This notice is provided under Article 10 of Turkey’s Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, to inform users of the Sestina mobile app (the “App”). More detail is in the Privacy Policy.
The data controller is Hasan Can Demircan, the individual developer of the App. Contact: support@sestinaapp.com.
All data is collected through the App, electronically. It is created when you enter it or take an action (partly automated), or automatically while the App runs (counters, server logs).
| Data | Purpose | Legal basis | Collection method |
|---|---|---|---|
| Account data: email address, name, password (for email sign-up), Apple / Google identity token, profile picture link when you sign in with Google, time of your over-18 confirmation | Creating, signing in to and managing your account; applying the age limit | KVKK Art. 5/2-c (establishing and performing a contract) | Information you enter on the sign-up and sign-in screens; from the provider when you sign in with Apple or Google |
| Style profile: the styles and weights you pick | Outfit suggestions | KVKK Art. 5/2-c | Your choices on the onboarding screens |
| Clothing photos and clothing details (category, color, pattern, season, fabric, fit, etc.) | Digital wardrobe, outfit suggestions, calendar | KVKK Art. 5/2-c | Photos you take with the camera or pick from your gallery; you choose the details, or (if you allowed it) AI extracts them |
| AI recognition of clothing and products: clothing or “Match?” product photo; the style names you pick, for your Style DNA name | Background removal, recognizing clothing features, “Match?” scans, Style DNA name | KVKK Art. 5/2-c. The AI permission is an additional in-app preference; it is not a processing condition under the KVKK. | When you add a photo or scan; sent to providers only if you allowed it |
| Profile photo (full-length) and the virtual try-on images created with it | Virtual try-on | Explicit consent (KVKK Art. 5/1; Art. 6 to the extent it is special category data) — “Virtual try-on · your photo” consent | The photo you pick from your gallery |
| Physical profile (height, weight, age, body type, skin tone, hair color, length and type), the AI mannequin generated from it and the try-on images created with the mannequin | Generating an AI mannequin for virtual try-on | Explicit consent (KVKK Art. 5/1; Art. 6 to the extent it is special category data) — “Virtual try-on · your physical details” consent | Only the fields you choose on the physical profile screen |
| Outfits, worn and planned outfits (calendar), favorites | Outfit history and planning | KVKK Art. 5/2-c | Your actions in the App |
| Approximate location (coordinates rounded to about 1 km) | Weather-based suggestions | KVKK Art. 5/2-c | From your device if you grant location permission, only while the App is open |
| Subscription data: product, store, period type, expiry date, auto-renewal | Managing your Premium subscription and applying plan limits | KVKK Art. 5/2-c | From RevenueCat, based on your App Store / Google Play purchase |
| Consent and permission records: which text, which version, and when you accepted or declined it | Keeping and proving records of consents and permissions | KVKK Art. 5/2-ç (legal obligation) | Your choices on the consent and permission screens |
| Account deletion record: time of deletion, channel, types of data deleted, outcome of the RevenueCat / Apple steps; and an irreversible digest of the user ID, so that a deleted account can be deleted again if a backup is restored | Showing that the deletion took place | KVKK Art. 5/2-ç (Regulation on the Deletion, Destruction or Anonymization of Personal Data, Art. 7/3) | Automatically when your account is deleted; by us for deletions requested by email |
| Security and operations records: virtual try-on quota records, daily usage counters, your user ID in server logs, sign-in and authentication records (including IP address), database backups | Preventing misuse, security, debugging, applying plan limits | KVKK Art. 5/2-f (legitimate interest) | Automatically while the App runs |
| Support and request correspondence | Responding to your requests and KVKK applications, verifying the applicant’s identity | KVKK Art. 5/2-ç and 5/2-c | Emails you send us |
Depending on their content and how they are used, your profile photo and virtual try-on images may count as special category personal data under KVKK Art. 6 (e.g. clothing and attire); the skin tone in your physical profile may also count as special category data in terms of race or ethnic origin. For this reason virtual try-on is based on your explicit consent, and additional security measures are applied to this data (Privacy Policy, section 4).
Your personal data is shared with the following service providers only as far as needed for the purposes above: Supabase (hosting), Anthropic (AI clothing recognition and Style DNA name), Poof (background removal), FASHN (virtual try-on), OpenWeather (weather), RevenueCat (subscription management), Expo (app updates), Apple and Google (sign-in and store purchases), Google (storing database backups in Google Drive; receiving support emails in Gmail), Cloudflare (forwarding support emails). The data sent to each is listed in the Privacy Policy. Where legally required, it may also be shared with public authorities entitled to request it.
| Provider | Country | Data transferred | Purpose |
|---|---|---|---|
| Supabase | Germany (Frankfurt, EU) | All data stored on the server | Hosting: database, authentication, file storage |
| Anthropic | USA | Background-removed clothing or product photo; the style names you pick | Clothing recognition, Style DNA name (if AI permission is given) |
| Poof (Dumpling Software UG) | Germany | Clothing or product photo | Background removal (if AI permission is given) |
| FASHN (FASHN LTD) | United Kingdom; through FASHN’s sub-processors, the USA, Singapore, Malaysia, Indonesia, the EU and global cloud / content delivery networks | Profile photo or AI mannequin, clothing images (via links valid for 10 minutes); if there is no profile photo, a mannequin description generated from the physical profile | Virtual try-on (if the relevant explicit consent is given) |
| OpenWeather (OpenWeather Ltd) | United Kingdom | Rounded coordinates or “Istanbul” | Weather |
| RevenueCat, Inc. | USA | Account ID, store purchase information | Subscription management |
| Expo (650 Industries, Inc.) | USA | Device operating system and a random ID for the app installation | Downloading app updates |
| Apple / Google | The provider’s own policy | Information you share directly with the provider during sign-in and purchase | Sign-in, store purchases |
| Google (Google LLC) — Google Drive | USA | Database backups encrypted with AES-256 (excluding photos) | Storing backups |
| Cloudflare, Inc. | USA | Emails you send us | Forwarding support emails |
| Google (Google LLC) — Gmail | USA | Emails you send us and our replies | Receiving and storing support and request emails |
| Data | Period |
|---|---|
| Account, style profile, wardrobe, outfits, favorites, subscription status, virtual try-on quota records | For as long as your account exists; deleted immediately when you delete your account. Database records may remain in backups for up to 30 days. |
| Individually deleted clothing items | The record, its images and any try-on images containing that item are deleted immediately |
| Profile photo | Until you remove it, withdraw photo consent or delete your account |
| Physical profile and AI mannequin | Until you withdraw physical details consent or delete your account |
| Virtual try-on images | Until the related item, photo or consent is deleted, or you delete your account |
| Consent and permission records | For as long as your account exists; deleted when you delete your account |
| Daily usage counters | 13 months |
| Operations records (no user ID) | 12 months |
| Account deletion record | Limited to what is needed to show that the deletion took place: the time of deletion, the channel (App, email, under-18 declaration), the types of data deleted, and the outcome of the RevenueCat / Apple steps; and an irreversible digest of the user ID, so that a deleted account can be deleted again if a backup is restored. Kept for at least 3 years, then deleted. |
| Server logs | 1 day |
| Sign-in and authentication records (including IP address) | 1 day in server logs; at most 90 days in authentication audit records. They may remain until this period ends even after you delete your account. |
| Backups | No automatic backups are taken. The database is backed up manually once a week; backups are encrypted with AES-256 and kept in the data controller’s personal Google Drive account (Google LLC, USA) for at most 30 days. Photos are not backed up. |
| “Match?” photos, original photos of clothes added with AI permission, location | Not stored on our servers |
| Support and request correspondence | 2 years from the closing of the request |
| At third parties | The periods stated by the providers (Privacy Policy, Third parties) |
By applying to the data controller, you can:
How to apply, the information requested and the deadlines are explained on the Requests page. You can get a copy of your data right away in the App via Profile → Download my data.