1. Data controller
qrafx Studio (İstanbul). Contact: info@qrafx.com.
2. Data we process
During membership and service we process:
- Identity and contact: full name, phone, email.
- Business: business name, the URL where you sell your products.
- Service data: product photos you upload, pose/model/background preferences, your file naming scheme, job and request history, panel notifications.
- Technical: IP address, browser and device information, session and security logs.
- Communication: demo call and support correspondence.
3. Purposes
Your data is processed only to:
- Create your membership, authenticate you and give panel access.
- Evaluate your demo request and contact you.
- Receive, price, produce and deliver job requests.
- Process product images for AI-assisted dressing and scene generation.
- Send automatic emails on status changes.
- Keep the service secure, prevent abuse and meet legal obligations.
4. Legal basis
Under KVKK art. 5/2: necessity for the establishment or performance of a contract, the controller's legal obligations and legitimate interests; and under art. 9, your explicit consent for processing product images on AI infrastructure located abroad.
5. Transfers
Product images may be transferred to AI and cloud infrastructure providers located abroad for dressing and scene generation, only with your explicit consent and to the extent the service requires. Identity and contact data are not shared with third parties except where legally required.
6. Retention
Uploaded product photos and delivered frames are deleted automatically 24 hours after your first download. Membership and contact data are kept for the life of your membership and any statutory retention period; job records for the period required by law.
7. Your rights (KVKK art. 11)
Send requests with proof of identity to info@qrafx.com. Requests are answered within 30 days at the latest.
- Learn whether your data is processed and request information.
- Learn the purpose and whether data is used accordingly.
- Know the third parties to whom data is transferred, domestically or abroad.
- Request correction of incomplete or inaccurate data.
- Request deletion or destruction under art. 7.
- Request that corrections and deletions be notified to third-party recipients.
- Object to results produced solely by automated analysis.
- Claim compensation for damage caused by unlawful processing.