This Privacy Policy is provided for transparency. It is not a substitute for legal advice. If you have specific concerns, please consult a qualified privacy lawyer in your jurisdiction.
This Privacy Policy explains how Artificane, a service operated by Mustafa Kayra Tozan (a sole proprietor based in İstanbul, Türkiye) ("Artificane", "we", "us"), processes personal data of users of our website, applications, APIs, and related services (collectively, the "Service").
The data controller is Mustafa Kayra Tozan (trading as Artificane), Kartal, İstanbul 34880, Türkiye. Full legal-entity details are on our Imprint (/imprint). For privacy questions or to exercise your rights, contact privacy@artificane.com.
Account data: email address, display name, username, optional profile bio and avatar.
Content data: films, prompts, comments, ratings, follows, bookmarks, and other content you submit or interact with.
Transaction data: purchases (handled by Paddle.com, our Merchant of Record — we never receive full card numbers), subscription status, and payout records for creators and marketplace sellers (paid out manually via Wise, bank transfer, or Paddle, using the destination you provide when you request a withdrawal).
Usage data: pages viewed, films watched and completion rates, clicks, search queries, device type and operating system, and approximate IP-based location for security and abuse prevention.
Communications: emails or support requests you send us.
Where the EU/UK GDPR applies, we rely on the following bases: (a) performance of contract — to provide the Service you signed up for; (b) legitimate interests — to keep the Service secure, prevent abuse, and improve features; (c) consent — for optional analytics and marketing emails; (d) legal obligation — to comply with applicable law.
You may withdraw consent at any time from /settings without affecting prior processing.
To operate the Service: authenticate you, deliver content, process payments, send transactional email (e.g., password reset, dispute responses).
To moderate and protect: detect spam, abuse, copyright infringement, and to enforce our Terms.
To improve: aggregated, de-identified analytics on which features are used and where users drop off.
To comply with law: respond to legal requests, audits, and tax obligations.
We do not sell personal data and we do not use it to train external AI models.
We use first-party cookies for authentication and session management. We use product-analytics tools (e.g., PostHog) to collect aggregated usage data via first-party cookies or anonymous identifiers.
You can opt out of product analytics from /settings → Privacy at any time.
We share data with carefully selected service providers who process it on our behalf under contractual obligations: Supabase (authentication and database), Cloudflare R2 (video, image, and asset object storage), Paddle (payments, billing & tax as Merchant of Record), Wise (creator and seller payouts), Resend (transactional email), Upstash (rate limiting), Vercel (hosting and analytics), Sentry (error reporting), and PostHog (product analytics). A current list of sub-processors is available on request.
We may disclose data to comply with valid legal process (e.g., subpoena, court order) or when we believe in good faith disclosure is necessary to protect rights, safety, or to investigate fraud. We will notify you of legal disclosure requests where permitted.
Films, profiles, and other content you publish are public by design — they may be indexed by search engines and shared by other users.
Some of our service providers process data in countries other than your own, including the United States, the European Union, and other regions where our sub-processors operate data centers. Where required for EU/UK users, we rely on Standard Contractual Clauses (SCCs) or equivalent safeguards approved under EU/UK law.
For users in Türkiye (KVKK Article 9): the Personal Data Protection Authority of Türkiye has not issued an adequacy decision for all destination countries we use (in particular, the United States). We therefore transfer your personal data abroad on the basis of your explicit consent ("açık rıza"), which you provide at sign-up and through your continued use of the Service after reviewing this Privacy Policy. You may withdraw this consent at any time by contacting privacy@artificane.com or by requesting account deletion at /settings; we will then cease further cross-border processing where technically feasible, subject to legal-retention obligations.
We retain account and content data for as long as your account is active. After account deletion, we retain limited records for up to 90 days for fraud prevention, dispute resolution, and legal compliance, then delete or anonymize them. Audit and transaction logs may be retained longer where required by tax or accounting law.
Hosting-provider obligations under Türkiye Law No. 5651 (Yer Sağlayıcı): Artificane acts as a hosting provider (yer sağlayıcı) under Turkish law for user-submitted content. We retain traffic information — including IP address, timestamp, session identifier, and the URLs accessed — for a minimum of one (1) year and up to two (2) years from the date of access, as required by Article 5 of Law No. 5651 and its implementing regulation. We will respond to lawful access requests from authorized Turkish authorities (BTK and the criminal magistrate's office) within the statutory timeframe.
Depending on your jurisdiction, you may have the right to: (a) access your personal data; (b) correct inaccurate data; (c) delete your data ("right to erasure"); (d) restrict or object to processing; (e) data portability; (f) lodge a complaint with your local data-protection authority.
You can exercise most rights directly from /settings, or contact privacy@artificane.com. We will respond within the timeframes required by applicable law (typically 30 days under GDPR).
Users in Türkiye — KVKK Article 11: under the Turkish Personal Data Protection Law (Kişisel Verilerin Korunması Kanunu, Law No. 6698), you have the right to: (a) learn whether your personal data are being processed; (b) request information about the processing if so; (c) learn the purpose of processing and whether it is used in line with that purpose; (d) learn the third parties to whom your data are transferred, domestically or abroad; (e) request correction of incomplete or inaccurate data; (f) request deletion or destruction of your data; (g) request notification of corrections, deletions, and destructions to the third parties to whom your data have been transferred; (h) object to results that arise from automated analysis of your data; and (i) claim compensation for damages arising from unlawful processing. You may exercise these rights by writing to privacy@artificane.com; we will respond within thirty (30) days as required by KVKK.
California residents have additional rights under the CCPA, including the right to know, delete, correct, and opt out of "sales" of personal information. We do not sell personal information.
We use industry-standard practices to protect your data: HTTPS in transit, encryption at rest where supported, hashed passwords, rate limiting, audit logs, role-based access control, and least-privilege database policies. No system is perfectly secure; if you become aware of a vulnerability, please email security@artificane.com.
Data-breach notification: in the event of a personal-data breach that is likely to result in a risk to the rights and freedoms of affected individuals, we will notify the relevant supervisory authorities — the Turkish Personal Data Protection Authority (KVKK Kurumu) and, where applicable, EU/UK data-protection authorities — without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the breach. Where the breach is likely to result in a high risk to affected users, we will also notify those users directly, using the email address on file, as soon as reasonably practicable.
Artificane is an adults-only Service intended only for users aged 18 and older. We do not direct the Service to children and do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has created an account or provided us personal data, contact privacy@artificane.com and we will close the account and delete the data promptly.
Films and prompts are processed by third-party AI tools (e.g., Sora, Runway, Pika). When you use those tools, your inputs may be processed under their own privacy terms — please review them.
Artificane does not use your User Content to train external AI models. We do use aggregated, anonymized signals (e.g., how often a tool is referenced) to power the platform's discovery features.
We may update this Privacy Policy. If a change is material, we will notify registered users by email or in-app notice at least 14 days before it takes effect. Continued use after the effective date constitutes acceptance.
Questions or requests: privacy@artificane.com. Security reports: security@artificane.com. Legal notices: legal@artificane.com.