Privacy notice

Who this notice is from

This notice explains how VitrinPost (the “service”) handles personal data. VitrinPost is a web service that turns a phone photo of a jewellery piece into showcase and model images and a weekly posting plan. The data controller is Mutlu Celep. You can reach us at support@fenoralabs.com.

It is written to meet the Turkish Personal Data Protection Law (KVKK, No. 6698) and, for customers in the EU, the GDPR. A Turkish version is published alongside it; if the two differ, the Turkish text applies to customers in Turkey.

What we collect

We collect only what the service needs:

• Account: your e-mail address, your password (stored only as a hash by our authentication provider), your shop name, country and language.
• Consent record: the time you accepted this notice and the terms, and the version you accepted.
• Photos and images: the product photos you upload, the details you confirm about each piece (type, metal, stones and similar), and the images generated for you, with the weekly plan and captions you build.
• Credit and payment records: your credit movements, which package you bought, the amount and currency, and the payment provider’s reference. We never receive or store your card number.
• Security records: a log of key events (sign-up, upload, start of a generation, payment events, administrator actions) with the time, internal ids and the IP address the request came from.
• Technical data: your IP address and device details are seen by our hosting and security providers when you use the site.

Why we use it

We use your data to create and secure your account, to produce and store your images, to take payment and keep an exact credit balance, to prevent abuse and fraud, to answer your requests, and to meet legal and accounting duties. Your photos and generated images are used only to provide the service to your shop. We do not use them to train AI models and we do not show them in marketing without your separate written permission.

Legal bases: performing the contract with you, our legitimate interest in security and fraud prevention, legal obligations, and your explicit consent where the law requires it (for example the transfer abroad described below).

Who processes your data

We use these providers. Each receives only what its task needs:

• Supabase: database, sign-in and private file storage for your account, photos and images.
• Vercel: hosting of the website and server code.
• fal.ai: image generation. Your uploaded product photo and a fixed description of the chosen scene are sent to produce each result.
• Anthropic: automatic checks. Your product photo, and later the generated result, are sent so the service can read the piece’s details and flag differences. No text you typed is sent.
• Creem: payments. Creem acts as merchant of record and takes your card payment. It receives your e-mail address, the package you chose and an internal payment reference.
• Resend: sending the service’s e-mails (for example the sign-in confirmation and password reset).
• Cloudflare Turnstile: a bot check on sign-up, sign-in, password and e-mail confirmation screens, and on the signed-in pages while your e-mail is unconfirmed.
• Upstash: short-lived counters that limit repeated requests. They are keyed by IP address, an e-mail hash or your account id and expire within a day.
• PostHog (United States), only when switched on: product analytics for the homepage test. It records page views and which page variant you saw, using an anonymous id kept in your browser storage, with no session recording and no cookies. Until it is switched on, nothing is sent to PostHog.
• We do not sell personal data. Providers act on our instructions and may share data only as they describe in their own terms.

Faces in model images

Model images show synthetic, computer-generated people. A customer’s photo is never used as a model. The service accepts product photos only; it has no feature for uploading a person’s photo to be used as a model. Please do not upload photos of people.

Cookies and browser storage

We use only what the service needs to work, so there is no cookie banner:

• A sign-in session cookie (sb-…) from our authentication provider.
• Two short-lived security cookies: one during password recovery (15 minutes) and one that remembers the e-mail address of a sign-up in progress so you can resend the confirmation (1 hour).
• Your browser temporarily keeps a photo you are uploading, so that an interrupted upload can resume; it is discarded after 24 hours. A tab-level value prevents a generation from being started twice.
• Cloudflare may set its own storage for the bot check. If analytics is on, an anonymous id is kept in local storage as described above.
• We use no advertising cookies.

How long we keep it

There is no automatic deletion of your photos or generated images. We say this plainly so you can decide for yourself:

• Account details and consent record: kept while your account exists.
• Uploaded product photos: kept in private storage while your account exists. A file uploaded but never attached to a product is removed automatically after about an hour.
• Generated images: kept while your account exists. If an image cannot be stored correctly, it is removed and the credit is returned.
• Download links to your photos and images expire after 10 to 15 minutes.
• Credit and payment records: kept without a fixed end date. They are append-only so that your balance is always exact, they hold no card data, and they refer to your shop only by internal id. We keep them for accounting, tax and dispute purposes.
• Security records: kept without a fixed end date, for fraud prevention and to show what happened if there is a dispute.
• Rate-limit counters: expire automatically within 60 seconds to 24 hours.
• Provider logs and copies (hosting, database, e-mail, payments, and the inputs and outputs handled by fal.ai and Anthropic): kept by those providers under their own schedules, which we do not control.

Asking us to delete your data

There is no delete button in the app yet. To have your data deleted, write to support@fenoralabs.com from the e-mail address of your account, saying what you want deleted. We confirm it is you, handle the request by hand, and answer within 30 days at the latest, as the law requires.

On a deletion request we remove your sign-in and e-mail, delete your uploaded photos and generated images from storage, remove your plan, and replace your shop name with a placeholder. Some records cannot be erased by design: credit and payment records, the security log (internal ids and IP addresses), anti-abuse records, and the product and generation records that describe your pieces (type, metal, stones). They are no longer tied to a sign-in, but they are not anonymous. We keep them only for the purposes above.

Your rights

Under KVKK Article 11 and the GDPR you may ask whether we process your data and be told how; ask what it was used for; ask who it was shared with, in Turkey or abroad; ask for correction of wrong or incomplete data; ask for deletion or anonymisation; ask that corrections and deletions be passed on to third parties; object to a result produced solely by automatic analysis that is against you; and claim compensation for damage from unlawful processing. EU customers may also ask for a copy of their data and may complain to their data protection authority. Turkish customers may complain to the Personal Data Protection Board (KVKK).

Write to support@fenoralabs.com. We answer free of charge within 30 days.

Transfer abroad

Our providers run servers or support teams in countries other than Turkey, including the United States and the EU. By accepting this notice at sign-up you give your explicit consent to your data being transferred abroad to those providers for the purposes above. You can withdraw this consent by asking us to delete your account; the service cannot be provided without these transfers.

Security

Photos are stored in private storage and shown only through short-lived links. Access to your data is limited by account. Payments and credit changes are verified and recorded in an append-only ledger. No system is perfectly secure; if a breach affects you we will tell you and the authority as the law requires.

Changes

If we change this notice in a way that matters, we publish the new text with a new version and date, and ask for your acceptance again where the law requires it. This is version v3-2026-11, dated 9 November 2026.