Car Studio AI — Privacy Policy

Version 2.0 · Effective date: 30 September 2026 · Last updated: 30 September 2026
Applies to: carstudio.ai, app.carstudio.ai, the Car Studio AI iOS and Android apps, and the business (dealer) panel.

Summary

• Controller: Alıcıbul Bilgi Teknolojileri Pazarlama ve Ticaret A.Ş. (Istanbul, Türkiye), operating as Car Studio AI.
• What we collect: your account details; the vehicle photos and videos you upload and the results we generate; payment and subscription records (never full card numbers); how you use the apps; device and diagnostic data; and, with your permission, advertising-measurement identifiers.
• Why: to run the Services and generate your results, to bill you, to keep the platform secure, to understand and improve the product, and — with your consent — to measure our marketing.
• AI: your images are processed by machine-learning models that we run on our own servers (the free tools on carstudio.ai use a named third-party provider). We do not use them to train models.
• Who else sees data: the providers listed in Section 6, each named with its role, the data involved and where it processes it. We do not sell your personal data.
• Your choices: on carstudio.ai, visitors in the EEA, UK and Switzerland decide on analytics, session replay and advertising measurement in the cookie banner before anything optional runs; elsewhere these run on notice and you can object at any time (Section 7); on iOS, you decide on advertising tracking in Apple's tracking prompt. Section 7 explains what currently runs in the web application and the mobile apps.
• Your rights: access, correction, deletion, portability, objection, withdrawal of consent — see Section 12 and the annex for your region.

1. Who is responsible

Alıcıbul Bilgi Teknolojileri Pazarlama ve Ticaret A.Ş. ("Car Studio AI", "we")
Muallimköy Mah. Deniz Cad. Bilişim Vadisi T.G.B. I.Etap Sitesi 1.1.C1 Blok No: 143/8 İç Kapı No: Z01 Gebze / Kocaeli, Türkiye
MERSİS 0052228975900001 · KEP alicibulbilgiteknolojileri@hs03.kep.tr
Privacy contact: kvkk@carstudio.ai (all regions) · Legal: legal@carstudio.ai

Where a business customer uploads its own customers' or employees' personal data through the dealer panel, that business is the controller and we act as its processor (Section 14).

2. What this policy covers

This policy applies to personal data we process when you visit carstudio.ai (including its free tools and blog), use the web application app.carstudio.ai, use the Car Studio AI mobile apps, use the business/dealer panel, contact us, or receive our communications. It does not cover third-party websites we link to or platforms to which you publish your results.

3. The data we collect

We do not knowingly collect special-category (sensitive) data. Please do not upload images containing such data.

4. Why we use your data and on what legal basis

Where we rely on consent, you can withdraw it at any time (Section 12) without affecting your ability to use the Services.

5. How AI processing works

5.1. What happens to your image. When you request an edit, your photo or video is transmitted over an encrypted connection to our servers, where it is analysed and processed by machine-learning models that we run ourselves. The result is returned to your account. The free tools on carstudio.ai work differently (see 5.3).

5.2. Where the core Services run. Our application servers and the machine-learning models that generate outputs run on our own servers on Google Cloud Platform (Google Cloud EMEA Limited, Ireland) in Frankfurt, Germany. Our database runs on Amazon Web Services (Amazon Web Services EMEA SARL) in Ireland (eu-west-1). Both act as our processors under their data processing addenda and do not access your content for their own purposes.

5.3. Free tools on carstudio.ai (number-plate blur and related tools). To use a free tool we ask for your name, e-mail address, phone number and how you heard about us, and we record your IP address. We use these to enforce the daily usage limit (currently two uses per day per person across all free tools, matched by e-mail, phone or IP). Your photo is sent to OpenRouter, Inc. (United States), which routes the request to the model provider hosting the FLUX.2 [klein] model by Black Forest Labs. The tool keeps your selected and processed images in your own browser's local storage so you can download them; they are not stored on our servers after processing. Usage records (name, e-mail, phone, IP, tool, date) are kept for 12 months.

5.4. No training. We do not use your photos, videos or outputs to train or fine-tune machine-learning models, and Google Cloud, as our infrastructure provider, commits in its Service Specific Terms not to use customer data to train or fine-tune its AI/ML models without the customer's permission.

5.5. People and plates. Our models edit vehicles, backgrounds and plates. We do not attempt to identify people who appear in your images and we do not run facial recognition. Number plates are personal data in many countries; you decide whether an output shows a real plate.

5.6. Location metadata. We do not use GPS coordinates embedded in uploaded photos (EXIF). If you do not want to share them, turn off location tagging in your camera settings before taking photos.

5.7. Provenance markers. Outputs may carry metadata or invisible markers indicating that they were produced with AI. These markers do not contain your personal data.

5.8. No automated decisions with legal effect. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

6. Third-party services we use

We use a limited number of providers. The table below is organised by where you meet them. Processor means the provider acts only on our instructions under a data processing agreement; Independent controller means the provider decides itself how it uses the data it collects. Providers marked consent run only after you allow them (see Section 7 for the current state on each platform).

6.1 Everywhere (infrastructure, payments, communications)

6.2 Websites (carstudio.ai and app.carstudio.ai) — measurement and advertising

On carstudio.ai the tools below run only after you allow them (consent), except Microsoft Clarity, which runs without cookies until you allow analytics. On app.carstudio.ai they currently load when a page opens (see Section 7).

6.3 Mobile apps (iOS and Android)

iOS App Tracking Transparency. On iOS we show Apple's tracking prompt. If you choose "Ask App Not to Track", the advertising identifier is not read and Adjust, Meta and TikTok measure only with non-identifying data. You can change this at any time in Settings › Privacy & Security › Tracking. We do not show ads inside the app; tracking is used only to measure which campaign brought you to us and to reconcile purchases.

Android. The app declares the AD_ID permission for the same attribution purpose. You can reset or delete your advertising ID in Settings › Google › Ads.

6.4 Other recipients

• Professional advisers (lawyers, accountants, auditors) under confidentiality.
• Authorities and courts where required by law or to protect rights, safety or property.
• A buyer or successor in a merger, acquisition or asset sale, with notice to you and subject to this policy.
• Your organisation — if you use a business account, your Account Owner and authorised Team Members can see your name, e-mail, role, projects and activity in that workspace.

We do not sell personal data and we do not share it with data brokers.

7. Your choices — consent by platform

carstudio.ai (website). In the EEA, UK and Switzerland (and wherever we cannot determine your country) you see a banner with two equally weighted buttons, "Accept all" and "Necessary only", each one click; nothing optional loads before you choose, except Microsoft Clarity, which runs without cookies until you allow analytics (Section 6.2). Elsewhere, including Türkiye, you see a notice and optional tags run; to object, e-mail kvkk@carstudio.ai or block cookies in your browser settings. Two categories are covered: Analytics (Google Analytics, Microsoft Clarity, PromptWatch) and Marketing (Meta Pixel, ad-click attribution, Google ad signals); the banner accepts or refuses both together. Your choice is stored for 180 days in the cs_consent cookie and recorded, with a time stamp and the banner version, so we can prove it. In the EEA, UK and Switzerland you can change it any time via "Cookie settings" in the footer, which reopens the banner.

app.carstudio.ai (web application). On app.carstudio.ai, analytics (PostHog, Google Analytics), session replay (PostHog, Microsoft Clarity), chat (HubSpot) and advertising measurement (Meta Pixel) currently run from page load; the cookie notice records your acknowledgement. You can block them with browser tracking protection or with the provider opt-outs listed in the Cookie & SDK Policy. We are working to bring app.carstudio.ai under the same consent banner as carstudio.ai.

Mobile apps. The apps do not currently have a separate in-app privacy screen. Product analytics (PostHog), diagnostics (Crashlytics, Sentry) and, on Android, session replay (Microsoft Clarity) start when the app opens. Firebase Analytics starts on launch on Android and, on iOS, once the tracking prompt has been answered. Advertising measurement (Adjust, Meta, TikTok) starts after the iOS tracking prompt has been answered; the advertising identifier is read only if you allow tracking. On Android you can reset or delete your advertising ID in device settings. Push notifications require the system permission, which you can withdraw in device settings.

Marketing e-mail. Every marketing e-mail contains an unsubscribe link; service e-mails (codes, receipts, security) cannot be unsubscribed while you have an account.

8. Cookies and similar technologies

Details of every cookie, local-storage key and mobile SDK, with names, purposes and lifetimes, are in our Cookie & SDK Policy.

9. International transfers

We are based in Türkiye. Your content and account data are processed and stored in the European Union (Germany and Ireland), except photos you submit to the free tools on carstudio.ai, which are processed in the United States (Section 5.3); some analytics, advertising, payment and support providers are in the United States or elsewhere. Where personal data leaves the country where it was collected we rely on:

• From Türkiye (KVKK Art. 9): your personal data is transferred to the providers abroad listed, with their countries, in Section 6.
• From the EEA, UK and Switzerland: the EU–US Data Privacy Framework (and its UK and Swiss extensions) where the recipient is certified, and otherwise the European Commission's Standard Contractual Clauses (and the UK Addendum / Swiss amendments), together with transfer risk assessments and supplementary measures. A copy of the clauses can be requested from kvkk@carstudio.ai.
• Other countries: the mechanisms permitted by local law.

Microsoft Clarity data is processed in the United States by Microsoft as an independent controller; for EEA users the contracting entity is Microsoft Ireland Operations Ltd., which transfers to Microsoft Corporation under Standard Contractual Clauses.

10. How long we keep data

When retention ends we delete or irreversibly anonymise the data.

11. Security

We use encryption in transit (TLS) and at rest, access controls based on least privilege, logging and monitoring, separate environments for development and production, and contractual security obligations for every processor. Payment card data is handled only by Stripe, Apple and Google, which are PCI-DSS compliant. No system is perfectly secure; if a breach affects your data we will notify you and the relevant authority as the law requires (in Türkiye, the Board within 72 hours).

12. Your rights

Wherever you live, you can ask us to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate or incomplete data;
• delete your data (and delete your account yourself in-app or at app.carstudio.ai);
• restrict or object to processing based on legitimate interests;
• port data you gave us to you or another provider in a machine-readable format;
• withdraw consent at any time (cookie settings, device tracking settings, unsubscribe links);
• not be subject to solely automated decisions with legal or similarly significant effects (we make none);
• complain to your data protection authority.

Send requests to kvkk@carstudio.ai or by post to the address in Section 1. We may ask you to verify your identity. We respond within 30 days (one month in the EEA/UK, extendable by two months for complex requests, with notice). Requests are free unless manifestly unfounded or excessive. Region-specific details are in Annexes A–C.

If you are a Team Member of a business account, some requests (for example deletion of workspace content) must go through your Account Owner, who is the controller for that data; we will help them respond.

13. Children

The Services are for adults (18+). We do not knowingly collect data from anyone under 18. If you believe a minor has provided data, contact kvkk@carstudio.ai and we will delete it.

14. Business accounts — who is the controller?

• Your own account data (your e-mail, login, billing) — we are the controller.
• Team Members' data (names, e-mails, roles, activity) and content your organisation uploads (its customers' vehicles, plates, possibly bystanders) — your organisation is the controller; we are its processor and act on its instructions, under our Data Processing Addendum (available at legal@carstudio.ai). Your organisation is responsible for informing Team Members and for having a lawful basis for the images it uploads.
• Analytics and attribution data about how the panel is used — we are the controller, on the bases in Section 4.

15. Changes to this policy

We review this policy at least annually and whenever our providers or practices change. Material changes are announced by e-mail and/or in-app at least 30 days before they take effect, and the version number and dates at the top are updated. Earlier versions are available on request.

16. Contact

Alıcıbul Bilgi Teknolojileri Pazarlama ve Ticaret A.Ş. ("Car Studio AI")
Muallimköy Mah. Deniz Cad. Bilişim Vadisi T.G.B. I.Etap Sitesi 1.1.C1 Blok No: 143/8 İç Kapı No: Z01 Gebze / Kocaeli, Türkiye
kvkk@carstudio.ai · legal@carstudio.ai · support@carstudio.ai

Annex A — Users in Türkiye (KVKK)

This annex, together with the body of this policy, constitutes the information notice under Article 10 of Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.

Data controller: Alıcıbul Bilgi Teknolojileri Pazarlama ve Ticaret A.Ş., Muallimköy Mah. Deniz Cad. Bilişim Vadisi T.G.B. I.Etap Sitesi 1.1.C1 Blok No: 143/8 İç Kapı No: Z01 Gebze / Kocaeli. MERSİS 0052228975900001. KEP alicibulbilgiteknolojileri@hs03.kep.tr.

Method of collection: your personal data is collected fully or partly by automated means through our website, web application, mobile applications, e-mail and support channels, and through the software development kits and cookies described in Section 6 and the Cookie & SDK Policy.

Legal grounds: set out per purpose in Section 4 (Art. 5/2(c) performance of a contract; 5/2(ç) legal obligation; 5/2(e) establishment or protection of rights; 5/2(f) legitimate interests; 5/1 explicit consent for commercial electronic messages).

Explicit consent is collected separately from this notice, through an unticked, purpose-specific marketing opt-in. Refusing consent does not restrict any feature of the Services. This notice is not a consent form.

Transfers abroad: your personal data is transferred to the recipients abroad listed, with their countries and the purpose of each transfer, in Section 6; see also Section 9.

Your rights under KVKK Art. 11: to learn whether your data is processed; to request information; to learn the purpose and whether data is used accordingly; to know the third parties to whom data is transferred in Türkiye or abroad; to request correction; to request deletion or destruction under Art. 7; to request that corrections and deletions be notified to recipients; to object to a result against you produced by exclusively automated analysis; to claim compensation for damage caused by unlawful processing.

How to apply: in writing to the address above, via registered electronic mail (KEP) to alicibulbilgiteknolojileri@hs03.kep.tr, or by e-mail to kvkk@carstudio.ai from the e-mail address registered to your account, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. We conclude applications free of charge within 30 days; if the process incurs a cost, the fee in the Board's tariff may be charged. If your application is rejected or not answered, you may complain to the Personal Data Protection Board.

Commercial electronic messages: sent only with your prior approval under Law No. 6563 and the Regulation on Commercial Communications; you can opt out from any message or via İYS (iys.org.tr).

Annex B — Users in the EEA, United Kingdom and Switzerland

Controller: Alıcıbul Bilgi Teknolojileri Pazarlama ve Ticaret A.Ş.

Legal bases are listed in Section 4. Where we rely on legitimate interests, you may ask for our balancing assessment. On carstudio.ai, storage of, and access to, information on your device (cookies, SDK identifiers) for analytics, session replay and advertising happens only with your consent under Article 5(3) of the ePrivacy Directive and its national transpositions. Section 7 describes what currently runs in the web application and the mobile apps.

International transfers: Section 9. The EU–US Data Privacy Framework adequacy decision is currently in force; because its status is subject to litigation, we also maintain Standard Contractual Clauses with our US providers so that transfers continue lawfully if the framework changes.

Your rights: access, rectification, erasure, restriction, portability, objection (including to direct marketing at any time), withdrawal of consent, and the right not to be subject to solely automated decision-making. We respond within one month, extendable by two further months for complex requests (we will tell you within the first month). You may lodge a complaint with the supervisory authority of your habitual residence, place of work or the place of the alleged infringement; in the UK, the Information Commissioner's Office; in Switzerland, the FDPIC.

Microsoft Clarity: for EEA users the contracting entity is Microsoft Ireland Operations Ltd.; Microsoft acts as an independent controller for Clarity data and you may also exercise rights directly with Microsoft at privacy.microsoft.com.

Meta Business Tools: we and Meta Platforms Ireland Ltd. are joint controllers for the collection and transmission of Pixel/SDK event data; Meta is solely responsible for its subsequent processing. The joint-controller arrangement is at facebook.com/legal/controller_addendum; you can exercise rights against either party.

TikTok Business SDK: we and TikTok are joint controllers for the collection and transmission of app event data through the TikTok Business SDK; TikTok is solely responsible for its subsequent processing, under the TikTok Business Products (Data) Terms. You can exercise rights against either party.

Annex C — Users in the United States

This annex applies to residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and other states with comprehensive privacy laws, to the extent those laws apply to us.

Categories of personal information collected in the last 12 months: identifiers (name, e-mail, phone, account and device IDs, IP address); commercial information (purchases, subscriptions); internet or network activity (usage, interactions, session replay); geolocation (approximate, from IP); audio/visual information (the photos and videos you upload); inferences (usage-based segments for product analytics). Sources, purposes and recipients are in Sections 3, 4 and 6.

"Sale" and "sharing." We do not sell personal information for money. Our use of Meta Pixel, the Meta and TikTok SDKs, Adjust, Google Analytics and Microsoft Clarity may be considered "sharing" for cross-context behavioural advertising or a "sale" under some state laws. We do not knowingly sell or share the personal information of anyone under 16. Sensitive personal information: we do not use or disclose it for purposes other than those permitted by law.

Your rights: to know/access; to delete; to correct; to portability; to opt out of sale/sharing and of targeted advertising; to limit use of sensitive personal information; to non-discrimination for exercising rights; and (outside California) to appeal a denied request.

How to exercise them: e-mail kvkk@carstudio.ai with "US privacy request" in the subject, or block cookies in your browser (web) / use Settings › Privacy & Security › Tracking (iOS). We do not require identity verification for opt-out requests. We respond within 45 days (extendable by 45 days with notice). Appeals: reply to our decision e-mail within 30 days; we answer appeals within 45 days (60 in some states) and will tell you how to contact your state Attorney General if the appeal is denied.

Authorised agents may submit requests with written permission; we may verify directly with you.

Notice of financial incentive: none.

Do Not Track / GPC: we do not currently respond to "Do Not Track" headers or Global Privacy Control signals; please use the opt-out options above.