Privacy Policy
Effective date: —
In short
- The photos and videos you upload are used only for the creation you ask for and are automatically deleted after 30 days. You can delete them right away if you want.
- Your creations are private by default. No one sees them unless you share them.
- What you upload and create is not used to train AI models and is not sold.
- We do not perform facial recognition and we do not store face templates.
- We do not see or store your card details.
- You can download your data and delete your account and all your creations.
1. Who are we?
Rayomo is operated by — ("Umutla", "we"). We are the data controller for your personal data.
- Address: —
- MERSIS: —
- Email: info@rayomo.com
- Registered e-mail (KEP): —
- EU representative (GDPR Art. 27): —
- UK representative (UK GDPR Art. 27): —
2. What data do we collect?
| Data | When | Examples |
|---|---|---|
| Account data | Sign-up and sign-in | Email, display name, profile photo (when signing in with Google/Apple), language preference |
| Uploads | When you upload a file for a creation | Photos, videos (including facial images and the audio in videos) |
| Prompts and settings | When you start a creation | The text you write, template, tier, format, duration |
| Outputs | When a creation is completed | The images and videos created |
| Activity data | During use | Credit transactions, creation history, Feed shares, likes, reports |
| Payment data | When you make a purchase | Order number, amount, currency, payment status, billing details. Card details are entered directly with the licensed payment institution or the app store; we do not see them. |
| Consent records | Likeness confirmation, explicit consent, accepting the terms | Date, text version, IP address |
| Technical data | On every visit | IP address, device/browser type, session logs, error logs, cookies |
| Communications | When you write to us | Email correspondence, support requests, rights infringement notices |
Facial images: Faces in photos are personal data. We do not use faces to identify or verify anyone, and we do not create biometric templates; facial images are processed only to create the content you request. As a precaution, we obtain your explicit consent for operations that transfer facial likeness, such as Video replace. We do not infer sensitive information such as race, religion or health from images.
Other people's data: If the content you upload features other people, it is your responsibility to inform them and obtain their permission.
Children: Rayomo is not intended for anyone under 18. If we find an account belonging to someone under 18, we delete the account and its data.
3. Why do we use data, and on what legal basis?
| Purpose | Legal basis (GDPR Art. 6 / KVKK Art. 5) |
|---|---|
| Creating and managing your account | Performance of a contract |
| Creating and storing the images and videos you request and letting you download them | Performance of a contract (plus explicit consent for Video replace) |
| Taking payments, adding credits, managing subscriptions | Performance of a contract |
| Issuing invoices, complying with tax and consumer legislation | Legal obligation |
| Content safety (automated checks for nudity, protection of minors, etc.), moderation | Legitimate interest (protecting users and third parties) and legal obligation |
| Recording likeness confirmations and consents | Legitimate interest / protection of rights |
| Security, preventing fraud and abuse, access logs | Legitimate interest and legal obligation |
| Responding to support and rights infringement requests | Performance of a contract, legitimate interest |
| Transactional emails (sign-in, receipts, creation ready) | Performance of a contract |
| Improving the Service (aggregated, anonymous statistics) | Legitimate interest |
| Publishing your own image in the public Feed | Explicit consent |
| Marketing emails | Explicit consent |
| Analytics cookies | Explicit consent |
Where we rely on legitimate interest, we balance our interest against your rights, and you have the right to object (Section 8).
Automated decisions: Uploads and outputs pass through automated content safety systems, and content found to violate the rules may be blocked. This is necessary to provide the Service safely. If you think a decision was wrong, you can request a human review by writing to destek@rayomo.com. We do not make automated decisions for profiling purposes.
Model training: We do not use your uploads or outputs to train AI models.
4. Who do we share data with?
We do not sell your data. We share it only to the extent necessary to provide the Service, and only with service providers bound by contract (data processors):
| Recipient category | Location | Why |
|---|---|---|
| Third-party AI infrastructure providers | USA | Generation and automated content safety checks |
| Cloud storage and content delivery provider | EU / USA | Storing and serving files |
| Server hosting provider | — | Running the application |
| Licensed payment institution | Türkiye | Web payments |
| Mobile purchase management infrastructure | USA | Verifying mobile purchases |
| Apple App Store, Google Play | USA / EU | Mobile purchases (independent data controllers) |
| Sign in with Google / Apple (if you choose it) | USA | Authentication |
| E-invoice service provider, certified public accountant | Türkiye | Invoicing and accounting |
| Error monitoring and (if you consent) analytics providers | — | Debugging, statistics |
| Competent authorities, courts | — | Legal requirement |
| Legal advisers | Türkiye | Protection of rights |
| Acquirer in the event of a merger/transfer of the company | — | Continuity of the Service (you will be notified) |
Content you share in the public Feed can be seen by anyone.
5. International transfers
We are based in Türkiye, and some of our providers are located in the USA and the EU. When transferring your data to these countries, we use appropriate safeguards:
- Transfers from Türkiye: Standard contracts published by the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) under Article 9 of KVKK (notified to the Authority), or adequacy decisions.
- Data of EEA/UK users: Where there is no European Commission adequacy decision for Türkiye or the USA (except for recipients in the USA participating in the EU-U.S. Data Privacy Framework), the European Commission's Standard Contractual Clauses (and, for the UK, the addendum/IDTA) together with any necessary supplementary measures.
You can request a copy of the safeguards at info@rayomo.com.
6. How long do we keep data?
| Data | Period |
|---|---|
| Uploads | 30 days (incomplete uploads 24 hours); you can delete them earlier |
| Outputs | Until you delete them or delete your account |
| Blocked outputs | Not stored |
| Account data | Until the account is deleted |
| Payment and invoice records | 5–10 years (Turkish tax and commercial law) |
| Consent records | Life of the account + statutory limitation period |
| Access logs | The period required by Turkish legislation (—) |
| Backups | Deleted data is removed from backups within — days at the latest |
7. Security
We encrypt data in transit (HTTPS/TLS) and at rest; access to files is provided through short-lived signed links; access by authorised staff is limited on a role basis and logged; and payment card data never enters our systems. No system is completely secure; if a data breach occurs, we will notify it as required by law (under KVKK, to the Board within 72 hours) and inform affected users.
8. Your rights
Depending on the country you are in, you have the following rights:
- Access: To find out what data we process about you and get a copy (Account → Settings → Download my data).
- Rectification: To have inaccurate data corrected.
- Erasure: To have your data deleted (Account → Settings → Delete account; for individual creations and uploads, My creations).
- Restriction and objection: In particular, to object to processing based on legitimate interest.
- Data portability: To receive your data in a machine-readable format.
- Withdrawing consent: You can withdraw any consent you have given at any time; this does not affect processing carried out before the withdrawal.
- Objecting to automated decisions and requesting human review.
- Complaints: In Türkiye, to the Personal Data Protection Board; in the EEA, to the data protection authority of your country; in the UK, to the ICO.
- California and other US states: We do not sell your personal data or "share" it for targeted advertising. You can use the channel below for requests to know, correct or delete; you will not be discriminated against for exercising your rights.
Send your requests to info@rayomo.com from your registered email address. We may ask for additional information to verify your identity. We respond to requests within 30 days at the latest (one month under GDPR, extendable where necessary as provided by law). For the application procedure in Türkiye, see Section 8 of the KVKK Privacy Notice.
9. Cookies
We use strictly necessary cookies to make the Service work, and analytics cookies only with your consent. Details: Cookie Policy.
10. Changes
We may update this policy. We will announce material changes in advance by email or in-app notification. The "updated" date at the top of the page shows the latest change.
11. Contact
For any privacy question: info@rayomo.com · — · —
Version history
0.1.0 · October 15, 2026
Questions? destek@rayomo.com · Contact