and the credits we add to your account. For our cost tracking we log each AI call (provider, model, size, cost, duration) with your account id but without the prompt. If you pay us outside the site (for example by bank transfer), we keep that payment record.

Technical data. Your IP address and browser details reach our servers and providers with every request. We use the IP address only for short-lived rate limits and to block attacks. Error reports contain the request or page that failed, your browser and device, and your account id.

From Claude, if you connect it: the requests Claude sends for you (prompts, settings, notes and the files to use), files you upload through the Kolayza upload card or page, and connection records (which app, when, and how a connection ended).

Emails you send us, with our replies.

What we do not collect. No payment card details: there is no checkout on the site. We do not ask for special categories of personal data (such as health, religion or biometric data) and do not use face or voice recognition. The faces of Creators are made by AI from words, not from a photo of you. Please do not upload sensitive data about yourself or others.

What you must give us. No law requires you to give us personal data, but some is needed for our contract. To have an account we need your email address and a password; without them we cannot open one. To make an image or a video we need the content you send for it (your prompt and any photo, video or audio you attach); without it nothing can be made. Everything else, such as your name, brand kits and Creators, is optional.

4. How we collect it

• From you, electronically: the forms, uploads and chats on the site, and the emails you send us.
• Automatically as you use the site: server logs, usage and credit records, error reports and your browser’s storage.
• From Claude, when you connect it and use Kolayza there.
• From AI providers, which return the results you asked for.
• From payment records, when you pay us outside the site.

5. Why we use it, and the legal basis

• To provide the service: run your account, make what you ask for, store and show your work, keep your credits. Basis: performing our contract with you (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).
• To keep the service safe and working: sign-in protection, rate limits, error reports, preventing abuse and fraud, checking the quality of results, support. Basis: our legitimate interest in a secure, working service (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
• To understand the site: page-view statistics and speed measurements, cost and usage reports. Basis: legitimate interest (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
• To meet legal duties: accounting and tax records, answers to authorities. Basis: legal obligation (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)).
• To establish, use or defend legal claims. Basis: KVKK Art. 5(2)(e); GDPR Art. 6(1)(f).

We do not make decisions about you based only on automated processing that have legal or similarly significant effects. AI is used to make the content you ask for.

6. AI providers

To make what you ask for, we send the content needed to these providers through their paid APIs. They process it for us and return the result. They check requests automatically for misuse and may refuse some.

• Google (Gemini API). Prompts and images for image making and editing, style images, resizing and image analysis; the Turkish lines of a video, to be read aloud as a voice guide; prompts and images for Gemini Omni videos. On the paid service Google does not use them to improve its products. It keeps prompts and results for 55 days to detect misuse, may store them in any country where it has facilities. Gemini API terms.
• OpenAI (API). Prompts, notes and product photos for writing prompts (Smart mode), video plans, captions, ad texts and image analysis; prompts and images for GPT Image. OpenAI does not use API data to train its models. It keeps it for up to 30 days to detect abuse, longer only where the law requires it or to protect its services or others from harm. OpenAI: your data.
• BytePlus (ModelArk). Prompts, reference photos, videos and audio, and the clip to edit, for Seedance videos; text descriptions for Creator portraits (Seedream). With videos we send a one-way hashed code of your account (not your name or email), which BytePlus asks for to detect abuse. BytePlus does not use this data to train its models. It processes it in Malaysia, Indonesia and/or the EU, keeps task records for 7 days and result links for 24 hours, keeps inputs and outputs caught by its content filter for 180 days in Malaysia, and recognises the outputs it made that show a face for 30 days, so it keeps a record of those outputs for that time. BytePlus ModelArk data processing.

Files are often sent as their links (see Your files and their links), so the provider fetches them from our storage.

7. Who else receives data

• Vercel hosts the site. Its server functions for Kolayza run in Frankfurt, Germany. Your files are stored in Vercel Blob and delivered through Vercel’s worldwide network. Server logs are kept for 1 day.
• Neon runs our database in AWS Europe (Frankfurt, Germany).
• Sentry receives error reports and performance traces and stores them in Frankfurt, Germany.
• Google Fonts: when you open the editor or a brand kit, your browser loads fonts from Google’s servers, which receive your IP address and browser details. Google uses them to answer the request and for security, and sets no cookies.
• AI providers, as described above.
• Anthropic, only if you connect Claude (see below).
• Authorities, when the law requires it, for example under a court order.
• A successor: if Kolayza is transferred, for example to a company we register to run it, your data moves with it under this policy. We will tell you.

The people who run Kolayza (today, its founder) can see accounts and the content in them, including prompts and results, for support, quality and abuse checks. We do not sell your personal data or share it for advertising.

8. If you connect Claude

• Claude signs in to your Kolayza account through OAuth, and you approve each connection. We store the codes and tokens only as keyed hashes, never in readable form.
• Claude sends us the requests it makes for you, and we return the results to your Claude chat.
• What you write to Claude and what Claude shows you is handled by Anthropic under its own terms and privacy policy. Anthropic does not process data for us, and we do not process data for Anthropic: each is responsible for its own part.
• We keep the records of a connection (the app, when it connected and was last used, how it ended) until 8 days after it ends, then delete them.
• You can see and end your connections on the Claude page of your dashboard.

9. Transfers abroad

Because the service runs on these providers, your data is processed outside Türkiye:

• Germany (EU): our database at Neon (your account, content records, usage and credit records), our server functions at Vercel, and error reports at Sentry.
• United States: Vercel, which hosts the site and your files and has its main processing facilities in the US; OpenAI, which receives the prompts, notes and images sent for its features; Google, which receives the prompts, images and texts sent to the Gemini API (and may process them in any country where it has facilities), and your IP address when your browser loads Google Fonts.
• Malaysia, Indonesia and/or the EU: BytePlus, which receives the prompts, reference files and hashed account code sent for videos and Creator portraits.

Data can also pass through other countries where these providers run their networks. For questions about a transfer, write to info@kolayza.com.

10. Your files and their links

Images, videos, audio and logos are stored in Vercel Blob. Each file has a long link with a random part that is hard to guess. The storage is public: anyone who has the link can open the file, without signing in. The site, your Claude chat and the AI providers use these links to show or fetch your files.

Share a link only with people you want to see the file. If a link has leaked, delete the file in the app or write to us. A deleted file disappears from Vercel’s cache within about a minute.

A video, or its still, used in a saved design or template stays stored while that design uses it, even after you delete the video in its chat. A template we copy into another account (for example for a client) points at the same files.

11. How long we keep data

• Your account and your content: as long as your account exists, until you delete an item or until you ask us to delete your account. Nothing expires automatically.
• Deleting in the app: deleting an image, a video or a whole chat deletes it and its files (result, still, uploaded references, voice guide); only a video file that a saved design still uses is kept. Deleting a design deletes it and its preview image. Deleting a brand kit or a logo deletes the logo files. Deleting a Creator deletes its portraits, face and voice sample. Videos uploaded in the editor can be deleted there.
• Images and music uploaded in the editor cannot be deleted in the app yet. Write to us and we will delete them.
• Deleting your account: we delete it within 30 days of your request. Its database records (your content, usage and credit records, Claude connections) and its stored files are deleted together. The only files kept are those that another account’s saved design or template still uses, for as long as that design uses them.
• Kept after an account is deleted: our cost records of AI calls keep the account id, without name, email or content; payment records, for as long as tax and commercial laws require.
• Claude connection records: 8 days after the connection ends. Files sent with the upload card but never used: deleted about a day after the upload link expires.
• Server logs: 1 day. Rate-limit counters: at most 1 hour. Error reports: up to 90 days at Sentry.
• Your browser keeps its own storage until you clear it (see Cookies).
• AI providers keep data under their own terms, as described in AI providers.

12. Security

• All connections use HTTPS.
• Passwords are stored only as bcrypt hashes; Claude codes and tokens only as keyed hashes.
• File links carry a long random part.
• Sign-in attempts and costly actions are rate-limited.
• Signed-in pages and admin areas are checked on the server.
• Error reports are scrubbed of request bodies, cookies, passwords, tokens and email addresses.

No system is completely secure. If a breach affects your data, we will tell you and the authorities as the law requires.

13. Cookies and browser storage

We use only the cookies needed to sign you in and keep you signed in. We use no advertising or tracking cookies.

• __Secure-next-auth.session-token: your sign-in session (encrypted). Lasts 7 days and is renewed while you use the site.
• __Host-next-auth.csrf-token: protects the sign-in forms. Ends when you close the browser.
• __Secure-next-auth.callback-url: the page to return to after signing in. Ends when you close the browser.

The site also keeps some settings in your browser’s storage, which stays on your device: your language on public pages, your colour theme, editor view settings, and the recent results of the style-image and resize pages (in IndexedDB).

We measure the site with Vercel Web Analytics and Speed Insights. Web Analytics uses no third-party cookies: it tells visits apart by a hash of the request that is discarded after 24 hours, and records the page, referrer, country and city, browser and device without tying them to you or your IP address. Speed Insights records page speed the same anonymous way. The error reports we send to Sentry contain no IP address and no cookies.

14. Your rights

Under KVKK Article 11 you have the right to:

• learn whether your personal data is processed;
• ask for information about it if it is;
• learn the purpose of the processing and whether the data is used for that purpose;
• know the third parties in Türkiye or abroad to whom it is transferred;
• ask for it to be corrected if it is incomplete or wrong;
• ask for it to be deleted or destroyed under the conditions of KVKK Article 7;
• ask that the third parties who received it are told of a correction, deletion or destruction;
• object to a result against you that comes only from automated analysis of your data;
• claim compensation if you suffer damage from unlawful processing.

If you are in the EU or EEA, the GDPR gives you the rights of access, rectification, erasure, restriction, data portability and objection (Articles 15 to 21), and rights about solely automated decisions (Article 22). We apply these rights to every user where we can.

How to use them. Much of this you can do in the app: change your language, delete images, videos, chats, designs, brand kits and Creators, and end Claude connections. For anything else, such as a copy of your data, a correction or deleting your account, write to info@kolayza.com from your account’s email address, so that we can confirm it is you. Requests under KVKK are made in Turkish and include your name, your T.C. identity number (or, if you are not a Turkish citizen, your nationality and passport number), your address and what you ask for. Other requests can be in English.

We answer within 30 days (KVKK Article 13). For GDPR requests we answer within one month, which the GDPR allows to be extended by two more months for complex requests; we tell you if we need that. Answers are free unless the law allows a fee.

You can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) in Türkiye after applying to us first, within 30 days of our answer and at the latest 60 days after your request (KVKK Article 14). In the EU or EEA you can complain to the data protection authority where you live or work.

15. Children

Kolayza is for people aged 18 or over. We do not knowingly collect data from children. If you think a child has an account, write to us and we will delete it.

16. Changes to this policy

We update this policy when the service or the law changes. The date at the top shows the latest version. We tell signed-in users about important changes in the app before they apply.

17. Contact

Kolayza is run by its founder as an individual. It is not yet a registered company. Email: info@kolayza.com.