Privacy Policy
Last updated 18 October 2026
This policy explains what personal data Wulpax collects, why, and what your rights are. The data controller is TKT SOLUTIONS GIDA DIŞ TİCARET VE LİMİTED ŞİRKETİ, Elmalı Mh. 7. Sk. Zamanlar İş Merkezi No:18/604, Muratpaşa/Antalya, Türkiye (“we”). Contact: wulpax@tktexport.com. We process personal data in line with the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where it applies, the EU General Data Protection Regulation (GDPR).
1. What we collect
- Account data: your email address, the name you enter at sign-up, and your password (stored only as a secure hash by our login provider).
- Content: the prompts you write, the images you upload (including reference photos for characters) and the images and videos you generate.
- Usage and billing records: your credit history, the generations you ran and their status, your plan and subscription status, and order references from our payment provider.
- Consent records: the time you confirmed you have permission to use a person's photos.
- Safety records: when a safety filter refuses a request, the prompt, model and time of that request.
- Technical data: IP address, browser type and timestamps in server logs.
We never receive or store your card details; payments are handled entirely by Lemon Squeezy. Photos of faces are used only to create the images you ask for; we do not use them to identify people.
2. Why we use it and on what legal basis
- To provide the Service (account, generations, storage, credits): performance of our contract with you.
- To take payments and keep accounting records: contract and legal obligations.
- To keep the Service secure and prevent abuse, including reviewing content that may break our Terms: our legitimate interests.
- To send service emails such as sign-up confirmation and password reset: contract.
We do not sell your data, show ads, or use your content to train AI models.
3. Who we share it with
We use these service providers, who process data on our behalf and only for these purposes:
| Provider | Purpose | Data |
|---|---|---|
| Supabase | Account login, database and private file storage | Account data, uploads, outputs |
| Vercel | Hosting of the website and server code | Technical request data (IP address, browser) |
| fal.ai | Running the AI models | Prompts and the images you send to a model |
| AI model providers via fal.ai (e.g. Google, Black Forest Labs, Ideogram, Alibaba, MiniMax, Kuaishou) | Generating images and videos | Prompts and input images for that generation |
| Lemon Squeezy | Payments, taxes and invoices (Merchant of Record) | Name, email, billing address, payment details |
| Resend | Sending account emails (confirmation, password reset) | Email address |
| Cloudflare (Turnstile) | Bot check on the sign-in and sign-up forms | Technical request data (IP address, browser) |
We may also disclose data when required by law or to protect people from harm, for example by reporting illegal content to the authorities.
4. International transfers
Our providers store and process data outside Türkiye, mainly in the United States and the European Union. We transfer data abroad only with the safeguards required by KVKK and the GDPR, such as standard contractual clauses.
5. How long we keep it
- Account data, content and credit history: for as long as your account exists.
- You can delete any image or video from your library at any time; its files are removed from our storage straight away.
- Safety records of refused requests: for as long as your account exists, even if you delete the related item, so that repeated abuse can be recognised.
- After you ask us to delete your account, we delete your content and account data within 30 days.
- Billing records are kept for as long as tax and commercial law requires (in Türkiye, generally 10 years).
- Model providers may keep inputs briefly to run and secure their services, according to their own policies.
6. Cookies
We use only the cookies needed to keep you signed in and to remember your language. We do not use analytics, advertising or tracking cookies. If that changes, we will update this policy and ask for consent where required.
7. Your rights
Under KVKK (Article 11) and the GDPR you can ask whether we process your data and get a copy of it, have it corrected or deleted, restrict or object to processing, receive it in a portable format, learn who it was shared with, and object to decisions made solely by automated processing. To use these rights, email wulpax@tktexport.com from the address on your account. We answer within 30 days. You can also complain to the Turkish Personal Data Protection Authority (KVKK) or, in the EU, to your local data protection authority.
8. Security
Your files are stored in private storage and shown to you only through short-lived links. Access between users is separated at the database level. No system is perfectly secure; if a breach affects you, we will notify you and the authorities as the law requires.
9. Children
The Service is for people aged 18 and over. We do not knowingly collect data from children.
10. Changes
We will post any changes here and update the date above. For significant changes we will also notify you by email.