Version 2026-10-08
Weardrop Privacy Notice
This notice explains how Weardrop A.Ş. ("Weardrop", "we") processes personal data when you use the Weardrop virtual try-on service on a store's website, visit weardrop.app, create an account, or contact us. It is our information notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where it applies to you, our privacy notice under Articles 13 and 14 of the EU and UK General Data Protection Regulation (GDPR).
This notice is for information. You do not need to "accept" it. Where we rely on your consent, we ask for it separately (see the Explicit Consent text, weardrop.app/en/consent).
1. Who is responsible (data controller)
Weardrop A.Ş., Aznavurlar Mahallesi, Tax No: 111000
Email: [email protected] · KEP: [email protected]
Weardrop is the data controller (veri sorumlusu) for the data described here. The store on whose website you use Weardrop is a separate business and a separate controller for its own website, your orders, and the limited usage information it receives from us (section 6). The store's own privacy policy applies to that.
2. Summary
- We use your photo only to create your try-on image and to provide the features you ask for.
- The store does not receive your photo or the generated image.
- We do not sell your data, use it for advertising, build profiles, identify you from your photo, use facial recognition, or train our own AI models with it.
- To create the image, your photo is sent to Google's AI services, which process it for us, possibly outside Türkiye (section 7).
- Photos and generated images are deleted automatically after the periods in section 8.
- You can withdraw your consent and use your rights at any time (section 10).
3. What data we process, and where it comes from
3.1 When you use the try-on (with or without an account)
| Category | Data | Source |
|---|---|---|
| Visual data | The photo you upload or select (it shows your face and/or body), the generated image | You; generated by the AI service |
| Transaction data | Product picture and product page address (without query string), store, date and time, result status, error messages, options chosen | The store's page, the Service |
| Security data | A scrambled (salted hash) form of your IP address, not the address itself; request counts used for limits | Your connection (via our network provider) |
| Consent data | That you accepted the Terms and gave consent, the version and the time | You |
3.2 If you create or use an account
| Category | Data | Source |
|---|---|---|
| Identity / contact | Name, email address | You |
| Account security | Password (stored only as a one-way hash), sign-in token, account role | You, the Service |
| If you sign in with Google | Name, email, profile picture address, Google account identifier | Google, with your permission |
| Visual data | Your saved photo (if you choose to save it), your try-on history (photos and generated images) | You, the Service |
| Consent data | Version and time you accepted the Terms and gave consent | You |
3.3 Stores and business contacts
If you contact us or ask for a demo: Name, email, company, store web address, phone number (optional), page language, message date, status of our follow-up, and a scrambled form of your IP address (used only to limit abuse of the form).
If we contact your store about Weardrop: the store's name and website, the business email address and other contact details published on the store's website (or given to us), the store's category, and the emails we sent and when. Every email contains a link to stop further emails; after that we keep only a note that you do not want to be contacted.
3.4 Store owner accounts
Name, email, password hash, the stores linked to the account, settings and actions in the dashboard.
3.5 Technical data
Server and network logs (time, requested address, status, technical identifiers; our web server and network provider may log IP addresses and browser type). We do not use analytics, advertising or tracking cookies.
What we do not do with photos. We do not create face templates, face geometry or other biometric identifiers from your photo, and we do not use it to identify or authenticate you. The image is passed to the AI service only to create a new image. If a law where you live nevertheless treats your photo as biometric data, the retention and destruction schedule in section 8 applies, and we never sell, lease, trade or otherwise profit from it.
4. Why we process it and on what legal basis
| Purpose | Data | Legal basis (KVKK) | Legal basis (GDPR) |
|---|---|---|---|
| Creating your try-on image from your photo; transferring it to our AI provider abroad | Visual, transaction | Your explicit consent (KVKK Art. 5/1; transfer abroad: Art. 9) | Consent, Art. 6(1)(a) (and Art. 9(2)(a) if treated as special category) |
| Automatically checking your photo, the product picture and the generated image for safety (to refuse photos of minors, nudity and sexual content) | Visual, transaction | Legitimate interest (Art. 5/2-f); legal obligations to protect minors | Legitimate interests, Art. 6(1)(f) |
| Saving your photo and showing your try-on history | Visual, transaction, identity | Explicit consent; performance of the contract (Art. 5/2-c) for the account itself | Consent; contract, Art. 6(1)(b) |
| Running your account, signing you in | Identity, contact, account security | Performance of the contract (Art. 5/2-c) | Contract, Art. 6(1)(b) |
| Usage limits, preventing abuse, fraud and attacks, keeping the Service secure | Security, transaction, logs | Legitimate interest (Art. 5/2-f); legal obligation for information security (Art. 12) | Legitimate interests, Art. 6(1)(f) |
| Recording your acceptance and consent; proving compliance | Consent data | Legal obligation (Art. 5/2-ç); establishment and defence of rights (Art. 5/2-e) | Legal obligation, Art. 6(1)(c); legitimate interests |
| Usage statistics for stores (how often products are tried) | Transaction data without photos | Legitimate interest (Art. 5/2-f) | Legitimate interests, Art. 6(1)(f) |
| Answering contact and demo requests, managing business relationships with stores | Contact form data, store owner data | Steps before or performance of a contract (Art. 5/2-c); legitimate interest (Art. 5/2-f) | Art. 6(1)(b), (f) |
| Contacting stores about Weardrop by email | Store's public business contact details, emails sent, unsubscribes | Legitimate interest (Art. 5/2-f); for commercial messages, Law No. 6563 on Electronic Commerce | Legitimate interests, Art. 6(1)(f) |
| Answering authorities, legal claims, data subject requests | Any relevant data | Legal obligation (Art. 5/2-ç); establishment, exercise or defence of rights (Art. 5/2-e) | Art. 6(1)(c), (f) |
Our legitimate interests are: keeping the Service secure and available, controlling AI costs, preventing misuse, and giving stores aggregated information about the use of the Service on their products.
You are not legally obliged to give us your photo. Without your consent the try-on cannot work, but you can still use the store's website normally.
No automated decisions. The AI creates an image; it does not make decisions about you that have legal or similarly significant effects.
5. How we collect it
Electronically, through the Widget on stores' websites, our website, the sign-in with Google feature, our contact form, email, and automatically through our servers and our network provider when you use the Service.
6. Who receives your data
We do not sell, rent or trade your personal data.
| Recipient | What | Why |
|---|---|---|
| Google: Gemini API and/or Google Cloud Vertex AI | Your photo and the product picture; the generated image is returned | To generate the try-on image (processor acting on our instructions) |
| Cloudflare, Inc. | All traffic to weardrop.app and library.weardrop.app passes through it, including uploads | Network security, protection against attacks, delivery (processor) |
| Our hosting provider | All data we store | Hosting our servers and database (processor) |
| Google (sign-in) | Only if you choose "Sign in with Google" | Authentication |
| The store | Not your photo and not the generated image. Only: which product page was used, date/time, success or failure, counts; if you are signed in, a masked email (e.g. j***@example.com); otherwise "visitor" | Usage statistics for the store's own products |
| Authorities, courts | Data they lawfully request | Legal obligations, defence of rights |
| A buyer or successor of our business | Data needed to continue the Service, under equivalent protection | Merger, acquisition (you will be informed) |
Inside Weardrop, access to photos is limited to the few authorised people who need it for support, security, abuse investigations or legal requests.
Our AI providers process data on our behalf, under their business terms and data processing commitments. They may keep inputs and outputs for a limited period to detect abuse, as described in their terms.
7. Transfers abroad
Our AI provider (Google), our network provider (Cloudflare) and possibly our hosting provider process data in countries outside Türkiye, including the United States and countries of the European Union. When we use Google Cloud Vertex AI, processing takes place in the europe-west4 region.
We transfer your photo to the AI service on the basis of your explicit consent to that transfer. We work with providers under contractual data protection commitments that require them to process the data only on our behalf and on our instructions, and we apply the appropriate safeguards provided for in Article 9 of KVKK. You can ask us for information about these safeguards.
8. How long we keep it
| Data | Kept for |
|---|---|
| Photo and generated image of a try-on made without an account | 7 days, then deleted automatically |
| Photo and generated image of a try-on made with an account (your history) | 90 days, or until you delete them or your account, whichever is first |
| Saved account photo | Until you remove it or delete your account; deleted after 12 months of account inactivity |
| Try-on records without photos (product page, time, status, scrambled IP) | 24 months, then deleted or anonymised |
| Account data | Until you delete your account; then deleted within 30 days, except what the law requires us to keep |
| Record of your acceptance and consent | For accounts, for the life of the account; for try-ons, together with the try-on record (24 months) |
| Contact form, business contacts and emails to stores | 24 months after the request or email, unless a contract follows; an unsubscribe is kept so we do not contact you again |
| Server and network logs | Only as long as needed for security and troubleshooting, then overwritten |
| Data needed for a legal claim or authority request | Until the matter is closed and limitation periods expire |
Deletion means deletion from our live systems. In any case we destroy photos no later than 3 years after your last use of the Service.
9. Security
We protect data with encrypted connections (HTTPS), access restricted to authorised personnel, passwords stored as one-way hashes, and IP addresses stored only in scrambled form. No system is completely secure. If a breach affects your data, we will notify the KVKK Authority and, where required, you, as the law requires.
10. Your rights
Under KVKK Article 11 you have the right to: learn whether your personal data is processed; request information about it; learn the purpose of processing and whether it is used accordingly; know the third parties in Türkiye or abroad to whom it is transferred; request correction if it is incomplete or inaccurate; request deletion or destruction under Article 7; request that corrections and deletions be notified to the third parties it was transferred to; object to a result to your detriment arising exclusively from automated analysis; and claim compensation for damage caused by unlawful processing.
Under the GDPR, where it applies, you also have the rights of access, rectification, erasure, restriction, portability, objection (in particular to processing based on legitimate interests), and to lodge a complaint with your supervisory authority.
Withdrawing consent. You can withdraw your consent at any time by deleting your photo or account or by writing to us. Withdrawal does not affect processing carried out before it.
How to apply. Send your request in Turkish or English, with your name and contact details and enough information to identify you and the data (for example the email of your account), by:
- email from the address registered with us, to [email protected];
- registered electronic mail (KEP) to [email protected];
- a signed letter to Aznavurlar Mahallesi;
or another method allowed by the Communiqué on the Procedures and Principles of Application to the Data Controller.
We answer free of charge within 30 days at the latest (KVKK); if the request requires additional cost, we may charge the fee set by the KVKK Authority. If we reject your request or you are not satisfied, you may complain to the Personal Data Protection Authority (KVKK) within the legal periods, or to your local data protection authority if the GDPR applies.
11. Browser storage and cookies
- Widget (on the store's website): stores in your browser's local storage a sign-in token (if you sign in, valid for 30 days), a random device identifier and a try-on counter. They are needed to keep you signed in and to apply usage limits.
- weardrop.app: session cookies needed for signing in, and your choices for language and light/dark theme.
These are strictly necessary for the Service you request. We use no analytics, advertising or tracking cookies. You can delete them in your browser settings at any time.
12. Children
The Service is only for people aged 18 or older. We do not knowingly process data of children. If you believe a child has used the Service, contact us and we will delete the data.
13. Changes
We will update this notice when our processing changes. The version and date are shown at the top. Important changes are announced on our website and, for account holders, by email.