Privacy notice

The sole proprietor trading as Renovaitor operates Renovaitor as a sole proprietorship in Türkiye and is responsible for the personal data described here.

Privacy contact: [email protected].

This notice covers website visitors, trial users and account holders. Turkish Law No. 6698 (KVKK) applies to our processing; EU GDPR and UK data protection rules also apply where their territorial requirements are met.

• Account and service delivery: your name, email, sign-in details, uploaded images, prompts, plans, designs and settings are collected from you and your chosen sign-in provider to create your account and provide the features you request. The basis is performance of our contract (GDPR Article 6(1)(b); KVKK Article 5(2)(c)). Providing these details is necessary for the corresponding feature.
• Billing: order, subscription, payment status and transaction records are used to fulfil purchases and meet accounting obligations (GDPR Articles 6(1)(b) and (c); KVKK Articles 5(2)(c) and (ç)). Our payment provider handles payment-card details.
• Security and support: request logs, IP addresses, authentication events, errors and support correspondence help protect accounts, prevent fraud, diagnose failures and answer requests. We rely on the legitimate interest in operating a secure service, subject to your rights (GDPR Article 6(1)(f); KVKK Article 5(2)(f)), and legal obligations where applicable.
• Optional analytics: with your consent, we use visit and campaign data, browser identifiers and experiment interactions to measure site use and improve the service (GDPR Article 6(1)(a); KVKK Article 5(1)).
• Optional advertising: with your separate cookie choice, advertising partners may process browser identifiers and campaign interactions for advertising measurement and personalization, on the same consent basis.
• Email marketing: only after a separate opt-in, we use your email and account activity to send design ideas, product news, offers and relevant reminders. Account activity may help choose relevant messages; it does not make decisions with legal or similarly significant effects. The basis is consent. We keep the choice, date, source and wording as evidence and to honour opt-outs.

We receive data through forms, uploads, service requests, cookies when permitted, and service providers such as sign-in and payment providers. Do not upload sensitive personal information or other people’s personal data unless you have the right to do so. Sharing a design or presentation makes it accessible to people with the sharing access you choose.

Necessary storage supports sign-in, security, your saved consent and features you request. Optional analytics and advertising start off. Use the Cookie settings button or our cookie policy to accept, reject or change individual categories. We ask again after 180 days or a material change to the consent notice. Closing a dialog, browsing, signing in or purchasing does not grant consent.

Cookie acceptance does not subscribe you to emails. Use Profile → Email preferences to opt in or withdraw. Every marketing email has an unsubscribe link that works without signing in. We stop future promotional sends when you unsubscribe; a message already handed to the email provider may still arrive. Necessary sign-in, account, security and billing messages continue.

Withdrawing consent does not affect the lawfulness of processing before withdrawal. A withdrawn email permission remains a suppression instruction unless you explicitly subscribe again.

• Contabo hosts the application and database; Cloudflare stores and delivers images and exported files; Upstash supports rate limiting and caching.
• fal.ai processes images for generation and editing; OpenAI processes prompts, images and conversation context for AI features you request.
• Google provides optional sign-in. When enabled with your cookie consent, Google analytics/advertising and Meta advertising tags receive website interaction data.
• Lemon Squeezy handles purchases and billing; Resend delivers service messages and consented marketing emails.

Providers may process data outside Türkiye, the EEA or the UK, depending on the provider and service configuration. International processing requires an applicable transfer mechanism as well as a processing basis; a cookie or email opt-in does not itself establish a transfer safeguard. Contact us for information about recipients, processing locations and the safeguards applicable to your data.

Data is transmitted over HTTPS. Authorized service providers need access to the data used to provide their functions; this is not end-to-end encryption that hides data from every provider.

Account and project data is kept while needed to provide your account and saved work, subject to deletion requests and applicable legal exceptions. Billing and dispute records may need to be retained for statutory accounting obligations or legal claims. Retention depends on the record and the applicable obligation; you can request details for your records.

Cookie choices and their anonymous receipts expire after 180 days. The receipt records categories, notice version and time, without an account link, IP address or user agent. Email consent history and suppression preferences remain with your account to demonstrate and enforce your choice. They are not used to send marketing after withdrawal.

Deletion requests also require consideration of backups and provider copies. We explain any data that must be retained and the reason when handling your request.

Write to [email protected] to ask about your data, obtain a copy, correct it or request deletion. We may request proportionate information to verify your identity.

Where GDPR or UK GDPR applies, you may also request restriction and portability, object to legitimate-interest processing and direct marketing, and withdraw consent. We normally respond within one month; where a lawful extension is needed we explain it within that period. You can complain to your EEA supervisory authority or the UK Information Commissioner.

Under KVKK Article 11, you can learn whether your data is processed, request information, learn the purposes and recipients in Türkiye or abroad, request correction or erasure where the conditions are met, ask that recipients be notified, object to a result against you based solely on automated analysis, and seek compensation for unlawful processing. Applications to the controller are handled as soon as possible and within 30 days, subject to the statutory application procedure. You may complain to the Kişisel Verileri Koruma Kurumu under the applicable procedure.

We publish a dated notice when our practices change and provide additional notice where required. Continued use is not consent to a new purpose. Where a change needs consent, we request a new choice before the relevant processing.