Privacy Policy

This Privacy Policy explains how personal data of users of services provided through ablacim.com (the "Service") is collected, used, stored, shared, and protected.

1. DATA CONTROLLER AND CONTACT

UK GDPR and EU GDPR apply to users in the UK and EU. Türkiye's KVKK (Law No. 6698) applies to users in Turkey via our Turkey Representative. The data controller is registered, where required, with the relevant supervisory authorities (UK ICO, KVKK Authority).

2. PERSONAL DATA WE PROCESS

We process the following categories of personal data:

• Identity & Contact: Name, surname, email address.
• Customer Transactions: Order, payment, invoicing records, support and complaint records.
• Transaction Security: IP address, browser/device information, session logs.
• Special Category Data (Biometric): Photos you upload for palm and face analysis.
• Chat Content: Messages you send to the AI assistant and the responses you receive.
• Behavioural & Analytics: On-site clicks, page views, conversion events (anonymous/pseudonymous).
• Payment: We do not store your card details; payments are processed via Stripe with 3D Secure.

3. SPECIAL CATEGORY (BIOMETRIC) DATA — EXPLICIT CONSENT

Photos you upload of your palm and face are special category personal data (biometric) under UK/EU GDPR Article 9(1) and KVKK Article 6.

We process this data with your explicit consent (GDPR Art. 9(2)(a), KVKK Art. 6/2), for a single purpose — generating the personalised analysis report you requested. Consent is obtained at payment or signup as: "I explicitly consent to my photo being processed for analysis."

Specific safeguards we apply:

• Your photos are permanently deleted within 30 days after the report is generated.
• Photos are not used to train AI models (vendor agreements include zero-retention and no-training commitments).
• We do not share photos with third parties; they are sent to the AI provider performing the analysis, transiently.

Right to withdraw consent: You may withdraw your explicit consent at any time by emailing info@ablacim.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

4. PURPOSES OF PROCESSING AND LEGAL BASES

Your personal data is processed for the following purposes on the indicated legal bases:

• Generating the analysis report (general data): Performance of contract — GDPR Art. 6(1)(b), KVKK Art. 5/2-c.
• Generating the analysis report (biometric photos): Explicit consent — GDPR Art. 9(2)(a), KVKK Art. 6/2.
• Billing and accounting: Legal obligation — GDPR Art. 6(1)(c), KVKK Art. 5/2-a.
• Customer support and communication: Legitimate interest — GDPR Art. 6(1)(f).
• Information security and fraud prevention: Legitimate interest — GDPR Art. 6(1)(f).
• Marketing and analytics: Consent (collected via cookie banner) — GDPR Art. 6(1)(a).
• Commercial electronic communications: Consent — GDPR Art. 6(1)(a). For Türkiye recipients, additionally PECR/ETK Law No. 6563 and IYS approval.
• Compliance with legal obligations: Legal obligation — GDPR Art. 6(1)(c).

5. AUTOMATED DECISION-MAKING AND PROFILING (GDPR Art. 22)

Our service uses AI-based automated processing:

• Photos you upload are processed automatically by AI models.
• Your chat messages are sent automatically to AI providers such as OpenAI / Anthropic.
• The analysis result is delivered to you automatically.

Important: This automated processing is for entertainment and personal-insight purposes and produces no legal, financial, or medical effects. You have the right to request human review, to object, and to express your view regarding the automated outcome (GDPR Art. 22(3)). You may exercise these rights via info@ablacim.com.

6. SUB-PROCESSORS

We use the following third-party sub-processors. Each is contractually bound to protect your data:

• Supabase — Database, authentication, file storage. EU (Frankfurt). EU/UK adequacy.
• Vercel — Frontend hosting, edge functions. Global CDN, US HQ. EU SCCs + UK Addendum.
• Railway — Backend application hosting. US/EU. EU SCCs.
• Stripe — Payment processing, invoicing. UK / US / Ireland. UK adequacy + EU SCCs.
• OpenAI — AI analysis model. US. EU SCCs (zero-retention, no training).
• OpenRouter / Anthropic — AI analysis model. US. EU SCCs (zero-retention, no training).
• Sentry — Error monitoring. EU (Frankfurt).
• PostHog — Product analytics. EU.
• Meta (Facebook) — Ad conversion measurement (Pixel + CAPI). US/Ireland. EU SCCs.
• Email provider — Magic link and transactional emails. EU.

For an up-to-date and complete list, contact info@ablacim.com.

7. INTERNATIONAL DATA TRANSFERS

Some sub-processors may transfer data outside the UK/EU/Türkiye. These transfers rely on:

• UK GDPR / EU GDPR Chapter V — Standard Contractual Clauses (SCCs) and UK adequacy mechanisms.
• KVKK Art. 9 — explicit consent or adequate-protection determinations for transfers from Türkiye.

8. RETENTION PERIODS

Your personal data is retained for as long as necessary for the purposes for which it was collected:

• Uploaded biometric photos: Permanently deleted within 30 days.
• Chat messages and analysis outputs: While your account is active + 30 days.
• Order and invoicing records: 10 years (Türkiye Commercial Code / Tax Procedure Law).
• Payment transaction records: 10 years (Türkiye Law No. 6493, equivalent UK record-keeping).
• IP and security logs: 180 days.
• Marketing preference records: Until withdrawn + 3 years for evidentiary purposes.
• Cookies and analytics: Periods specified in our Cookie Policy.

At the end of these periods, data is deleted, destroyed, or anonymised.

9. YOUR RIGHTS

Under UK/EU GDPR Articles 15–22 (and KVKK Art. 11 for users in Türkiye), you have the right to:

• Access your data and request a copy
• Have inaccurate or incomplete data rectified
• Have your data erased (right to be forgotten)
• Restrict processing
• Data portability
• Object to automated processing and request human review
• Withdraw your explicit consent (with future effect)
• Lodge a complaint with a supervisory authority (UK: ICO • EU: your local DPA • TR: KVKK Authority)

Submit requests to info@ablacim.com — we respond free of charge within 30 days.

10. MARKETING COMMUNICATIONS (UK PECR / TR ETK Law No. 6563)

We send marketing emails with your prior consent under UK PECR (and Türkiye ETK 6563 / IYS for Türkiye recipients). You may withdraw consent at any time by emailing info@ablacim.com or using the "unsubscribe" link in any message.

11. CHILDREN

The Service is not directed at persons under 18; we do not knowingly process personal data of anyone under 18. If we have inadvertently collected such data, contact us for immediate deletion.

12. SECURITY MEASURES

We apply the following technical and organisational measures to prevent unauthorised access, loss, or misuse:

• End-to-end encryption with TLS 1.3
• Database-level encryption-at-rest
• Role-based access control with least-privilege
• Regular security audits and dependency scanning
• Vendor agreements with AI providers including zero-retention and no-training-use clauses
• Breach notification within 72 hours to the relevant authority (GDPR Art. 33 / KVKK Art. 12)

13. COOKIES

See our Cookie Policy for details on cookies used across the site and the consent mechanism.

14. CHANGES TO THIS POLICY

We may update this Policy from time to time. For material changes, we will notify you by email or in-app banner. The current version is always available on this page.

15. CONTACT

For any questions about your personal data and privacy, please contact us:

Last updated: May 9, 2026