Skip to content

Privacy Policy

This text explains how your personal data is processed when you use the Moonpix AI service at moonpixai.com. It is an information notice under art. 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and under art. 13 of the EU General Data Protection Regulation (GDPR). It is not a contract: it does not ask for your consent; we only record that you have read it. The only processing based on your explicit consent is the ad measurement described below.

Data controller

The data controller is Umut Hasan Şahin (a natural person, acting as an individual). If you are signed in, reach us from the support screen on the site; if you cannot sign in, use the request form. No data protection officer has been appointed.

With the same account you can also sign in to our other apps and use your coins there. Those apps have the same data controller; that is why your account and coin information is used there too.

What we process

  • Account: your email address, an irreversible hash of your password (argon2id; we do not store the password itself), your year of birth, your language preference, your member ID, when the account was opened and last signed in to, and your sign-in security settings.
  • If you sign in with Google, from Google: your Google account ID, your email address and whether it is verified, your name and the link to your profile picture.
  • Verification codes: only a hash (SHA-256) of the 6-digit codes we email you. Codes are valid for 10 minutes.
  • Sessions: a session ID, a hash of your browser details (user agent), country, and when the session was opened and last used.
  • Photos and videos you upload and your prompts (the text you write for a generation).
  • Generations: output files, the model and settings you chose, the coin price, the status of the generation and country.
  • Coins and purchases: your balance; coins set aside, spent and returned; your subscription status; the transaction ID, product, price, store and country reported by the store. Your card details never reach us.
  • Age confirmation: if you confirmed your age to access some content, when you did so and your member ID.
  • Agreement evidence: the version and language you accepted, a SHA-256 hash of each document, when you finished reading each document, the confirmation sentences you saw on screen (including your statement that you entered your year of birth correctly and are 18 or older), your year of birth, your IP address, your browser details (user agent), a SHA-256 hash of your email address and the time of acceptance.
  • Support and requests: what you write on the support screen; the full name, email address and message you give on the request form; country.
  • Usage measurement: that a session started, the path of the page you opened, a "still here" signal sent every 60 seconds while the page is open, and that the session ended. If you are signed in, it is linked to your member ID; if not, it is tied to a random number that disappears when you close the tab.
  • Security records: sign-in attempts and risk events. These hold not your IP address itself but an irreversible hash of it made with a secret key (HMAC). During sign-in, registration and password actions these records are linked to a random identifier given to your browser (the __Host-iid cookie), so accounts opened from the same browser can be linked to each other.
  • Country: the country code Cloudflare derives from your connection. It is written to session, usage measurement, media, generation and support records; some content may be available or unavailable by country.
  • Technical records: system logs and performance metrics. Logs may contain connection details.
  • Ad measurement data: only if you allow it; see the separate section below.

We do not keep your IP address in clear form in our database; the only exception is the agreement evidence. Your IP address is also passed to Cloudflare for bot protection and, if you allowed it, to Meta.

We do not process your photos for face recognition or to identify you.

How we collect data

Your data is collected electronically: from what you type into forms and upload; automatically through cookies, browser storage and system records while you use the site; from Google if you sign in with Google; from the store when you purchase; and the country from Cloudflare.

Why we process it and the legal grounds

  • To open your account, sign you in and provide the service (generation, coins, subscriptions, showing your results, preparing a copy of your data): forming and performing the contract. KVKK art. 5/2-c; GDPR art. 6/1-b.
  • To send your inputs to AI providers for generation: performing the contract (KVKK art. 5/2-c; GDPR art. 6/1-b). You are also asked to accept the AI Processing Agreement explicitly for this.
  • To apply the age limit (year of birth, the 18-year limit and age statement, age confirmation): our legal obligations aimed at protecting children and our legitimate interest. KVKK art. 5/2-ç and 5/2-f; GDPR art. 6/1-c and 6/1-f.
  • Security and preventing abuse (bot protection, account security, multiplying free allowances with several accounts, prohibited content, fraud): our legitimate interest. KVKK art. 5/2-f; GDPR art. 6/1-f.
  • Keeping agreement evidence (to be able to prove what you accepted and when): establishing, exercising or defending a right. KVKK art. 5/2-e; GDPR art. 6/1-f.
  • Purchase and financial records: a legal obligation under tax and accounting law. KVKK art. 5/2-ç; GDPR art. 6/1-c.
  • Answering support and requests: performing the contract, our duty to answer requests and our legitimate interest. KVKK art. 5/2-c, 5/2-ç and 5/2-f; GDPR art. 6/1-b, 6/1-c and 6/1-f.
  • Our own usage measurement (seeing which pages are used so we can improve the site): our legitimate interest. KVKK art. 5/2-f; GDPR art. 6/1-f. You can turn it off at any time.
  • Ad measurement (Meta): only your explicit consent. KVKK art. 5/1 and, for the transfer abroad, art. 9; GDPR art. 6/1-a. Saying no affects nothing, and you can withdraw your permission at any time.
  • Meeting lawful requests from competent authorities: a legal obligation. KVKK art. 5/2-ç; GDPR art. 6/1-c.

Without the data needed for the account and for generation we cannot provide the service. Allowing ad measurement, on the other hand, is entirely optional.

Who we share it with

We share your data only with the service providers we work with to provide the service, and only as far as that task requires:

  • netcup GmbH (Germany): our servers. The database and the service itself run in the data centre in Nuremberg, Germany.
  • Cloudflare, Inc. (USA): the network your traffic passes through and content delivery; the country code; bot protection (Turnstile, which works with your IP address and browser details on the sign-in, sign-up, password reset and request forms); storage of media files and encrypted backups (R2).
  • Brevo (Sendinblue SAS, France): sending email (verification codes and account notices). Brevo states that it hosts data in the EU.
  • AI providers: fal (Features & Labels Inc., USA), Atlas Cloud (Atlas Cloud AI LLC, USA) and Siray (RUNEX AI PTE. LTD., Singapore). Your prompt, the photo or video you upload and the settings you choose go there, only to make the generation you asked for. Details are in the AI Processing Agreement.
  • Google (in the EU Google Ireland Limited, Ireland; elsewhere Google LLC, USA): only if you sign in with Google, to verify the sign-in. Once sign-in with Apple is available, if you use it, Apple (outside Türkiye) verifies the sign-in.
  • App Store (Apple) and Google Play (Google), both outside Türkiye: when you buy in a store, they take the payment; we receive only the transaction details.
  • Meta (in the EU Meta Platforms Ireland Limited, Ireland; also Meta Platforms, Inc., USA): only if you allow ad measurement; see the separate section below.
  • Telegram (outside Türkiye): for our own internal sales alerts, the member ID, country, product, price, store and transaction ID. Your email address is not sent.
  • Competent public authorities and courts: only when the law requires it.

We do not sell or rent your personal data.

Transfers abroad

Our servers are in Germany; some of our service providers are in the USA, Singapore and other countries. This means your data is transferred outside Türkiye and outside the European Economic Area. These transfers are needed for the tasks described above, and each one is limited to the data that task requires.

How long we keep it

  • Photos and videos you upload: deleted when the generation ends (within 2 hours at the latest); files not used in a generation are deleted within 15 minutes.
  • Generated images and videos: removed within 30 days.
  • Prompts: stored encrypted and deleted with the outputs after 30 days.
  • Copies at AI providers: we ask fal to delete the files it produces after 24 hours; copies at Atlas Cloud and Siray are subject to their own terms.
  • Support conversations: deleted 2 years after the conversation is closed, or immediately if you delete your account.
  • Request form records: kept to answer your request and to be able to show that we answered it.
  • Usage measurement: 90 days.
  • Security records: risk events 90 days, closed review cases 2 years.
  • Technical logs: 14 days; performance metrics 15 days.
  • Backups: backups on the server are deleted after 14 days, encrypted off-site backups after 30 days.
  • Sessions: the access token is valid for 15 minutes and the refresh token for 30 days; your session on the site ends after 30 days without use, and in any case after 90 days at most.
  • A copy of your data: can be downloaded for 7 days after it is prepared.
  • Account details: for as long as your account is open.

If you delete your account, deletion happens after 7 days. Your identity details, uploads, generations and prompts are deleted; your membership and usage measurement records are pseudonymised. The following remain:

  • Financial records (purchases and coin movements): for the period required by tax and accounting law.
  • Generation records: without the files and prompts, in pseudonymised form.
  • Age confirmation records: in pseudonymised form, to be able to show that a piece of content was generated for a membership that had confirmed its age.
  • Agreement evidence: for 10 years from the date of acceptance, including your IP address, browser details, year of birth and the hash of your email address. It is needed as proof in a dispute about what you accepted.
  • Security records and backups are deleted on their own when the periods above run out.

Cookies and browser storage

The necessary ones are required for the site to work and need no permission. You can turn usage measurement off; advertising cookies are used only if you allow them. You can change your choices at the bottom of this page or with "Manage preferences" in the cookie banner.

  • __Host-sid (necessary): keeps you signed in; scripts in the browser cannot read it. Expires after 30 days without use.
  • __Host-signed-in (necessary): a marker that lets pages know you are signed in; 7 days.
  • __Host-iid (necessary): a random identifier given to this browser for account security and abuse prevention; scripts in the browser cannot read it. Written when you sign in, register or reset your password; 1 year.
  • moonpix_oauth_google, moonpix_oauth_apple (necessary): completing sign-in with Google or Apple securely; 4 minutes.
  • moonpix_consent (necessary): remembers your cookie and measurement choice; 180 days.
  • NEXT_LOCALE (necessary): remembers your language choice; 1 year.
  • moonpix.analytics.sid (tab storage, usage measurement): the session's random number; deleted when you close the tab.
  • moonpix.analytics.consent (browser storage, usage measurement): a copy of your measurement choice; until you delete it.
  • moonpix.favorites, moonpix.jobs.blur (browser storage): your favourites and your choice to show results blurred. They stay only in your browser and are not sent to us; until you delete them.
  • moonpix.adVisit, moonpix.fbclid (tab storage): that you came from a Meta ad and the ID of that ad click. Deleted if you refuse ad measurement or close the tab.
  • _fbc (advertising, only with permission): the ID of a Meta ad click, if you clicked one; 90 days.
  • _fbp (advertising, only with permission): the ID Meta Pixel gives this browser; its lifetime is set by Meta.

Ad measurement (Meta)

We use Meta Pixel and the Meta Conversions API to measure whether our ads work and to let Meta show you more relevant ads. This measurement:

  • is offered only if you came to the site from a Meta ad (Facebook or Instagram); if you did not, Meta is not loaded at all;
  • is switched on only if you choose Allow; "Allow", "Reject" and "Manage preferences" are equal options;
  • stays off, and you are not asked, if your browser sends a "do not track" signal (Global Privacy Control);
  • never runs for accounts whose age by year of birth (this year minus the year of birth) is under 18, even if permission was given; for an account whose age comes out as 18, it runs only if you confirmed on the agreements step that you are 18 or older, because we do not know your birthday and such a person may still be 17.

What goes to Meta: the pages you view and their kind (such as pricing, models, studio); that you signed up; SHA-256 hashes of your email address and member ID; your IP address; your browser details; the IDs in the _fbc and _fbp cookies. Your creations, prompts and photos are never sent.

Meta processes this data under its own privacy policy, including for its own purposes. You can withdraw your permission at any time in the preferences at the bottom of this page; withdrawing does not make earlier processing unlawful. Saying no does not affect the site, signing up or purchasing in any way.

If you live in the USA or California

We do not sell your personal information. Under California law (CCPA/CPRA), Meta ad measurement may count as "sharing" information for personalised advertising. We do it only with your permission, and we treat your browser's Global Privacy Control signal as a request to opt out of this sharing. To opt out, turn ad measurement off in the preferences at the bottom of this page or turn on GPC in your browser. You also have the right to know, correct and delete your information; you can use the request form. We do not treat you differently for using your rights.

Your rights

Under KVKK art. 11 you have the right to learn whether your personal data is processed; to request information if it is; to learn the purpose of processing and whether it is used for that purpose; to know the third parties in Türkiye or abroad to whom it is transferred; to have it corrected if it is incomplete or wrong; to have it deleted or destroyed under the conditions of KVKK art. 7; to have these steps notified to the third parties it was transferred to; to object to an outcome against you that results solely from analysis by automated systems; and to claim compensation if you suffer damage from unlawful processing.

If you live in the EU, under GDPR art. 15 to 22 you also have the rights of access, rectification, erasure, restriction of processing, data portability and objection, and the right not to be subject to decisions based solely on automated processing. Where processing is based on consent (ad measurement), you can withdraw your consent at any time.

To use these rights:

  • On the Account page you can download a copy of your data and delete your account.
  • For other requests, write from the support screen if you are signed in, or use the request form if you cannot sign in. We may need to verify your identity. We answer your request free of charge within 30 days at the latest.

If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu). If you live in the EU, you also have the right to complain to the data protection authority of the country where you live or work.

Automated decisions: if your year of birth shows you are under 18, you cannot continue to the service and you are signed out; if it shows you are under 13, the deletion of the account also starts automatically. Age confirmation and ad measurement are also kept off based on your year of birth. If you think there is a mistake, write through the request form; a person will review it.

Children

The service is not for anyone under 18, and we do not knowingly process the personal data of people under 18 for this service. Your year of birth is asked on the agreements step and you are asked to confirm that you are 18 or older. If the year of birth shows someone is under 18, they cannot continue: no acceptance record is created and we sign them out; if it shows they are under 13, we also start the deletion of the account. If you believe someone under 18 is using the service, report it through the request form; we will close that account's access to the service.

Security

  • Passwords are stored irreversibly with argon2id.
  • Email codes are valid for 10 minutes and only their hashes are stored.
  • If you like, you can add a second verification step to sign-in.
  • Prompts are stored encrypted.
  • Security records hold a keyed hash (HMAC) instead of the IP address.
  • The session cookie cannot be read by scripts in the browser (httpOnly) and is sent only over secure connections; the site works only over encrypted connections (HTTPS).
  • Media files are kept in storage that is not publicly accessible.
  • Off-site backups are encrypted before they leave the server.
  • The sign-in, sign-up and request forms are protected against automated attacks with bot protection.

No system is flawless. If a data breach happens, we notify the Personal Data Protection Board and the people affected as the law requires.

Changes

This text is versioned. We announce a material change on the site before it takes effect, and the new text is shown to you again on the agreements screen. We keep earlier versions.

Translations

This text is a translation of the Turkish original. If the two differ, the Turkish text prevails.