Privacy Policy

1. Information We Collect

Account information: name, email address, and authentication identifiers when you sign in with Apple, Google, or email.

Content you provide: photos and images you upload, text prompts, brand details (business name, logo, colors, phone, website, social handles), and the images and videos you generate. Uploaded photos may contain people or faces if you choose to include them.

Support messages: if you contact us from inside the app or by email, we keep your messages and any attachments so we can help you and keep a record of the issue.

Safety and moderation records: prompts or content flagged by our automated filters or reported by other users, kept so we can enforce our Terms and keep the Service safe.

Purchase information: records of credit purchases and subscriptions in the app, and of what you buy on admov.io. Purchases in the app are processed by Apple, and purchases on admov.io by Stripe; we do not receive your full payment-card details.

Usage and device data: app interactions, feature usage, generation history, approximate diagnostics, device type, OS version, language, and similar technical data.

2. How We Use Information

• To provide, operate, and improve the Service and generate your requested Output.
• To manage your account, credits, and subscriptions.
• Personal offers (admov.io): a person on our team may give your account a personal discount, chosen from your purchase history and account. It is not an automated decision. It is shown only in your account and at checkout; we do not email it.
• Marketing emails (admov.io): if you agree to them, through the newsletter (confirmed by email) or the setting in your account, we send you news, new products and prompts, and occasional offers, at most about one a week. You can stop them at any time.
• To provide customer support and respond to reports.
• To enforce our Terms, prevent abuse, and moderate content for safety.
• To send transactional messages (e.g. verification codes, password resets) and, where permitted, service notifications.
• To comply with legal obligations.

We do not sell your personal information. We do not use Your Content to train our own AI models.

3. AI Providers & How Your Content Is Processed

This section applies to the app. To create your Output, the images, prompts, and brand details you submit are sent to third-party AI providers that run the models on their own infrastructure. Depending on the tool or model you choose, these currently include OpenAI, Replicate, AtlasCloud, and Google, along with the model providers they host (for example Seedream, Nano Banana, Flux, Grok Imagine, Qwen, Veo, and Kling).

These providers operate outside Türkiye, mainly in the United States, so using the generation features involves an international transfer of the content you submit. They process your content in order to return your Output, under their own terms and security commitments. We do not use Your Content to train our own AI models, and we do not sell your personal information.

We may add, change, or remove providers as the models we offer evolve. We update this page when the providers we rely on change materially.

4. How We Share Information

We share information with service providers strictly to operate the Service:

• Cloud/backend & storage — Supabase (database and authentication), Cloudflare (R2 file storage and the content delivery network at cdn.admov.io, which stores the photos you upload, the images and videos you generate and the files you buy, and serves the images on this website) and Vercel (hosting and serverless functions) run the app and this website.
• AI model and processing providers — see the section above for who they are and what they receive.
• Messaging. Contact-form alerts, newsletter sign-up notifications and admin alerts about sales, refunds, enrolments, account deletions and free access our team gives or removes reach our team through Telegram, which processes them for us on its servers outside Türkiye and the EEA. Contact-form submissions are stored in our database, and their Telegram alert shows only a shortened email address and a link to our admin tools. If storing fails, the full submission is sent through Telegram instead, so it is not lost. The other alerts also show only a shortened email address (for example j•••@example.com) and never a licence key or a download link; an alert about free access given or removed names only the item, with shortened addresses for you and for the team member and a link to our admin tools; an enrolment alert also carries the name and phone number given at checkout, so we can contact the student. When a marketing campaign has been sent, the alert says only how many people it went to.
• Payments. Purchases made on admov.io are processed by Stripe, Inc., which receives your email address and payment details directly. We never receive your full card details.
• Apple / Google — for sign-in and in-app purchases in the app, and Google for signing in on admov.io.
• Email delivery providers — Resend sends our verification, account and purchase emails, and tells us whether each one was delivered, delayed, bounced or marked as spam. We record that, not the email's contents. Resend also sends our marketing emails (the newsletter's confirmation email and our campaigns), only to people who agreed to them. We do not track opens or clicks, and our emails carry no tracking pixels.
• Email hosting — one.com hosts our mailbox at info@admov.io, in the EEA. Our super admins can read it from our admin tools; reading there does not change or store your email.

These providers process data under their own privacy and security commitments. We may also disclose information to comply with law or protect our rights and users.

5. Camera, Photos & Notifications

With your permission, the app accesses your camera and photo library so you can upload images, and may send push notifications (e.g. when a generation is ready). You can change these permissions anytime in your device Settings.

6. Data Retention

We retain your account data and content while your account is active and as needed to provide the Service. When you delete your account in the app, we delete or anonymize your personal data within a reasonable period, except where we must retain it for legal, security, or accounting purposes.

On admov.io: entries in our admin activity log (see section 12) are kept for 2 years and then deleted. Most of what our team can see about you is kept while your account exists and is deleted with it, with these exceptions: the order records we keep for accounting, as section 12 explains; the messages our team receives through Telegram (contact-form alerts, and the full message when one could not be stored; newsletter sign-up notifications; and the alerts about sales, refunds, enrolments, account deletions and free access given or removed described in section 4), which stay in that chat until a team member deletes them and are not removed when you delete your account; and sales lists and marketing consent records a super admin exports from our admin tools as CSV files (see section 12), which stay on that admin's computer until they delete the file. A newsletter subscription is separate from your account and is kept until you unsubscribe; after that, only the record of your consent and its withdrawal is kept, as described below.

Email and contact records: records of the emails we send (which email, to which address, its subject and whether it arrived, never its contents) are kept for 12 months. Contact-form messages are kept for 24 months, or deleted sooner if you ask us to erase yours. An email address given to unlock a guide is kept for 24 months as well, as section 11 describes. Our suppression list holds a one-way hash of an address that bounced or marked our email as spam, never the address itself, for 24 months after the last such event. The internal notes and tags our team keeps about your account are deleted with your account; email delivery records stay, unlinked from the account, until their 12 months are up. A data export a super admin downloads for your access request stays on their computer until they delete it.

Personal offers: the offers our team gives your account are kept while your account exists and are deleted with it. A purchase that used one keeps the amount of the discount as part of the sale record, for as long as section 12 says order records are kept. The Telegram alert our team receives when an offer is given or withdrawn shows only a shortened address, and stays in that chat until a team member deletes it.

Marketing emails: a newsletter sign-up that is never confirmed is deleted after 30 days. We keep a record of each consent to marketing emails and of its withdrawal (the address, the time, the version of the wording you agreed to, where you gave it and the language) for as long as the consent lasts and for 3 years after it ends, so that we can prove it and never mail an address that refused. The record of which campaign was sent to which address is kept for 24 months, and email delivery records for 12 months, as above.

7. Your Rights

Depending on where you live (e.g. under GDPR/KVKK), you may have rights to access, correct, delete, or port your data, and to object to or restrict certain processing. You can delete your account directly in the app (Settings → Delete account) or contact us at info@admov.io. We will respond as required by applicable law. An access request also covers the internal notes and tags our team keeps about your account, the record of emails we sent you, and the entries our admin activity log holds about you. It also covers the personal offers given to your account. We provide these as a file. Contact-form messages, emails you sent us and the email addresses you gave to unlock a guide are searched by hand.

Marketing emails: you can withdraw your consent at any time, with the unsubscribe link in every marketing email, the setting in your account, or by writing to info@admov.io. Withdrawing changes nothing else: your purchases and their receipts are not affected. An access request also covers the record of your marketing consents and withdrawals and the campaign emails we sent you.

8. International Transfers

Your information may be processed in countries other than your own, including where our service providers operate. We take steps to protect it consistent with this Policy and applicable law.

9. Security

We use reasonable technical and organizational measures to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. Children's Privacy

The Service is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect their data. If you believe a child has provided us information, contact us and we will delete it.

11. Website, Blog & Newsletter

This section applies to our website at https://admov.io, including the blog and the newsletter.

• Language preference. We store a cookie named admov-lang so the site opens in the language you chose. It contains only the language code and expires after one year. If you close an announcement at the top of the site, a cookie named admov-announce remembers which one so it is not shown again; it contains only a short identifier for that message.
• Analytics. We use Vercel Web Analytics, which counts page views without cookies and without collecting personal data. With your consent, we also use Google Analytics 4 to understand how visitors use the site; it sets the cookies _ga and _ga_35B5ZKGN2K, which last up to two years. Google Analytics stays off until you accept it in the cookie banner, and you can change your choice at any time from “Cookie settings” at the bottom of every page. Your choice itself is kept in your browser's local storage under the key admov-consent, not on our servers.
• Contact form. Details you submit (name, email, phone, the service you select, your preferred date and your message) are stored in our database for 24 months so we can reply and keep track of the conversation. Our team is told through Telegram with your address shortened. Super admins can see the message, mark it handled, and see whether its address matches an account on admov.io. We do not use them for marketing unless you ask us to.
• Newsletter. Signing up is double opt-in: we first send you one email with a link, and you are subscribed only once you press the button on the page it opens. If you do not, nothing more is sent, and the sign-up is deleted after 30 days. We store your email address, your language, the page you signed up from, the version of the wording you agreed to, and when you asked, confirmed and (if you do) unsubscribed, and send our team a Telegram notification that shows your address shortened. We use it only to send you our emails: news, new products and prompts, and occasional offers, at most about one a week. Every marketing email has an unsubscribe link, which opens a page where one press of a button unsubscribes you, and mail apps that support it show their own one-click “Unsubscribe” button; you can also write to info@admov.io, and we remove your address. We do not track opens or clicks, and our emails carry no tracking pixels. Our team can see the subscriber list (email address, language, the page you signed up from, the date and whether the subscription is confirmed) in our admin tools in order to manage it. We do not match the list against what you bought: a customer's page in our admin tools shows only whether their address is on it (see section 12). We match a newsletter address with an account's address only so that one person is not sent the same email twice, and so that withdrawing either ends both.
• Guides. Our guides are free. Some ask for your email address before the download: we store it with the guide, your language, the platform you came from and whether you asked for new guides, for 24 months, to count interest in each guide. We do not send you marketing emails unless you also tick the box to receive new guides, which subscribes you to the newsletter as described above. Super admins can see the addresses given for a guide in our admin tools. We also count views and downloads per guide without any personal data. On the Resources page, your choice between Claude Code and Codex is kept in your browser's local storage under the key admov-resources-agent.
• Purchases. If you buy an app, a template, a course, a prompt or a prompt membership here, payment is handled by Stripe and we store your email address, what you bought, the amount and the Stripe reference so we can deliver it and keep our accounts. We send you the licence key, download link or enrolment confirmation by email, or show it on the confirmation page; prompts appear in your account, and we email you an order confirmation. For a yearly prompt membership we also keep its Stripe customer and subscription references, so you can manage it from your account and so it is cancelled if you delete your account.
• Blog content. Some articles are drafted with the help of AI tools and reviewed by our team before publication.

12. Accounts and Sign-In on admov.io

This section applies to the website. You can read admov.io without an account, but buying an app, a template, a licence or a course seat requires one. Sign-in is provided through Supabase Auth, and Google is the identity provider.

• What we store. Your name, your email address and the profile picture address Google returns, the language you prefer the site in, and the orders placed with your account. We ask Google only for your basic profile and your email address. We never ask for access to the contents of your Google account, and we never receive your Google password.
• Where your session lives. Signing in stores a session token in your browser's local storage, under a key managed by Supabase that starts with sb- and ends with -auth-token. It stays on your device, it is not sent to us to keep, and signing out removes it.
• Earlier purchases. When you sign in with a verified email address that matches an order you placed before creating the account, we attach that order to your account so the licence key, download or course confirmation stays available to you in one place.
• Deleting your account. Open your account page, choose “Delete account” and confirm. Your sign-in and your profile are removed straight away. The order records themselves stay in our accounting for as long as tax and commercial law requires — no longer attached to an account, but still holding the email address the purchase was made with. You can also email info@admov.io and we will do it for you.
• Marketing emails. Your account's setting for marketing emails is off unless you turn it on. Turning it on records the time, the version of the wording you saw and its language; turning it off is one click, and also ends a newsletter subscription with the same address.
• Who can see it. Your account page shows only your own orders. In our admin tools, only our super admins, after a second sign-in step, can see your profile (name, email address, profile picture and preferred language), how you sign in, when you signed up and last signed in, your purchases (what you bought, the amount, its status and any refund), how many downloads you have used, whether a licence was issued — never the licence key itself or a download link — your course certificates, whether you are on the newsletter, the internal notes and short labels (tags) our team writes about your account (for example about a support request; we never write health or other sensitive details there), which emails we sent you and whether they arrived, and contact-form messages from your address. They can also resend a receipt to the address you paid with or your confirmed account email (it links to your account, never to a download), reset your download allowance, give or remove free access to an item, and download your data to answer your request. Every such view and change is recorded in an activity log: who looked or acted, at what kind of record, and when. Other members of our team see only totals there. Super admins can also export the sales list (email address, name, what was bought, the amount and its status) as a CSV file; section 6 says how long such a file is kept. They can also give and withdraw personal offers, and give or remove free access to a prompt or to the lifetime membership. The owner is told each time on Telegram, with your address shortened. Every change is recorded in the activity log. For a purchase, they also see its payment history: renewals, partial refunds and disputes. Super admins can also see the subscriber list with each address's status, and, for each marketing campaign, totals only: how many people it was sent to, and how many of its emails were delivered, bounced, marked as spam or led to an unsubscribe. They can also download the marketing consent records as a CSV file, for the İYS upload and to prove consent: each address, whether it is a newsletter subscription, an account's setting or an earlier consent or withdrawal, its status, where, in which wording and in which language consent was given, and when it was given and withdrawn; section 6 says how long such a file is kept. When you ask us by email to stop marketing emails, a super admin can withdraw your consent for your address, which ends your newsletter subscription and your account's setting together.

13. Legal Bases for Processing

We process your information on the following legal bases under the GDPR and Türkiye's personal data protection law (KVKK):

• Contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)): your account, your purchases and delivering what you bought, and answering your contact-form message about our services (a step you asked for before any contract).
• Legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)): the order records we keep for accounting and tax, and, where the law requires it (in Türkiye, Law No. 6563 and the İYS rules), the record of each marketing consent and its withdrawal.
• Legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)): keeping the Service secure, preventing abuse, customer support, the admin alerts and the activity log described above; email delivery records and the suppression list (making sure purchase emails arrive, and not mailing an address that refused them); internal notes and tags (customer support); and personal offers (customer relationship); and keeping the record of a marketing consent and its withdrawal where no law requires it (to prove it, and so that an address that refused is never mailed again).
• Consent (GDPR Art. 6(1)(a); explicit consent under KVKK Art. 5(1)): Google Analytics, the newsletter and marketing emails. In Türkiye, marketing emails are commercial electronic messages sent with your approval under Law No. 6563 on the Regulation of Electronic Commerce, and we register that approval with the Message Management System (İYS) where required. You can withdraw your consent at any time, as sections 7 and 11 explain.

14. Changes to This Policy

We may update this Policy from time to time. Material changes will be posted here with a new "Last updated" date and, where appropriate, notified in the app.

15. Contact

If you have questions about this Policy, you can reach us at: