1. Who is responsible for your data
The controller of your personal data under Article 4(7) GDPR is Anıl Fidan, who operates cupid visual (cupidvisual.com) (“we”, “us”).
- Controller: Anıl Fidan
- Address: Osmaniye Mahallesi, Osmaniye Mektebi Sokak No: 29-31 Daire: 7, Bakırköy / İstanbul
- Email: info@cupidvisual.com
For purchases, our payment provider Creem acts as Merchant of Record and is an independent controller for payment, invoicing and tax data under its own privacy policy (creem.io/privacy).
2. Personal data we process
- Account and contact data: name, email address, phone number when you use the contact form and, if you sign in with Google, your basic Google profile.
- Content: product photos you upload, brand kit files, text/prompts you enter and the images/videos you generate. If people appear in your uploads, their images may also be processed.
- Usage data: subscription and plan, usage allowance (image/video) history, generation history, feedback and support requests.
- Payment data: payment status and order summary sent by Creem. We never see or store your card details.
- Technical data: IP address, device and browser details, security and error logs, bot-protection results.
- Consent data: your cookie and marketing preferences; with consent, analytics data.
We do not intend to process special categories of data (Art. 9 GDPR). Please do not upload images revealing health, religious beliefs, biometric data or similar information.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and managing your account | Contract — Art. 6(1)(b) |
| Generating images and videos from your uploads | Contract — Art. 6(1)(b) |
| Subscriptions, usage allowances (images/videos) and automatic refunds for failed jobs | Contract — Art. 6(1)(b) |
| Support requests | Contract / legitimate interests — Art. 6(1)(b), (f) |
| Security, abuse and fraud prevention, content moderation | Legitimate interests — Art. 6(1)(f) |
| Improving and fixing the service | Legitimate interests — Art. 6(1)(f) |
| Retaining records required by law | Legal obligation — Art. 6(1)(c) |
| Analytics cookies and marketing emails | Consent — Art. 6(1)(a) |
Where we rely on legitimate interests, we have balanced them against your rights; you can object at any time (see section 7). Where we rely on consent, you can withdraw it at any time without affecting processing carried out before withdrawal.
Providing account and content data is necessary to use the service; without it we cannot perform the contract.
4. Recipients
We do not sell your personal data. We share it only with the processors that help us run the service, bound by data processing agreements under Art. 28 GDPR, and with authorities where required by law:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | EU (Frankfurt) |
| Hostinger | Website hosting | EU |
| Wiro | AI image and video generation | Türkiye / international servers |
| Creem | Merchant of Record: payments, invoicing and tax | EU / international |
| Google (Analytics, Search Console) | Visit statistics (only with consent) | USA / EU |
| Cloudflare (Turnstile) | Bot and abuse protection | USA / EU |
| Email service provider | Account and transactional emails | USA / EU |
We do not use your images to train our own AI models, and we never publish your outputs in showcases without your explicit permission.
5. International transfers
We operate from Türkiye, and some of our providers process data outside the EEA. Where a country does not benefit from an adequacy decision of the European Commission, transfers are protected by the Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR) or, for US providers, certification under the EU–US Data Privacy Framework where available. You can request a copy of the relevant safeguards at info@cupidvisual.com.
6. How long we keep data
- Account data: while your account is open, then for applicable limitation periods.
- Uploaded and generated images: 30 days on free accounts; on paid accounts, for the subscription and 30 days after it ends. You can delete them yourself at any time.
- Order summaries: for dispute and limitation periods (up to 10 years); invoices are kept by Creem.
- Security and access logs: up to 2 years.
- Analytics data: up to 14 months.
7. Your rights
Under Articles 15–22 GDPR you have the right to:
- access your personal data and receive a copy (Art. 15),
- have inaccurate data rectified (Art. 16),
- have your data erased (“right to be forgotten”) (Art. 17),
- restrict processing (Art. 18),
- receive your data in a portable format (Art. 20),
- object to processing based on legitimate interests, and to direct marketing at any time (Art. 21),
- withdraw consent at any time (Art. 7(3)).
We do not make decisions producing legal or similarly significant effects based solely on automated processing (Art. 22). Automated content moderation may block a generation, but you can contact us to have it reviewed by a person.
To exercise your rights, email info@cupidvisual.com from the address linked to your account. We will respond within one month (Art. 12(3)), extendable by two months for complex requests.
8. Right to lodge a complaint
If you believe we process your data unlawfully, you can lodge a complaint with the data protection supervisory authority in your EU/EEA country of residence, place of work or place of the alleged infringement (Art. 77 GDPR). UK users can contact the Information Commissioner’s Office (ICO). We would appreciate the chance to address your concern first at info@cupidvisual.com.
9. Changes
We may update this notice from time to time and will announce significant changes by email or in-app notice.