Personal Data Protection Notice

Data controller: the Out of Ten team. Until the operating legal entity is finalised, the controller can be reached at agdemirhalim4@gmail.com.

If you are in Türkiye, this address is your KVKK application address until a formal one is published on this page.

Identity data: your name and any social-login identifiers.

Contact data: email address.

User content: the photos you upload for analysis.

Transaction data: subscription and one-time purchase receipt identifiers issued by Apple and Google.

Device and usage data: device type, OS, app language, push token, approximate location (city / country level), the scopes you choose, and the reports you generate.

Running the AI analysis you requested.

Operating your account, history, friends, battles and badges.

Verifying subscriptions and one-time purchases.

Sending transactional notifications.

Keeping the service secure and preventing abuse.

Responding to messages sent through the contact form on this website.

Performance of a contract (Art. 5/2-c) — providing the service you requested.

Legitimate interests (Art. 5/2-f) — operating the platform safely.

Explicit consent (Art. 5/1) — for the AI analysis of your photos and for the international transfer of that data, which we ask for on first use.

Some of our service providers operate abroad. With your explicit consent, your data is transferred to:

OpenAI (United States) — for AI photo analysis.

Apple and Google — for in-app purchase receipt validation.

Resend (United States) — to deliver transactional emails and the website contact form.

You can withdraw this consent at any time by deleting your account.

Photos are retained for up to thirty days after the analysis and then deleted unless you save the report.

Account, report and transaction data are retained until you delete your account, or for the period required by tax and electronic commerce legislation, whichever is longer.

You may apply to us to:

— learn whether your personal data is processed; — request information about how it is processed; — learn the purpose of processing and whether it is being used in accordance with that purpose; — learn the third parties to whom your data is transferred at home or abroad; — request correction of inaccurate or incomplete data; — request deletion or destruction of your data; — request that any corrections, deletions or destructions are reported to third parties to whom your data was transferred; — object to a result generated solely by automated processing that produces an adverse outcome; — request compensation for damages arising from unlawful processing.

You may send your application in writing, with your identity verified, to agdemirhalim4@gmail.com. We will respond within thirty days at the latest, free of charge unless the request requires an additional cost in accordance with the Communiqué of the Personal Data Protection Authority.