KVKK disclosure — VibeX

1. Data controller

Your personal data is processed by Mustafa Evleksiz ('VibeX') as data controller within the scope described below.

2. Categories of personal data processed

The app processes the following categories:

• Identity and contact: email if you create an account; Apple/Google identifier when you sign in via those services.
• Visual data: photos you upload or capture and the generated results (may contain facial features).
• Transaction security and usage: in-app events, device model, OS, app version, analytics identifier.
• Financial: subscription/purchase status (no card details — handled by Apple).
• Diagnostics: crash and error logs.

3. Processing purposes

Your data is processed to:

• Provide the core service (generating AI edits from photos).
• Manage account, credits and subscriptions.
• Detect errors, ensure security, and improve performance and features.
• Fulfil legal obligations.

4. Legal bases (KVKK Art. 5 and 6)

Processing is based on:

• Art. 5/2-c: necessary for the establishment or performance of a contract (service delivery).
• Art. 5/2-ç: necessary for compliance with a legal obligation.
• Art. 5/2-f: legitimate interest (security, error detection, improvement).
• Art. 5/1 and 6/2 (explicit consent): for processing of visual/facial data and, where required, international transfers. You give explicit consent by selecting a photo and starting an edit; you may withdraw it at any time.

5. Special-category data notice

Photos you upload may contain your face. VibeX processes these images only to generate the edit you request; we do not use them for biometric identification, face recognition, or model training. Facial/image data may qualify as special-category personal data, so processing relies on your explicit consent.

6. Transfers (KVKK Art. 8 and 9)

Your data may be transferred to the following service providers, some located outside Turkey (including the United States). International transfers rely on your explicit consent and/or appropriate safeguards:

• Google (Gemini API) — AI image processing — outside Turkey.
• Supabase — authentication and backend — outside Turkey.
• RevenueCat + Apple — purchases and subscriptions — outside Turkey.
• PostHog — analytics — outside Turkey.
• Sentry — crash reporting — outside Turkey.
• Expo / Upstash — updates and configuration — outside Turkey.

7. Collection method

Your personal data is collected electronically during your use of the app — in-app forms, photo selection or capture, and automated event logs.

8. Data subject rights (KVKK Art. 11)

Under Art. 11 you have the right to learn whether your data is processed, request information, know its purpose and whether it is used in accordance with that purpose, learn the third parties it is shared with, request correction of incomplete or wrong data, request deletion or destruction when the conditions are met, request that these be notified to recipients, object to automated decisions, and seek compensation for damages.

9. How to apply

Two ways to exercise your rights:

• In-app: Settings → Account → Delete account (deletes account and server-side data); Settings → Privacy → Delete all my data (deletes device data).
• Email: mustafa@mustafaevleksiz.com — under the Communiqué on Application Procedures and Principles to the Data Controller.

10. Response time

Applications are answered within 30 days at the latest.