Privacy Policy

1. Introduction

PeakCar ("we", "us", "our") provides AI-powered vehicle photo enhancement services. This Privacy Policy explains what data we collect, why we collect it, and how we protect it. We comply with the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law (KVKK / Law No. 6698).

2. Data We Collect

• Account data: email address, hashed password, account preferences.
• Payment data: processed by Stripe; we never store card numbers. We retain only billing metadata (plan, invoice IDs).
• Uploaded photos: vehicle images you upload for transformation, plus the AI-generated outputs.
• Usage data: job history, credit balance, transformation parameters.
• Technical data: IP address, browser type, session cookies (auth only).

3. How We Use Your Data

• To deliver the photo transformation service you requested.
• To process payments and manage your subscription.
• To maintain account history and credit balances.
• To detect abuse, fraud, and security threats.
• To comply with legal obligations.

We do not sell your data, use it for advertising, or train AI models on your photos.

4. License Plate Blur

When you draw a blur region over a license plate, the blur is permanently baked into the output image and the plate area is no longer recoverable from the result. The original (unblurred) photo remains in our storage as part of your job history unless you delete it.

5. Third-Party Processors

We share specific data with the following sub-processors strictly to operate the service:

• fal.ai — receives uploaded photos for AI segmentation and relighting (BiRefNet, ICLight V2).
• KIE.AI — receives prompts and reference images for custom background generation (GPT Image 2).
• Supabase (EU region) — stores account data, job records, and image files.
• Stripe — processes payments. Subject to Stripe's own privacy policy.
• Netlify — hosts the application and processes background jobs.

Each processor is bound by a Data Processing Agreement consistent with GDPR Art. 28.

6. Data Retention

• Uploaded photos and AI outputs are retained for 30 days by default, then automatically deleted.
• Account data is kept while your account is active.
• Billing records are retained for 10 years per Turkish tax law.
• You may request earlier deletion at any time (see section 8).

7. Cookies

We use only strictly necessary cookies for authentication (Supabase session). We do not use tracking, analytics, or advertising cookies.

8. Your Rights (GDPR Art. 15–22 & KVKK Art. 11)

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion ("right to be forgotten").
• Export your data in a portable format.
• Object to or restrict processing.
• Withdraw consent at any time.
• Lodge a complaint with a supervisory authority (KVKK or your local DPA).

To exercise any of these rights, email privacy@peakcar.co. We will respond within 30 days.

9. Security

We use TLS encryption in transit, at-rest encryption on Supabase Storage, Row-Level Security on all database tables, and signed URLs (7-day expiry) for image access. Access to production systems is restricted to authorized personnel only.

10. International Transfers

Some sub-processors (fal.ai, KIE.AI, Stripe) operate outside the EU/Turkey. Transfers are protected by Standard Contractual Clauses (SCCs) where required.

11. Children

The service is not directed to children under 18. We do not knowingly collect data from minors.

12. Changes to This Policy

We may update this policy. Material changes will be announced via email or in-app notice at least 30 days before they take effect.

13. Contact

Data Controller: PeakCar
Email: privacy@peakcar.co