سياسة الخصوصية

This policy explains what personal data Wulpax collects, why, and what your rights are. The data controller is TKT SOLUTIONS GIDA DIŞ TİCARET VE LİMİTED ŞİRKETİ, Elmalı Mh. 7. Sk. Zamanlar İş Merkezi No:18/604, Muratpaşa/Antalya, Türkiye (“we”). Contact: hello@wulpax.com, KEP (registered e-mail): tktsolutions@hs01.kep.tr, MERSIS no: 0845064083900001. We process personal data in line with the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where it applies, the EU General Data Protection Regulation (GDPR).

1. What we collect

• Account data: your email address, the name you enter at sign-up, and your password (stored only as a secure hash by our login provider).
• Content: the prompts you write, the images you upload (including reference photos for characters) and the images and videos you generate.
• Usage and billing records: your credit history, the generations you ran and their status, your plan and subscription status, and order references from our payment provider.
• Consent records: the time you confirmed you have permission to use a person's photos.
• Safety records: when a safety filter refuses a request, the prompt, model and time of that request.
• Technical data: IP address, browser type and timestamps in server logs.

We never receive or store your card details; payments are handled entirely by our payment provider, iyzico. Photos of faces are used only to create the images you ask for; we do not use them to identify people.

2. Why we use it and on what legal basis

• To provide the Service (account, generations, storage, credits): performance of our contract with you.
• To take payments and keep accounting records: contract and legal obligations.
• To keep the Service secure and prevent abuse, including reviewing content that may break our Terms: our legitimate interests.
• To send service emails such as sign-up confirmation and password reset: contract.
• To send campaign and product news emails, only if you ticked that box at sign-up or in your account: your consent. We keep your choice and its date; you can withdraw it any time from your account page or the link in those emails.

We do not sell your data, show ads, or use your content to train AI models.

3. Who we share it with

We use these service providers, who process data on our behalf and only for these purposes:

We may also disclose data when required by law or to protect people from harm, for example by reporting illegal content to the authorities.

4. International transfers

Our providers store and process data outside Türkiye, mainly in the United States and the European Union. We transfer data abroad only with the safeguards required by KVKK and the GDPR, such as standard contractual clauses.

5. How long we keep it

• Account data, content and credit history: for as long as your account exists.
• You can delete any image or video from your library at any time; its files are removed from our storage straight away.
• Safety records of refused requests: for as long as your account exists, even if you delete the related item, so that repeated abuse can be recognised.
• After you ask us to delete your account, we delete your content and account data within 30 days.
• Billing records are kept for as long as tax and commercial law requires (in Türkiye, generally 10 years).
• Model providers may keep inputs briefly to run and secure their services, according to their own policies.

6. Cookies

We use the cookies needed to keep you signed in and to remember your language. Only with your consent, we also use Google Analytics (Google LLC) cookies to measure how the site is used: pages visited, device and browser details, approximate location and traffic source are sent to Google, including outside Turkey. Without your consent Google Analytics is never loaded. We do not use advertising cookies. You can change your choice at any time from the "Cookie settings" link at the bottom of the page.

7. Your rights

Under KVKK (Article 11) and the GDPR you can ask whether we process your data and get a copy of it, have it corrected or deleted, restrict or object to processing, receive it in a portable format, learn who it was shared with, and object to decisions made solely by automated processing. To use these rights, email hello@wulpax.com from the address on your account. We answer within 30 days. You can also complain to the Turkish Personal Data Protection Authority (KVKK) or, in the EU, to your local data protection authority.

8. Security

Your files are stored in private storage and shown to you only through short-lived links. Access between users is separated at the database level. No system is perfectly secure; if a breach affects you, we will notify you and the authorities as the law requires.

9. Children

The Service is for people aged 18 and over. We do not knowingly collect data from children.

10. Changes

We will post any changes here and update the date above. For significant changes we will also notify you by email.