Privacy Policy
Last updated
July 2026
Prepared under the KVKK and GDPR principles.
This English translation is provided for convenience; the Turkish version prevails legally.
This Privacy Policy explains how Dahwo ("Dahwo", "we") processes the personal data of natural persons ("data subject", "you") who use the AI-powered jewellery-imaging services offered through dahwo.com.
Dahwo acts as the data controller under Law No. 6698 on the Protection of Personal Data (the "KVKK"). The controller’s identity and application details appear in the Contact and Data Controller section of this document.
Your payment-card details are never seen or stored by Dahwo. Payments are processed entirely by Shopier, a payment institution established in Türkiye; we keep only order and credit-grant records.
Only the following data is processed when you use the service:
Uploaded images are stored under unguessable public URLs; EXIF and location (GPS) metadata is stripped from images during re-encoding.
We use no advertising/tracking cookies, third-party analytics, or behavioural profiling. Only session and authentication cookies are used (see the Cookie Policy).
Your personal data is processed for the following purposes:
Each purpose rests on the legal bases set out in Article 5 of the KVKK (with the corresponding GDPR Article 6 basis shown for reference):
| Purpose | Legal basis |
|---|---|
| Providing the service and account management | KVKK Art. 5/2(c) — performance of a contract · GDPR Art. 6(1)(b) |
| Credit/order operations and transactional emails | KVKK Art. 5/2(c); for receipts/invoices Art. 5/2(ç) legal obligation · GDPR Art. 6(1)(b)–(c) |
| Retention of financial and commercial records | KVKK Art. 5/2(ç) — legal obligation · GDPR Art. 6(1)(c) |
| Security, rate limiting and fraud prevention | KVKK Art. 5/2(f) — legitimate interest · GDPR Art. 6(1)(f) |
| Customer support and request handling | KVKK Art. 5/2(c) and (f) · GDPR Art. 6(1)(b),(f) |
Core-service processing rests on the contract, legal-obligation and legitimate-interest bases above. Your explicit consent is sought separately, at sign-up, for one thing only: the transfer of your data to overseas service providers (see Section 06).
To generate AI outputs, your images are sent to overseas AI infrastructure providers for model inference. The vision-language models that check output quality also run through the same infrastructure.
Dahwo does not use your content to train its own models. Third-party AI providers process your content solely to provide the service, under their own terms; outputs produced on the provider side may be retained on the provider’s infrastructure for a short period. Outputs are re-uploaded to Dahwo’s own cloud storage, where they are retained for as long as your account remains active, within the retention periods in this policy for your plan.
An AI output is not profiling or an automated decision producing legal or similarly significant effects concerning you; the generation is the service you requested.
Your data is shared only with parties strictly necessary to deliver the service, under the conditions required by the KVKK.
Domestic transfer
Categories of overseas recipients
Türkiye has not yet issued an adequacy decision for any country. Cross-border transfer is technically indispensable to delivering the service and is carried out under KVKK Art. 9 on the basis of the explicit consent you give when creating your account. You may withdraw that consent at any time; withdrawal operates prospectively and may make the service impossible to provide. For data subjects in the EU/EEA, transfers outside the EEA rely on your explicit consent and on necessity for the performance of our contract with you (GDPR Art. 49(1)(a)–(b)).
Your personal data is under no circumstances sold, rented, or shared with third parties for advertising.
Your personal data is deleted, destroyed, or anonymised once the purpose of processing ceases or the relevant statutory retention period expires:
Appropriate technical and administrative measures protect your data:
Pursuant to Article 11 of the KVKK (and, for EU data subjects, Articles 15–22 of the GDPR), you have the following rights:
Being informed / access
Learn whether your data is processed and, if so, request information and a copy of it
Purpose and transfers
Learn the purpose of processing and the third parties to whom data is transferred
Rectification
Have incomplete or inaccurate data corrected
Erasure / restriction
Request deletion or destruction (and, under the GDPR, restriction and portability) where the conditions are met
Objection
Object to a result against you arising from automated analysis (and, under the GDPR, object to legitimate-interest processing)
Compensation and complaint
Seek compensation for damage from unlawful processing and lodge a complaint with the KVK Board (EU residents: their local supervisory authority)
To exercise your rights, apply to destek@dahwo.com with information verifying your identity. Applications are answered free of charge within 30 days at the latest (for the detailed procedure, see the KVKK Disclosure Notice).
Only strictly necessary cookies that maintain your session and authentication are used; no advertising, tracking, or analytics cookies are used. See the Cookie Policy for details.
The service is directed at businesses and users over 18; it is not directed at children, and we do not knowingly collect personal data from children. The synthetic models generated depict adults only.
You may direct any questions or requests about our privacy practices to destek@dahwo.com.
Related documents