Privacy and KVKK Information Notice

Effective: November 1, 2026 · Version 2026-11-01

This is a translation for your convenience. The Turkish text is the binding version.

Draft: do not publish until the company details in square brackets are filled in and a lawyer has reviewed it.

This notice explains, under Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu, “KVKK”), which of your personal data we process when you use Ambertale, why and how we process it, with whom we share it, and your rights.

1. Data controller

[ŞİRKET UNVANI], [TESCİLLİ ADRES]. For requests concerning personal data: [kvkk@ambertale.app] or KEP (Turkish registered electronic mail): [KEP ADRESİ].

2. Data we process, purposes and legal grounds

Identity and contact

Data: Email address; when you sign in with Google, the name and profile photo Google shares.
Purpose: To create an account, send sign-in links and recognise the account.
Legal ground: Establishment and performance of a contract (KVKK Art. 5/2-c).

Age

Data: Date of birth.
Purpose: To offer the service only to people aged 18 and over.
Legal ground: Performance of a contract (Art. 5/2-c) and legal obligation (Art. 5/2-ç).

Chat and memory

Data: The messages you write, the narrator’s replies, the story summary and memories, and the notes you add.
Purpose: To generate replies and keep the story continuous.
Legal ground: Performance of a contract (Art. 5/2-c).

Content you create

Data: Character drafts and publications, conversations with the studio assistant, image/video/comic prompts and files.
Purpose: To provide the studio and media features and to review content before publication.
Legal ground: Performance of a contract (Art. 5/2-c) and legitimate interest (Art. 5/2-f).

Credit transactions

Data: Daily credits, spending and refunds.
Purpose: To keep your credit balance accurate.
Legal ground: Performance of a contract (Art. 5/2-c).

Security and moderation

Data: Session records, IP address for rate limiting, reports and moderation decisions.
Purpose: To prevent abuse and protect the account and other readers.
Legal ground: Legitimate interest (Art. 5/2-f) and legal obligation (Art. 5/2-ç).

We collect data electronically, directly from you (forms, chats) and, when you sign in with Google, from Google. We do not use it for advertising, profiling or sale; we do not use advertising or analytics cookies.

3. Processing with artificial intelligence

To generate a reply or media, your message, the latest part of the chat, the story summary, memories and the character’s description are sent to the AI model provider. For image and video generation, only your prompt and the public introduction of the character you selected are sent.

Ambertale does not use chats to train its own models. The memories and summaries in Memory are also extracted with AI; you can view, correct and delete them in the Memory panel.

4. Transfers

We share data with the following groups of recipients only to the extent needed to provide the service:

Hosting and database service: [HOSTING PROVIDER, COUNTRY].
AI model providers: Alibaba Cloud Model Studio (images and video; Singapore region) and [LANGUAGE MODEL PROVIDER, COUNTRY].
Google LLC: for authentication, only if you choose to sign in with Google.
Email delivery service: [EMAIL PROVIDER, COUNTRY], for sign-in links.
Public authorities and bodies authorised by law: upon request and to the extent permitted by law.

Transfers to recipients abroad are made under KVKK Art. 9 on the basis of [APPROPRIATE SAFEGUARD: standard contract announced by the Board (Kişisel Verileri Koruma Kurulu, Personal Data Protection Board) / explicit consent — to be determined with a lawyer].

5. Retention periods

Account, chats, memories, characters, credit transactions and generations: for as long as the account is open.
When you delete your account, this data is deleted immediately; from backups it is deleted within at most [30] days.
Sign-in links: 15 minutes (single use). Session: at most 30 days.
Rate-limiting counters (including IP): at most 1 hour.
Characters you published may remain available to readers without an owner even if you delete your account.
Once paid transactions begin, invoice and payment records will be kept for the period required by the applicable legislation.

6. Your rights (KVKK Art. 11)

You have the right to learn whether your personal data is processed; to request information about it; to learn the purpose of processing and whether the data is used in line with that purpose; to know the third parties to whom it is transferred; to request its correction if it is incomplete or inaccurate, and its erasure or destruction; to request that these actions be notified to the parties to whom the data was transferred; to object to an outcome against you resulting from analysis by automated systems; and to claim compensation for damage you suffer due to unlawful processing.

You can exercise most of these right away in the app: on the Profile and settings page, “Download my data” gives you all your data in a single file, and “Delete my account” permanently deletes your account and data. For other requests, you can write to [kvkk@ambertale.app] or by KEP; we will resolve your request free of charge within 30 days at the latest.

7. Security

We do not keep passwords; sign-in is done with a single-use link or with Google. The session is kept in a secure cookie that page scripts cannot read; links and session keys are stored only in hashed form. We prevent abuse through access authorisation, rate limiting and logging.

8. Under 18

Ambertale does not serve anyone under 18 and does not knowingly collect data from anyone under 18. A date of birth declared as that of a minor is kept only to prevent the account from being opened again.

9. Changes

We may update this notice; we will announce significant changes in the app or by email. For cookies, see the Cookie Policy.