Data Protection Notice
Effective: 15 August 2026
This notice sets out how AppFellas ("we"), as the controller, processes personal data through İyziWeb. It complements the Privacy Policy, which covers the same ground in plainer language.
1. Controller
AppFellas, a sole proprietorship registered in Türkiye. Contact: info@appfellas.dev.
2. Data we process
| Category | Examples |
|---|---|
| Identity and contact | Name (optional), email address |
| Account security | Hashed password, session records |
| Content | Your build requests, answers, colour choices, chat history, uploaded images and text extracted from documents |
| Usage | Credits spent, build duration, model usage |
| Technical and security | IP address, access logs, traffic records |
| Moderation | Summaries of requests refused as unlawful, with the reason |
3. Purposes and legal bases
- Providing the Service (opening your account, building, storing and publishing your site) — necessary to perform our contract with you
- Security and abuse prevention — our legitimate interest in keeping the Service safe
- Legal record-keeping (traffic data, and invoices once sales begin) — compliance with a legal obligation
- Support — performance of the contract and our legitimate interest in helping users
We do not process your data for advertising or profiling, and we do not sell it.
4. Recipients
Your data is shared only with the processors needed to run the Service: Anthropic (generation), Runware (images), Resend (transactional email), Cloudflare (network and security) and Google (only if you use Sign in with Google, and for web fonts). Each is listed with its purpose and location in the Privacy Policy.
We disclose data to authorities only where legally required, and only to the extent required.
5. International transfers
Our servers are located in Türkiye. The processors above operate in the United States, the United Kingdom and the European Union. If you are in the EEA or the UK, using İyziWeb involves transferring your data outside your jurisdiction. We rely on the contractual protections offered by these providers and pass on only the data each one needs to perform its function.
6. Retention
| Data | Retention |
|---|---|
| Account and content | While your account is open; deleted on closure |
| Uploads that don't become a build | Deleted within one hour |
| Traffic records for published sites | One to two years (legal obligation) |
| Refused-request summaries | Up to two years |
| Invoices (once sales begin) | As required by tax and commercial law |
7. Your rights
You may ask us to confirm whether we process your data, to give you a copy, to correct or delete it, to restrict or object to processing, and — where processing is automated and based on contract or consent — to provide it in a portable format. You may also lodge a complaint with your local supervisory authority.
To exercise a right, email info@appfellas.dev from your registered address. We respond within thirty days, free of charge.
8. Security
Passwords are hashed with PBKDF2-SHA256, connections are encrypted with HTTPS, database access is restricted to our own server, and session cookies are HttpOnly, Secure and SameSite-scoped.