FaceAI

1. Introduction

FaceAI (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how your personal information is collected, used, kept and disclosed by FaceAI.

This Privacy Policy applies to our website and its associated subdomains (collectively, our “Service”) alongside our application, FaceAI. The Company defined in section 2 is the data controller responsible for your personal data. Please read this Privacy Policy together with our Terms of Use, which set out the rules for using FaceAI and the content you create with it.

2. Definitions and Key Terms

To help explain things as clearly as possible in this Privacy Policy, every time any of these terms are referenced, are strictly defined as:

• Cookie: small amount of data generated by a website and saved by your web browser. It is used to identify your browser, provide analytics, remember information about you such as your language preference or login information.
• Company: when this policy mentions “Company,” “we,” “us,” or “our,” it refers to DOFA TECH YAZILIM HİZMETLERİ ANONİM ŞİRKETİ, Ismet Kaptan Mah. Gazi Osman Pasa Bul. No: 9 Ic Kapi No: 47 Konak / Izmir TURKEY that is responsible for your information under this Privacy Policy.
• Content: the Inputs and Outputs together.
• Country: where FaceAI or the owners/founders of FaceAI are based, in this case is Turkey
• Device: any internet connected device such as a phone, tablet, computer or any other device that can be used to visit FaceAI and use the services.
• Inputs: the photos you upload and the text prompts you type to create images and videos.
• IP address: Every device connected to the Internet is assigned a number known as an Internet protocol (IP) address. These numbers are usually assigned in geographic blocks. An IP address can often be used to identify the location from which a device is connecting to the Internet.
• Outputs: the images and videos you create with FaceAI.
• Personnel: refers to those individuals who are employed by FaceAI or are under contract to perform a service on behalf of one of the parties.
• Personal Data: any information that directly, indirectly, or in connection with other information — including a personal identification number — allows for the identification or identifiability of a natural person.
• Service: refers to the service provided by FaceAI as described in the Terms of Use and on this platform.
• Third-party service: refers to advertisers, contest sponsors, promotional and marketing partners, and others who provide our content or whose products or services we think may interest you.
• Website: FaceAI's site, which can be accessed via this URL: getfaceai.com
• You: a person who uses FaceAI, with or without a registered account.

3. Information Automatically Collected

When the app connects to our servers, we record your IP address together with the date and time, and the app sends us your device model, platform and operating system version, app version, language, time zone, screen size and store country. We also keep a record of each request to create an image or video (see section 4).

When you visit our website, our hosting provider receives your IP address and browser information. If you open a creator's invitation link on our website (an address starting with getfaceai.com/i/), we record your IP address, browser user agent, language, screen size and time zone, and compare them with the first connection the FaceAI app makes from the same network, so that we can credit the creator who referred you.

4. Collection of Personal Data and Method

FaceAI may process your personal data for the purposes specified in this Privacy Policy.

The personal data of users collected and used by FaceAI in particular, are as follows:

• Account data: the identifier that the app creates for your installation and, if you link your account to Apple, Google or an e-mail address, your e-mail address and sign-in method. Apple may also share your name with us when you sign in with Apple.
• Content: the photos you upload, which show your face and may show other people; the text prompts you type in the image editor and text-to-image features; and the Outputs you create.
• Creation records: for each image or video you create, the feature and style you chose, your settings (such as quality and the female/male option), when you created it, the links to your Inputs and Outputs, its status, the credits it used, and any rating or like you give it.
• Device and connection data: your IP address and the information described in section 3, and your push notification token.
• Device and advertising identifiers that reach us through our subscription and attribution partners: the Identifier for Advertisers (IDFA) on iOS where you allow it in Apple's tracking prompt, the Identifier for Vendors (IDFV), the Android Advertising ID and Android ID, and the advertising campaign that brought you to FaceAI.
• Purchase data: your subscriptions, purchases and renewals, your credit balance and how you used your credits. Payments are made through Apple or Google, and we never receive your payment card details.
• Support and reports: what you send us when you contact us, report a problem or report content, including your e-mail address if you give it.
• Consent records: your answers to our tracking consent screen and to Apple's tracking prompt, and your choice about sharing consumption data with Apple (section 17).

5. Photos, Faces and Biometric Information

FaceAI works with photos of faces. When you start a creation, your photos are sent to the AI models we use, run by us or by the AI providers listed in section 10. These models detect the faces in your photos and generate the result, and to do so they may analyse facial features such as the position and shape of the eyes, nose and mouth. That analysis exists only while your creation is being made. Apart from it, we do not create or keep face templates, face embeddings or other biometric identifiers, and we do not use your photos to recognise or identify anyone. We never sell your photos or any information derived from the faces in them, and we do not use your photos or Outputs to train AI models.

We keep the photos themselves as described in section 7. Where the law requires your consent for this processing (for example where information derived from facial features is treated as biometric information), you give it by uploading a photo and starting a creation. You can withdraw it at any time by no longer uploading photos and by asking us to erase the photos you have uploaded.

Only upload a photo of another person if that person has agreed. Only upload a photo of a child if you are that child's parent or legal guardian or have their permission. Our Terms of Use set out these rules in full.

6. How We Use Your Information

We use your information for a variety of business purposes, including to provide our Services, for administrative purposes, and to market our products and Services, as described below.

Provide Our Services

We use your information to fulfill our contract with you and provide you with our Services, such as:

• Creating images and videos from your photos and prompts, showing them in your library, and letting you reuse a photo for later creations
• Managing your information and accounts
• Providing access to certain areas, functionalities, and features of our Services
• Sending you a notification when a creation is ready
• Answering requests for customer or technical support
• Communicating with you about your account, activities on our Services, and policy changes
• Processing your financial information and other payment methods for products or Services purchased
• Recommending styles, for example styles that are popular among people who use FaceAI in your language

Safety, Legal Compliance and Protection of Rights

• Checking Content for misuse. For example, we send the photos used in a custom face swap to OpenAI's moderation service, which detects sexual and other inappropriate content, and authorised staff may review face swaps.
• Enforcing our Terms of Use, and investigating and preventing fraud, abuse and security incidents
• Keeping records of the Content created with each account, so that we can respond to requests from authorities and to claims about that Content (section 9)
• Complying with the law and establishing, exercising or defending legal claims

Improve Our Services

• Testing and improving the quality of the Service. For example, authorised staff may compare the results that different AI models produce from a sample of photos. We do not use your photos or Outputs to train AI models.
• Analytics and advertising measurement, as described in section 11

7. Data Retention

We keep personal data only for as long as we need it for the purposes in this Privacy Policy:

• Photos you upload and your Outputs: we keep them so that you can see your creations in your library and reuse your photos, and we do not currently delete them automatically. Thirty days after an AI photo or AI video creation, we also store a copy of the photos used for it in archive storage. Deleting a creation in the app removes it from your library. To have your photos and Outputs erased from our storage, e-mail us at faceai@dofatech.com from the e-mail address of your account, or tell us your account identifier, and we will erase them within one month, unless we must keep them under the last point of this section.
• Account data: while your account exists. When you delete your account, we delete your sign-in account, remove your e-mail address, sign-in methods, IP address, push token and device model from our user record, and remove your creations from the app.
• Creation records (section 4): while your account exists and, after you delete it, for as long as claims about the Content created with it can be brought or authorities can request information about it (generally up to 10 years under Turkish law). For this purpose we also keep a record of the deletion of your account that includes the e-mail address of the deleted account.
• Purchase and credit records: for as long as tax and commercial law requires, generally up to 10 years.
• Support requests and content reports: for as long as we need them to handle the matter and any claim arising from it.
• Legal holds: when we receive a request from an authority, a complaint or a claim, or detect a serious breach of our Terms of Use, we may keep the relevant data beyond the periods above until the matter is finally resolved, even if you delete the Content or your account.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data, such as encrypting data in transit and limiting which staff can access it. However, no method of transmission over the internet or of electronic storage is 100% secure.

9. Legal Requests, Claims about Content and Protection of Rights

Content created with FaceAI can affect other people. So that we can respond to authorities and to claims about that Content, we keep records that link each creation to the account and device that made it, and we may disclose personal data in the following situations:

• Requests from authorities: to courts, prosecutors, law enforcement agencies, regulators and other public authorities, in Türkiye or in other countries, when we receive a subpoena, court order, warrant, production or preservation order, or another request that we believe in good faith we are legally required or permitted to comply with.
• Claims about Content: when someone complains, or brings or threatens a claim or lawsuit against us or against a user, alleging that Content created, uploaded or shared through an account is unlawful or infringes their rights (for example a person shown in it, or the owner of a work used in it). We may use the data ourselves to respond to or defend against the claim, and disclose it to the court or authority deciding it, to our lawyers, insurers and professional advisers, and to the person making the claim where the law or a court requires it or where it is necessary to establish, exercise or defend legal claims.
• Safety and abuse: to the competent authorities and organisations, such as the National Center for Missing & Exploited Children (NCMEC), when we believe in good faith that disclosure is necessary to prevent death or serious bodily harm, to protect a child from sexual exploitation, or to investigate fraud or a serious breach of our Terms of Use.

The personal data we may disclose in these situations includes: your account identifier, e-mail address and sign-in methods; IP addresses and the dates and times of your connections and requests; your device model, platform, app version, language and store country; the device and advertising identifiers we hold; your subscription and purchase records; the Inputs and Outputs concerned; and the creation records showing when, and with which feature and style, the Content was created.

We disclose only what is necessary for the request or claim, we do not make this information public, and we do not disclose it to a private person without a legal basis. Unless the law forbids it, the matter is an emergency, or telling you could put someone at risk or hinder an investigation, we may let you know about a request that concerns your account. When we receive a request or a claim, we may preserve the relevant data until the matter is finally resolved (section 7).

We rely on our legal obligations, on our legitimate interests in cooperating with authorities, protecting the rights of others and preventing harm, and on the need to establish, exercise or defend legal claims. Under the GDPR these are Articles 6(1)(c), 6(1)(f) and 9(2)(f). Under the Turkish Personal Data Protection Law No. 6698 (KVKK) these are the conditions in Article 5(2)(a), (ç), (e) and (f) and Article 6(3).

10. Data Sharing and Service Providers

We do not sell your personal data. We share it only as described in this Privacy Policy:

• With service providers who process it for us under contract. They may use it only to provide their services to us.
• With authorities, courts, claimants and our advisers, as described in section 9
• With Apple and Google to process your purchases and refund requests (section 17)
• With analytics and advertising measurement partners, as described in section 11
• With a buyer or successor, if our business or the Service is sold, merged or transferred
• With anyone you choose, when you share an Output, for example through your phone's share sheet or Instagram

Our service providers

• Amazon Web Services: servers, database and file storage in the United States
• Cloudflare: file storage, content delivery and image processing such as resizing and background removal
• AI providers that receive your photos, prompts and Outputs to create your result: fal.ai, Eachlabs, Higgsfield, Replicate and OpenAI. We also use OpenAI to translate text-to-image prompts into English and to check the photos used in custom face swaps for inappropriate content.
• Google Firebase: sign-in, push notifications (which may contain a link to your result), crash reports, remote configuration and analytics
• Adapty: subscriptions and in-app purchases, using your account identifier and, if you have linked one, your e-mail address
• Encore: subscription offers in the Android app
• Slack: internal handling of the problem reports you send from the app

Third-Party Services

Please note that the Application utilizes third-party services that have their own Privacy Policy about handling data. Below are the links to the Privacy Policy of the third-party service providers used by the Application:

• Google Play Services
• Google Analytics for Firebase
• Firebase Crashlytics
• Meta (Facebook SDK)
• Adjust
• Adapty

Google Analytics for Firebase, the Meta SDK and Adjust are used for analytics and advertising measurement. Section 11 explains what they receive and what Adjust passes on to advertising partners such as Meta, TikTok and Google.

11. Analytics and Advertising Measurement

The FaceAI app includes software from the following partners, which we use to understand how the app is used and to measure the advertising campaigns that bring people to FaceAI:

• Google Analytics for Firebase (Google) – usage analytics and ad campaign measurement
• Meta SDK (Meta Platforms) – measurement of ads shown on Facebook and Instagram
• Adjust – install attribution, which links an app install to the campaign that led to it, and reporting app events and purchases to advertising partners such as Meta, TikTok and Google

These tools receive device identifiers (the Identifier for Advertisers on iOS where you allow it in Apple's tracking prompt, the Advertising ID on Android, and the Identifier for Vendors), your IP address, device and app version information, and app events such as installing the app, opening it, finishing onboarding, viewing a subscription offer and making a purchase. Purchases and subscription renewals reach Adjust from our subscription provider, Adapty. If you are signed in, Adjust also receives a SHA-256 hash of your account e-mail address and our identifier for your account. These tools do not receive your photos or the images you generate.

Sharing with advertising partners through Adjust

Adjust reports app events (such as installing the app, opening it, finishing onboarding, creating an account, or making a purchase or subscription renewal) to advertising partners such as Meta, TikTok and Google, so that the ads shown on their platforms can be measured. For Meta this happens through the Meta Conversions API, in addition to the Meta SDK inside the app. Together with each event Adjust shares your device's advertising identifier where it is available, your IP address, your device's user agent, and device and app information, and with Meta also the hashed e-mail address and account identifier described above. The partners use these to match the event to their ads for measurement. Adjust does not receive your photos or the images you generate.

Legal basis

We use these tools on the basis of our legitimate interest in understanding and promoting our Services.

Controls on your device

• On iOS: the system asks whether FaceAI may track you across other apps and websites (App Tracking Transparency). You can change that answer at any time in iOS Settings › Privacy & Security › Tracking. If you do not allow tracking, your Identifier for Advertisers is not used for advertising.
• On Android: you can reset or delete your Advertising ID in Android Settings › Privacy › Ads.

Cookies on our website

Our website uses cookies and similar technologies to keep the site working and to hold certain information. It also loads the Meta Pixel and the TikTok Pixel, which tell Meta and TikTok about visits to the site so that the ads that bring people to FaceAI can be measured. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent.

12. Legal Bases

If you are in the European Economic Area, the United Kingdom or Switzerland (where the GDPR or equivalent laws apply), or in Türkiye (where the KVKK applies), we process your personal data on the following legal bases:

• To perform our contract with you: providing the Service, your account, your creations, purchases and support (GDPR Article 6(1)(b); KVKK Article 5(2)(c)).
• To comply with legal obligations: for example keeping tax records and complying with orders from authorities (GDPR Article 6(1)(c); KVKK Article 5(2)(ç)).
• Our legitimate interests, where they are not overridden by your rights: security, moderation, enforcing our Terms of Use, keeping creation records and making the disclosures described in section 9, testing and improving the Service, recommendations, and analytics and advertising measurement (GDPR Article 6(1)(f); KVKK Article 5(2)(f)).
• To establish, exercise or defend legal claims (GDPR Articles 6(1)(f) and 9(2)(f); KVKK Articles 5(2)(e) and 6(3)).
• Your consent, where the law requires it, for example for the processing described in section 5 and for sharing consumption data with Apple (section 17). You can withdraw your consent at any time; this does not affect processing that took place before.

13. International Transfers

We are based in Türkiye, and our servers and most of our service providers are in the United States and other countries, so your personal data is processed outside the country where you live. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we rely on safeguards such as the European Commission's Standard Contractual Clauses (and their UK and Swiss equivalents) or the recipient's certification under the EU-U.S. Data Privacy Framework. Where the KVKK applies, we transfer personal data abroad in accordance with Article 9 of the KVKK. You can contact us for more information about these safeguards.

14. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Restrict or object to data processing
• Data portability
• Withdraw any consent you have given

You can exercise these rights by contacting us at the address in section 18. We may need to verify that the request comes from the owner of the account. We may refuse or delay a request, for example to delete data that we must keep under section 7 or section 9, where the law allows us to. If you are in the European Economic Area, the United Kingdom or Switzerland, you also have the right to lodge a complaint with your local data protection authority. If you are in Turkey, you may apply to us under Article 11 of the Personal Data Protection Law No. 6698 (KVKK) and, if unresolved, to the Personal Data Protection Authority.

15. Children's Privacy

Our app is not intended for children under 13. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us. Under our Terms of Use, users under 18 need the permission of a parent or legal guardian, and photos of a child may only be uploaded by the child's parent or legal guardian or with their permission.

16. Changes to This Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last updated” date, and for material changes we will also give notice in the app or by e-mail where we can.

17. App Store Refund Requests Consent

When you request a refund through the App Store for purchases made within our application, we may share certain information with Apple to help them make informed refund decisions. This information may include:

• Details about your consumption of the purchased item
• Usage data related to the subscription or in-app purchase
• Date and time of consumption
• Other relevant information about your use of the purchased content

By using our application and making purchases, you consent to our sharing of this consumption information with Apple when you initiate a refund request. This data helps Apple determine the appropriate action for your refund request and is not used for tracking purposes.

This information is only shared with Apple in response to a specific refund request and is used solely for the purpose of processing that request. We do not share this information with any other third parties.

18. Contact Us

If you have any questions about this privacy policy, please contact us at:

Email: info@dofatech.com

Requests to erase photos and reports about content: faceai@dofatech.com

DOFA TECH YAZILIM HİZMETLERİ ANONİM ŞİRKETİ, Ismet Kaptan Mah. Gazi Osman Pasa Bul. No: 9 Ic Kapi No: 47 Konak / Izmir TURKEY