This notice is provided under Turkish Personal Data Protection Law No. 6698 (the "Law") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, to inform people who use the Otoklip website and app. The Turkish version prevails.
1. Data controller
Your personal data is processed by [Şirket Unvanı] (the "Company") as data controller under the Law, as described below.
- Company: [Şirket Unvanı]
- Address: [Adres]
- Trade registry / Tax no: [MERSİS/Vergi No]
- Registered e-mail (KEP): [KEP/e-posta]
2. Categories of personal data
| Category | Data |
|---|---|
| Identity | First and last name |
| Contact | E-mail address |
| Customer transactions | Credit history, generation records, plan, support tickets and messages, referral code and relationship |
| Transaction security | IP address, session and authentication data, activity and error logs, content-filter logs |
| Visual and audio records | Images, videos and audio you upload, and content generated from them |
| Finance | Once online payments launch: amount and date, card brand, bank, country, last 4 digits, installments (the card number is never sent to the Company) |
| Marketing | Communication opt-ins and cookie preferences |
Identity
- Data
- First and last name
Contact
- Data
- E-mail address
Customer transactions
- Data
- Credit history, generation records, plan, support tickets and messages, referral code and relationship
Transaction security
- Data
- IP address, session and authentication data, activity and error logs, content-filter logs
Visual and audio records
- Data
- Images, videos and audio you upload, and content generated from them
Finance
- Data
- Once online payments launch: amount and date, card brand, bank, country, last 4 digits, installments (the card number is never sent to the Company)
Marketing
- Data
- Communication opt-ins and cookie preferences
The Company does not aim to process special categories of personal data; the service is not used to identify people from their face or voice (biometric recognition).
3. Purposes of processing
- Managing membership and account security
- Providing AI content generation; storing content and making it available to the user
- Running contract, credit, sales and payment processes; refunding credits for failed jobs
- Finance and accounting
- Handling support, requests and complaints; communications
- Information security; preventing abuse and prohibited content
- Running the referral program
- Legal affairs and providing information to authorised persons and authorities
- With your explicit consent: analytics, marketing and campaign activities
4. Collection method and legal grounds
Your personal data is collected electronically, by fully or partly automated means, through forms on the website and app, the files you upload, the support chat and ticket forms, cookies and similar technologies, Google sign-in and (once live) payment providers.
It is processed on the following legal grounds in Article 5 of the Law:
- Art. 5/2-c – necessary for the conclusion or performance of a contract (membership, generation, credits, support)
- Art. 5/2-ç – necessary to comply with a legal obligation of the controller (tax, accounting, requests from authorities, traffic logs)
- Art. 5/2-e – necessary to establish, exercise or protect a right (disputes)
- Art. 5/2-f – legitimate interests of the controller, provided your fundamental rights are not harmed (security, moderation, improving the service)
- Art. 5/1 – explicit consent (analytics and marketing cookies, commercial e-mails and, where required, transfers abroad)
5. Transfers of personal data
Limited to the purposes above and in line with Articles 8 and 9 of the Law, your personal data may be transferred to:
- Infrastructure providers: database, authentication, file storage and e-mail infrastructure (e.g. Supabase)
- AI service providers: Higgsfield, fal.ai, Tripo, Anthropic, OpenAI or Google (only the prompts, files and messages needed for the requested generation or support answer)
- Payment institutions: once online payments launch, licensed payment providers such as iyzico and Paddle
- Competent public authorities and judicial bodies: under legal obligations
- Legal, financial and audit advisers
Some of these providers have servers abroad. Transfers abroad are made in accordance with Article 9 of the Law — where there is no adequacy decision, by providing an appropriate safeguard such as standard contractual clauses notified to the Board, or for incidental transfers, on the grounds listed in Article 9(6) (for example, where the transfer is necessary to perform a contract, or with your explicit consent).
6. Your rights under Article 11
As a data subject, you may apply to the Company to:
- a) learn whether your personal data is processed,
- b) request information if it has been processed,
- c) learn the purpose of processing and whether it is used in line with that purpose,
- ç) know the third parties in Türkiye or abroad to whom it is transferred,
- d) request correction if it is incomplete or inaccurate,
- e) request deletion or destruction under the conditions in Article 7 of the Law,
- f) request that the actions under (d) and (e) be notified to third parties to whom the data was transferred,
- g) object to a result against you arising from analysis exclusively by automated systems,
- ğ) claim compensation if you suffer damage due to unlawful processing.
7. How to apply
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your request in one of these ways:
- In writing with a wet signature, in person or through a notary: [Adres]
- With a secure electronic or mobile signature, or by registered electronic mail (KEP): [KEP/e-posta]
- From the e-mail address registered in our system: [KEP/e-posta]
Your application must include your name, signature (for written applications), Turkish ID number (nationality and passport/ID number for foreigners), address for notifications, e-mail and phone number if any, and the subject of your request.
We conclude your request free of charge as soon as possible and within 30 days at the latest. If the action involves an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your request is rejected, you find the answer insufficient or we don't answer in time, you may complain to the Board within 30 days of learning the answer and in any case within 60 days of your application.