Privacy Policy

This Privacy Policy explains how personal data of users of services provided through ablacim.com (the "Service") is collected, used, stored, shared, and protected.

1. DATA CONTROLLER AND CONTACT

UK GDPR and EU GDPR apply to users in the UK and EU. Türkiye's KVKK (Law No. 6698) applies to users in Turkey via our Turkey Representative. The data controller is registered, where required, with the relevant supervisory authorities (UK ICO, KVKK Authority).

2. PERSONAL DATA WE PROCESS

We process the following categories of personal data. This data is collected from the information you enter and the files you upload in the app and on the website:

• Identity & Contact: Name, surname, email address.
• Customer Transactions: Order, payment, invoicing records, support and complaint records.
• Transaction Security: IP address, browser/device information, session logs.
• Special Category Data (Biometric): Photos you upload for palm and face analysis.
• Chat Content: Messages you send to the AI assistant and the responses you receive.
• Behavioural & Analytics: On-site clicks, page views, conversion events (anonymous/pseudonymous).
• Payment: We do not store your card details; payments are processed via Stripe with 3D Secure.
• Dream and Reading Content: Dream texts and questions you write so they can be interpreted, and the interpretations we generate.
• Test and Comparison Data: Your answers to the personality and relationship style tests, the results calculated from them, and twin comparisons created with mutual consent.

3. SPECIAL CATEGORY (BIOMETRIC) DATA — EXPLICIT CONSENT

Photos you upload of your palm and face are special category personal data (biometric) under UK/EU GDPR Article 9(1) and KVKK Article 6.

We process this data with your explicit consent (GDPR Art. 9(2)(a), KVKK Art. 6/2), for a single purpose — generating the personalised analysis report you requested. Consent is obtained at payment or signup as: "I explicitly consent to my photo being processed for analysis."

Specific safeguards we apply:

• Your photos are permanently deleted within 30 days after the report is generated.
• We do not use your photos to train AI models. How the providers that perform the analysis handle data is governed by their own terms (see Section 6).
• Your photos are sent only to the AI providers named in Section 6 to perform the analysis; they are not shared with other third parties.

Right to withdraw consent: You may withdraw your explicit consent at any time by emailing info@ablacim.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

4. PURPOSES OF PROCESSING AND LEGAL BASES

Your personal data is processed for the following purposes on the indicated legal bases:

• Generating the analysis report (general data): Performance of contract — GDPR Art. 6(1)(b), KVKK Art. 5/2-c.
• Generating the analysis report (biometric photos): Explicit consent — GDPR Art. 9(2)(a), KVKK Art. 6/2.
• Billing and accounting: Legal obligation — GDPR Art. 6(1)(c), KVKK Art. 5/2-a.
• Customer support and communication: Legitimate interest — GDPR Art. 6(1)(f).
• Information security and fraud prevention: Legitimate interest — GDPR Art. 6(1)(f).
• Marketing and analytics: Consent (collected via cookie banner) — GDPR Art. 6(1)(a).
• Commercial electronic communications: Consent — GDPR Art. 6(1)(a). For Türkiye recipients, additionally PECR/ETK Law No. 6563 and IYS approval.
• Compliance with legal obligations: Legal obligation — GDPR Art. 6(1)(c).

5. AUTOMATED DECISION-MAKING AND PROFILING (GDPR Art. 22)

Our service uses AI-based automated processing:

• Photos you upload are processed automatically by AI models.
• Your dream texts, test answers, twin comparisons, chat messages and uploaded photos are sent automatically to the AI services of Anthropic, PBC and OpenAI, L.L.C. through OpenRouter, Inc. to create your personal interpretation. The content of these requests is also processed by LangSmith (LangChain, Inc.), which we use to monitor the service.
• The analysis result is delivered to you automatically.
• We do not use your data to train AI models and we do not sell it for advertising or marketing.

Important: This automated processing is for entertainment and personal-insight purposes and produces no legal, financial, or medical effects. You have the right to request human review, to object, and to express your view regarding the automated outcome (GDPR Art. 22(3)). You may exercise these rights via info@ablacim.com. This data is not sent until you explicitly accept the AI consent screen in the app.

6. SUB-PROCESSORS

We use the following third-party providers to process your data. Each provider processes data under its own terms and data processing agreements, linked below:

• Supabase — Database, authentication, file storage. EU (Frankfurt). EU/UK adequacy.
• Vercel — Frontend hosting, edge functions. Global CDN, US HQ. EU SCCs + UK Addendum.
• Railway — Backend application hosting. US/EU. EU SCCs.
• Stripe — Payment processing, invoicing. UK / US / Ireland. UK adequacy + EU SCCs.
• OpenRouter, Inc. — AI request router; forwards model requests to the providers below. US. Privacy · Terms
• Anthropic, PBC — AI model that generates interpretations (Claude). US. Privacy · Commercial terms
• OpenAI, L.L.C. — Text search (embeddings) and photo content moderation. US. Privacy · Business terms · Data processing addendum
• LangSmith (LangChain, Inc.) — Monitoring and debugging of AI requests; processes request content. US. Privacy · Terms
• Sentry — Error monitoring. EU (Frankfurt).
• PostHog — Product analytics. EU.
• Meta (Facebook) — Ad conversion measurement (Pixel + CAPI). US/Ireland. EU SCCs.
• Email provider — Magic link and transactional emails. EU.

For an up-to-date and complete list, contact info@ablacim.com.

7. INTERNATIONAL DATA TRANSFERS

Some sub-processors may transfer data outside the UK/EU/Türkiye. These transfers rely on:

• UK GDPR / EU GDPR Chapter V — Standard Contractual Clauses (SCCs) and UK adequacy mechanisms.
• KVKK Art. 9 — explicit consent or adequate-protection determinations for transfers from Türkiye.

8. RETENTION PERIODS

Your personal data is retained for as long as necessary for the purposes for which it was collected:

• Uploaded biometric photos: Permanently deleted within 30 days.
• Chat messages and analysis outputs: While your account is active + 30 days.
• Order and invoicing records: 10 years (Türkiye Commercial Code / Tax Procedure Law).
• Payment transaction records: 10 years (Türkiye Law No. 6493, equivalent UK record-keeping).
• IP and security logs: 180 days.
• Marketing preference records: Until withdrawn + 3 years for evidentiary purposes.
• Cookies and analytics: Periods specified in our Cookie Policy.

At the end of these periods, data is deleted, destroyed, or anonymised.

9. YOUR RIGHTS

Under UK/EU GDPR Articles 15–22 (and KVKK Art. 11 for users in Türkiye), you have the right to:

• Access your data and request a copy
• Have inaccurate or incomplete data rectified
• Have your data erased (right to be forgotten)
• Restrict processing
• Data portability
• Object to automated processing and request human review
• Withdraw your explicit consent (with future effect)
• Lodge a complaint with a supervisory authority (UK: ICO • EU: your local DPA • TR: KVKK Authority)

Submit requests to info@ablacim.com — we respond free of charge within 30 days.

10. MARKETING COMMUNICATIONS (UK PECR / TR ETK Law No. 6563)

We send marketing emails with your prior consent under UK PECR (and Türkiye ETK 6563 / IYS for Türkiye recipients). You may withdraw consent at any time by emailing info@ablacim.com or using the "unsubscribe" link in any message.

11. CHILDREN

The Service is not directed at persons under 18; we do not knowingly process personal data of anyone under 18. If we have inadvertently collected such data, contact us for immediate deletion.

12. SECURITY MEASURES

We apply the following technical and organisational measures to prevent unauthorised access, loss, or misuse:

• End-to-end encryption with TLS 1.3
• Database-level encryption-at-rest
• Role-based access control with least-privilege
• Regular security audits and dependency scanning
• AI requests are routed only to the providers named in Section 6 (fallback to other infrastructure is disabled)
• Breach notification within 72 hours to the relevant authority (GDPR Art. 33 / KVKK Art. 12)

13. COOKIES

See our Cookie Policy for details on cookies used across the site and the consent mechanism.

14. CHANGES TO THIS POLICY

We may update this Policy from time to time. For material changes, we will notify you by email or in-app banner. The current version is always available on this page.

15. CONTACT

For any questions about your personal data and privacy, please contact us:

Last updated: September 17, 2026