Privacy Policy

Türkçe sürüm: Gizlilik Politikası

This policy explains how personal data is processed when you use the Stokmeta website and application (the "Service"). It is written under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"). Where the EU or UK GDPR applies to you, the same practices apply and you have the corresponding GDPR rights.

1. Data Controller

Serkan Özmen, individual sole proprietor trading as StokMeta, Ufuk Mah. 893 Sok. No: 6/1, Buca / İzmir, Türkiye · destek@stokmeta.com. Under the thresholds set by the Turkish Personal Data Protection Board, the controller is exempt from registration in VERBİS (the Turkish data controllers' registry); this does not affect any other KVKK obligation.

2. Data We Process

We process only the minimum needed to provide the Service:

• Identity and contact: the name and e-mail address you give at sign-up; with Google sign-in, the name and e-mail from your Google account.
• Account and usage: your plan, monthly usage counters, the metadata records you generate (file name, title, description, keywords, category) and your preferences.
• Sign-up source and product milestones: the optional "how did you hear about us" answer, a campaign or referral code in the sign-up link, and the dates of your first generation, first CSV download and reaching the usage limit. Recorded on your account only, without cookies or tracking tools.
• Profile picture: an optional avatar, hosted at a public URL. Please don't upload a personal or sensitive picture.
• Security data: essential authentication cookies, IP address and basic access logs.
• Image content: the images you upload for metadata generation, processed temporarily and never stored (see section 4).
• Subscription and payment: plan, period and payment status. Your card details never reach our servers; payment is taken and processed by Paddle as Merchant of Record.

We do not request special categories of data (health, religion, biometrics, etc.). You are responsible for ensuring that uploaded images contain no such data.

3. Purposes and Legal Bases

• Performance of a contract (KVKK 5/2-c; GDPR 6(1)(b)): creating your account, metadata generation, CSV export, plan and limit management, subscription billing.
• Legal obligation (KVKK 5/2-ç; GDPR 6(1)(c)): tax and commercial record-keeping.
• Legitimate interest (KVKK 5/2-f; GDPR 6(1)(f)): security, error detection, preventing abuse and limit circumvention, and aggregate statistics on which channels and product steps work.
• Explicit consent (KVKK 5/1 and 9/6; GDPR 6(1)(a)): transferring personal data to service providers abroad. Requested separately and optionally; you can withdraw it at any time (section 5).

4. How Images and AI Are Handled

• Resized locally: images are downscaled in your browser; original files are not uploaded to our servers.
• Embedded data removed: before an image is sent to the AI provider, it is re-encoded on our server and embedded location (GPS), camera, date and similar data (EXIF, XMP, IPTC) are removed. Your file name is not sent.
• AI analysis: the downscaled copy is sent over an encrypted connection to our AI provider (Anthropic — Claude) solely to generate metadata. Your name and e-mail are not sent.
• No storage: images are not stored in any database and are discarded from memory after processing. Only the text metadata is kept in your account (History).
• No training: your images and metadata are not used to train AI models.
• No automated decisions: the AI only suggests text; no decision with legal effect is made about you.

5. Recipients and International Transfers

We never sell your personal data or share it with third parties for their marketing. To run the Service we use these providers:

Because the Turkish Personal Data Protection Board has not issued an adequacy decision for these countries, these transfers rely on your explicit consent (KVKK 9/6). Without it you can still create an account, but features that depend on this infrastructure, above all AI metadata generation, won't work. You can withdraw consent from your profile page at any time; withdrawal has effect for the future only. Otherwise, data may be shared with competent public authorities only where legally required.

Marketing e-mail (optional): if you join the free e-mail course or tick the separate consent box at sign-up or in your profile, your name and e-mail are transferred to Brevo (Sendinblue SAS, France) only to send those messages. This is based on your consent under Turkish Law No. 6563 and is not a condition of using the Service. You can unsubscribe from any e-mail or in your profile; consent and opt-out records are kept as proof.

6. Cookies

We use only strictly necessary cookies to keep you securely signed in, plus Paddle's payment cookies when the checkout opens. No marketing, advertising or third-party tracking cookies are used, so no cookie banner is shown. See the Cookie Policy (Turkish) for the full list.

7. Retention

After that, data is deleted, destroyed or anonymised.

8. Security

• All traffic uses encrypted connections (HTTPS/TLS).
• Row-level security in the database: each user can access only their own records.
• The AI provider's API key is kept server-side only and never sent to the browser.
• Passwords are stored as irreversible hashes.
• Access to data is limited to the minimum number of people needed to run the Service.

If a data breach occurs, it is reported to the Personal Data Protection Board within 72 hours and to affected people as required by KVKK.

9. Children

The Service is not directed at people under 18 and we do not knowingly collect their data. If we learn that we have, we delete it. You can report this to destek@stokmeta.com.

10. Your Rights

Under KVKK article 11 (and, where applicable, GDPR articles 15–22) you may request information about, access, correction, deletion, restriction or portability of your data, object to processing, and claim compensation for damage. See the Data Subject Application page (Turkish) or write to destek@stokmeta.com. We answer free of charge within 30 days. Residents of the EU or UK may also complain to their local supervisory authority.

11. Changes and Contact

We may update this policy; material changes are announced in the Service or by e-mail and the version number is increased. Questions: destek@stokmeta.com.