Privacy Policy
This policy combines our Privacy Policy and our privacy notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”). It explains how your personal data is processed when you use the Axvilo service (axvilo.com).
In short
- Your photos and the images you generate are yours. They are visible only in your account.
- We do not sell your data or share it with anyone for advertising.
- We use your images in our own marketing only with your separate, explicit permission.
- We do not use your images to train AI models.
- Your card details never reach us; payments are processed directly by Stripe.
- When you close your account or ask us to, your photos and images are deleted within 30 days.
1. Data controller
Your personal data is processed by NAIDOS LLC, operating under the “Axvilo” brand (“Axvilo”, “we”), as data controller.
- Legal name: NAIDOS LLC (operating under the Axvilo brand)
- Address: 8 The Green, Dover, Delaware 19901, United States
- Email: destek@axvilo.com
- Website: axvilo.com
2. Personal data we process
| Category | Data | Source |
|---|---|---|
| Identity | Full name | Sign-up form |
| Contact | Email address, phone number | Sign-up form, phone verification step |
| Verification and security | SMS verification code (only a one-way hashed version is stored; valid for 10 minutes), IP address, session and access logs, attempt/rate-limit logs | Automatically (while using the site) |
| Customer information | Onboarding survey answers (industry, sales channels, number of products) | Post-sign-up survey |
| Consent records | Time of acknowledging the privacy notice and accepting the terms; commercial electronic message consent and its time | Sign-up form, account settings |
| Customer content | Product photos you upload, generated images, product names, product attributes extracted by AI from the photo (type, color, fabric, etc.), generation settings (model, pose, background, etc.) | Your uploads and the operation of the service |
| Feedback | Likes/dislikes you give to images and the reason you state, support correspondence | Dashboard, email |
| Customer transactions | Credit balance and history, purchased packages, use of free regenerations | Operation of the service |
| Financial | Purchase amount, date, payment status, invoice details. Card numbers never reach us; card brand and last 4 digits are held by the payment institution (Stripe). | Payment institution |
| Technical | Session cookies, browser and device information | Automatically (cookies) |
The service works on product photos. Photos you upload are expected not to contain real people’s faces or other personal data. If you upload content containing images or information of third parties, you are responsible for informing them and obtaining any required consent. We do not process special categories of personal data (health, biometric data, etc.); please do not upload content containing such data.
3. Purposes and legal bases
Your personal data is processed on the following legal bases set out in Article 5(2) of the KVKK:
| Purpose | Legal basis (KVKK Art. 5(2)) |
|---|---|
| Creating your account and letting you sign in (one-time code by email) | (c) Formation and performance of a contract |
| Generating images from your photos, recognizing product attributes, storing and providing the images in your account | (c) Formation and performance of a contract |
| Managing credit balances, purchases, refunds and free regenerations | (c) Formation and performance of a contract |
| Sending transactional emails (sign-in code, receipt, account notices) | (c) Formation and performance of a contract |
| Keeping invoice and accounting records, responding to requests from competent authorities | (ç) Compliance with a legal obligation |
| Using phone verification to grant free credits to a single account, preventing fake accounts and abuse (including IP and rate-limit logs) | (f) Legitimate interest |
| Securing the service, detecting errors, measuring generation quality and improving the service (feedback, onboarding survey) | (f) Legitimate interest |
| Exercising and defending our rights in case of a dispute | (e) Establishment, exercise or protection of a right |
| Answering your support requests | (c) Performance of a contract, (f) Legitimate interest |
| Sending campaign and product update messages (email, SMS) | Explicit consent (KVKK Art. 5(1)) and commercial electronic message consent under Law No. 6563 |
Commercial electronic message consent is optional; not giving it does not affect your use of the service. You can withdraw it at any time via the unsubscribe link in each message or by writing to destek@axvilo.com. Consents may be registered with the Message Management System (İYS) as required by law.
We do not use your images to train AI models. We use your images in Axvilo’s marketing or showcase only with your separate, explicit permission.
4. Recipients of personal data
We work with certain technical service providers (data processors) to provide the service. Your data is transferred to them only for the purposes listed below and only to the extent necessary. We do not sell your data or share it with third parties for advertising.
| Recipient | Data transferred | Purpose | Country |
|---|---|---|---|
| Supabase Inc. (infrastructure: Amazon Web Services) | Account data, consent records, credit history, uploaded photos, generated images | Database, authentication and file storage | USA (server region depends on provider infrastructure) |
| Vercel Inc. | IP address, access logs, data passing through server operations | Website hosting and server operations | USA |
| Features & Labels Inc. (fal.ai) | Product photo, reference image of the selected model, generation prompt and settings | AI image generation | USA |
| Google LLC (Gemini model, via fal.ai) | Product photo | Recognizing attributes such as product type, color and fabric | USA |
| Stripe Payments Europe Ltd. / Stripe Inc. | Name, email, purchase amount, card details (entered directly with Stripe) | Processing payments and refunds, fraud prevention | Ireland / USA |
| Plus Five Five Inc. (Resend) | Email address, name, email content | Transactional emails and, if you consented, informational emails | USA |
| Netgsm İletişim ve Bilgi Teknolojileri A.Ş. | Phone number, SMS containing the verification code; informational SMS if you consented | Phone verification by SMS | Türkiye |
| Google LLC (Google Workspace) | Email address, name, content of support correspondence | Handling support emails | USA |
| Legal and financial advisors | Records needed for a dispute or audit | Legal and financial obligations, protection of rights | Türkiye / USA |
| Competent public authorities and courts | Requested records | Legal obligation | Türkiye |
SMS verification through Netgsm is being set up; once live, it will be used within the scope above. If the list of service providers changes, this policy will be updated.
5. International transfers
The data controller, NAIDOS LLC, is a company established in the United States, and most of the providers above have servers outside Türkiye (mainly in the United States and the European Union). Your personal data is therefore transferred abroad.
Transfers abroad are carried out under Article 9 of the KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad: where one of the legal bases in Article 5 exists and appropriate safeguards are in place, such as signing the standard contracts announced by the Personal Data Protection Board and notifying the Board within the required period. In exceptional cases where appropriate safeguards cannot be provided, we may rely on the incidental transfer grounds listed in Article 9(6) of the KVKK (for example, where the transfer is necessary for the performance of a contract).
6. How we protect your data
- All connections to the site are encrypted (HTTPS/TLS).
- Card details do not pass through or get stored on our servers; payment is taken on Stripe’s secure page.
- The database enforces row-level access rules: each user can see only their own data.
- Photos and images are not public; they are shown only through time-limited links specific to you.
- Credit balances change only on the server; they cannot be changed from the browser.
- SMS verification codes are not stored in plain text but in one-way hashed form, for a short time.
- Administrative access is limited to a small number of authorized people; API keys are kept only on the server.
- Sign-in is passwordless, using a one-time code sent to your email; repeated attempts are rate-limited.
No system is 100% secure. If a security breach affects your data, we will notify you and the Personal Data Protection Board within the period required by law.
7. Retention periods
| Data | Retention period |
|---|---|
| Account data (name, email, phone, survey answers, credit history) | While the account is open; deleted or anonymized within 30 days after the account is closed |
| Uploaded photos and generated images | While the account is open; deleted within 30 days after the account is closed or you request deletion |
| Payment and invoice records | For the period required by applicable law (10 years under the Tax Procedure Law and the Turkish Commercial Code) |
| SMS verification codes | At most 24 hours (codes are valid for 10 minutes) |
| IP address and rate-limit / security logs | 6 months |
| Commercial electronic message consent | Until withdrawn; after withdrawal, for the period required by law for proof |
| Support correspondence | While the account is open; in case of a dispute, for the limitation period |
Data whose retention period has expired is deleted, destroyed or anonymized in accordance with the Regulation on the Deletion, Destruction or Anonymization of Personal Data. Copies remaining in backups are deleted automatically when the backup cycle completes.
8. Cookies
We currently use only strictly necessary cookies to keep you signed in; there are no advertising or analytics cookies. Details: Cookie Policy.
9. Children
Axvilo is a service for businesses and sellers. Persons under 18 may not open an account or use the service. If we become aware that we are processing data of someone under 18, we will delete it.
10. Your rights (KVKK Article 11)
As a data subject, you have the right to:
- learn whether your personal data is processed,
- request information if it has been processed,
- learn the purpose of processing and whether it is used in line with that purpose,
- know the third parties in Türkiye or abroad to whom it is transferred,
- request correction if it is incomplete or inaccurate,
- request deletion or destruction under the conditions of Article 7 of the KVKK,
- request that correction, deletion and destruction be notified to third parties to whom the data was transferred,
- object to a result against you arising from analysis exclusively by automated systems,
- claim compensation if you suffer damage due to unlawful processing.
11. How to apply
In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your requests from the email address registered in your account to destek@axvilo.com, or in writing to our address above. Please state your full name, contact details and your request clearly. We may ask for additional information to verify your identity.
Your request will be concluded free of charge within 30 days at the latest, depending on its nature. If the process requires an additional cost, a fee may be charged according to the tariff set by the Board. If your request is rejected, the answer is insufficient or not given in time, you may file a complaint with the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of the application date.
12. Changes
We may update this policy. We will announce significant changes by email or on the site before they take effect. The current version is always on this page.