TR Open App
Fashify

Data Protection Notice (KVKK)

Last updated: 14.06.2026

This Clarification Text ("Aydınlatma Metni") is prepared by NOTRINO RESEARCH BİLGİ TEKNOLOJİLERİ ARAŞTIRMA GELİŞTİRME LİMİTED ŞİRKETİ ("Fashify"), in its capacity as data controller (veri sorumlusu), to fulfil its disclosure obligation (aydınlatma yükümlülüğü) under Article 10 of the Law on the Protection of Personal Data No. 6698 ("KVKK"). It explains which personal data we process, for what purposes, on what legal grounds, to whom we may transfer it, how we collect it, and the rights you hold as a data subject.

This Notice should be read together with our Privacy Policy and our Cookie Policy.

1. Data controller identity

The data controller responsible for processing your personal data is:

  • Controller: NOTRINO RESEARCH BİLGİ TEKNOLOJİLERİ ARAŞTIRMA GELİŞTİRME LİMİTED ŞİRKETİ ("Fashify")
  • Registered address: Üniversiteler Mah. İhsan Doğramacı Blv. Arge ve Eğitim Merkezi No:13 Çankaya/Ankara, Turkey
  • Email: [email protected]
  • MERSIS No: 0632094551700001
  • Phone: +90 554 855 09 44
  • KEP (registered electronic mail): [email protected]

Fashify operates the marketing website fashify.studio and the application app.fashify.studio.

2. Categories of personal data processed

Depending on your interaction with the Fashify platform, we may process the following categories of personal data:

  • Identity data: name, surname.
  • Contact data: email address, and (if provided) phone number.
  • Customer/account data: username, account credentials in hashed form, account preferences, language, credit balance and tier (Free/Starter/Growth/Brand/Enterprise).
  • Transaction & payment data: package purchased, credits consumed, invoice/billing details, currency (TL for customers in Turkey, USD for international customers), and the masked/tokenised payment confirmation returned by our payment provider. We do not store full card numbers.
  • Content data (user uploads & outputs): garment and model images you upload, prompts/parameters you enter, and the AI-generated visuals or optional videos produced for you.
  • Usage & technical data: IP address, device and browser information, log records, session and cookie identifiers, feature usage and timestamps.
  • Communication data: the content of your support requests and your correspondence with us.
  • Marketing data (where applicable): commercial-message consent status and preferences recorded in the İleti Yönetim Sistemi (İYS).

3. Purposes of processing

We process your personal data for the following purposes:

  • Creating and managing your account, and authenticating you;
  • Providing the Fashify service: generating AI fashion visuals and optional video from your uploads, and delivering outputs;
  • Operating the prepaid credit model: recording purchases, debiting credits, and managing your tier and balance;
  • Processing payments via our payment provider and issuing invoices;
  • Providing customer support and responding to your requests;
  • Ensuring information security, preventing fraud and abuse, and maintaining logs;
  • Improving and maintaining the platform's functionality, stability and security;
  • Fulfilling our legal obligations (e.g. tax, commercial and consumer-law record-keeping);
  • Where you have given consent, sending commercial electronic messages and conducting marketing activities.

You can review our prepaid credit packages on the Pricing page.

4. Legal grounds for processing (KVKK Art. 5 and Art. 6)

We process your personal data on the following legal grounds set out in Article 5 (and, where applicable, Article 6) of the KVKK:

  • Performance of a contract (KVKK Art. 5/2-c): processing necessary for the establishment or performance of your contract with us, e.g. account creation, credit purchase and consumption, and delivery of generated outputs.
  • Legal obligation (KVKK Art. 5/2-ç): processing necessary to comply with our legal obligations, e.g. invoicing, tax and commercial record-keeping, and responses to authorised public authorities.
  • Legitimate interest (KVKK Art. 5/2-f): processing necessary for our legitimate interests, provided your fundamental rights and freedoms are not harmed, e.g. platform security and fraud prevention. Service improvement and analytics are carried out on anonymised/aggregated data only; where such activity is not strictly necessary and not anonymised, it is based on your explicit consent rather than legitimate interest.
  • Establishment/exercise/protection of a right (KVKK Art. 5/2-e): where data processing is mandatory to establish, exercise or protect a right.
  • Explicit consent (açık rıza) (KVKK Art. 5/1): where no other legal ground applies, e.g. sending commercial electronic messages, non-essential cookies, and any incidental (arızî) cross-border transfer relying on consent.

We do not seek to process special categories of personal data (KVKK Art. 6) through the ordinary use of the platform; should this become necessary, it will be based on your explicit consent or another condition listed in Article 6.

4.1 Images of identifiable persons (including facial/biometric features)

Where User Content contains the image of an identifiable person, such data may constitute special-category (biometric) personal data under KVKK Art. 6. The Company processes it solely as a data processor on the User's documented instructions, on the basis that the User (as that person's controller) has obtained the explicit consent required by Art. 6 and holds a valid model release. The Company does not use such images for any purpose other than generating the User's requested output and the strictly necessary security/operation of the Service, and does not process them for profiling, analytics or model training. Service-improvement and analytics rely on anonymised/aggregated data only; any processing that is not strictly necessary and not anonymised is carried out only with explicit consent.

5. Recipients and purpose of transfer

We may transfer your personal data, limited to what is necessary, to the following categories of recipients:

  • Payment service provider, iyzico (a PayU company): to process card payments securely and to combat payment fraud. Cards are charged in TL for customers in Turkey and in USD for international customers. We do not store full card data; this is handled by the provider.
  • Cloud infrastructure provider, Amazon Web Services (AWS): to host the platform, store data and run the AI generation pipeline.
  • Service and technology providers (data processors): e.g. email/communication, analytics, logging, customer-support and security vendors acting on our instructions.
  • Authorised public authorities and courts: where disclosure is required by law or a valid legal request.
  • Professional advisors: legal, accounting and audit advisors, bound by confidentiality.

We do not sell your personal data.

6. Domestic and cross-border transfer basis (KVKK Art. 8 and Art. 9)

Domestic transfers are carried out, where one of the legal grounds in Article 5 (or Article 6) of the KVKK applies, under Article 8.

Cross-border transfers: Our cloud infrastructure is provided by Amazon Web Services (AWS) and hosted in the European Economic Area (EEA), within a GDPR-compliant framework. Our payment provider iyzico (a PayU company) may also process certain data internationally. Such cross-border transfers are carried out under Article 9 of the KVKK as amended (in force from 1 June 2024) and the Regulation on the Transfer of Personal Data Abroad (10 July 2024): where there is no adequacy decision of the Personal Data Protection Board, on the basis of an appropriate safeguard: in particular the standard contract (standart sözleşme) prescribed by the Board, which the Company notifies to the Board within five (5) business days of signature, or another approved safeguard (binding corporate rules / written undertakings approved by the Board). Explicit consent is relied upon only for incidental (arızî) transfers, not for routine hosting. Our cloud provider AWS hosts data in the EEA, where it additionally benefits from GDPR safeguards; our payment provider iyzico may process certain data internationally; both are covered by such safeguards.

7. Method and legal reason of collection

We collect your personal data by electronic means (through the registration and account forms, the application interface at app.fashify.studio, your uploads of garment/model images and prompts, your purchases and support requests, and automatically through cookies, log records and similar technologies) as well as from our payment provider in the course of completing a transaction. The legal reasons for collection are those set out in Section 4 (contract performance, legal obligation, legitimate interest, establishment/exercise/protection of a right, and explicit consent).

8. Data subject rights (KVKK Art. 11)

Under Article 11 of the KVKK, as a data subject you have the right to:

  • (a) learn whether your personal data is being processed;
  • (b) request information if your personal data has been processed;
  • (c) learn the purpose of processing and whether your data is used in accordance with that purpose;
  • (ç) know the third parties to whom your personal data is transferred, domestically or abroad;
  • (d) request correction of your personal data if it is incomplete or inaccurate;
  • (e) request deletion or destruction of your personal data within the conditions set out in Article 7 of the KVKK;
  • (f) request that the correction, deletion or destruction be notified to third parties to whom the data has been transferred;
  • (g) object to a result arising from the analysis of the processed data solely through automated systems, where it produces an adverse outcome for you;
  • (ğ) claim compensation for damage arising from unlawful processing of your personal data.

9. How to exercise your rights (başvuru)

To exercise your rights under Article 11 of the KVKK, you may submit a request to us, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, by one of the following channels:

  • by email to [email protected] (using an email address registered in our systems), or
  • in writing, in person or via notary, to our registered address: Üniversiteler Mah. İhsan Doğramacı Blv. Arge ve Eğitim Merkezi No:13 Çankaya/Ankara, Turkey, or
  • via our registered electronic mail (KEP) address: [email protected].

Your request must contain the information required to verify your identity and to clarify the subject of your request. We will conclude your request free of charge and as soon as possible, and in any event within thirty (30) days of receipt, in line with Article 13 of the KVKK; where the process incurs an additional cost, the tariff set by the Personal Data Protection Board may be charged. If you are not satisfied with the outcome, you may lodge a complaint with the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu).

For any other privacy-related question, you may also reach us via our Contact page.

10. Updates to this Clarification Text

We may update this Clarification Text from time to time to reflect changes in our processing activities or legal requirements. The current version and its "last updated" date are always published on fashify.studio. Last updated: 14.06.2026.