Privacy Policy and Personal Data Protection Notice
This notice is issued under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It applies to everyone who uses the Wowstage mobile application (the "App") and the wowstage.app / api.wowstage.app web pages (the "Site").
1. Data Controller
Wowstage is a brand; the data controller above is responsible for your personal data.
2. Personal Data We Process
2.1. Account and profile data
- Full name, username, e-mail address, password (stored only as an irreversible hash), gender, app language.
- Profile photo, short bio, private-account preference, notification preferences.
- University verification (optional): your university e-mail address and verification status.
- We do not collect your date of birth; the 18+ requirement is accepted by your declaration at sign-up.
2.2. Content you share and your interactions
- Photos, videos (Fit Check and 360° Spin), stories (24 hours), highlights, collections, comments, likes, your per-photo score visibility choices, follows and follow requests, blocks, bookmarks, duel invitations and votes, Studio (AI-edited) images, your Studio wardrobe (garments you picked from other users' public photos), article comments and likes.
- Photos you have analysed only for yourself with "See my scores" and their results; they are not shown to other users unless you share them (see Sections 5, 8 and 9).
- View records (which photos/stories you viewed), reports you submit and reports about you, moderation decisions.
2.3. Messaging
- One-to-one messages: text, photos, documents, voice messages, story replies, shared posts, reactions, delivered/read status, typing status.
- Messages are not end-to-end encrypted; they are stored on our servers and, apart from a lawful request, visible only to the parties of the conversation.
2.4. Biometric data (special category personal data)
The core function of the App is the evaluation of photos containing faces. Accordingly:
- A face vector (a mathematical representation of the face) is generated and stored for every photo you share and for the best frame of every video. For photos you analyse with "See my scores" without sharing them, the face vector is used only while the score is calculated and the photo is verified, and is not stored; if you share the photo, it is generated and stored at that moment.
- During face verification, a reference face vector is generated from the live selfie you take; the selfie itself is not stored.
- Face vectors are used for three purposes only: calculating the beauty/handsomeness AI score; identity verification (if you have verified your face, confirming that the photos and videos you upload are of you); and the "Similar Faces" feature (showing other users' shared photos whose faces resemble a shared photo; your shared photos may also appear in other people's results, and the photos of a private account only to the followers you approve).
- Face vectors are never shared with third parties, never used for advertising or promotion, and are destroyed the moment you delete the photo or your account (see Section 8).
- Under Article 6 of KVKK this data is processed only with your explicit consent. Consent is collected at sign-up with its own checkbox; an account cannot be created without it. You can withdraw it at any time under Settings > Face Data Consent, confirming with your password (see Section 8).
2.5. AI derivatives
- Numerical representations (embeddings) of your photos and garments, clothing segment masks, AI scores and uncertainty values, similar-outfit search data.
- Shot and outfit signals for tips: the size and position of the face area in the frame, its sharpness, light and how much it faces the camera; which parts of the outfit are visible and how each part contributes to the style score. These signals do not identify you and do not change the score.
- Studio: before/after images of your face photo edited by AI (processed on our own server; not sent to any third party).
- Studio wardrobe: the mask and cut-out copy of a garment you added, cut from the source photo (the garment only; no face or person image), the garment's numerical representation and colour/size metadata. Outfit try-on results: before/after images of your own photo redrawn by AI with the chosen garment, and the result notes. All processed on our own server.
2.6. Device and technical data
- IP address, requested address, device type, operating system, app version, language (in server access logs and requests).
- Push notification registration (push token).
- Device identifier: only at sign-up and sign-in, for abuse and ban-evasion detection; stored on the server only as an irreversible keyed hash.
2.7. Support and contact
- When you contact us by e-mail: the content of the correspondence and your contact details.
3. How We Collect Your Data and Our Legal Bases
Your data is collected electronically through the App and the Site, directly from you (sign-up, sharing, messaging, settings) and automatically during your use (access logs, device information).
Legal bases under Articles 5 and 6 of KVKK:
- Account, profile, content, interaction and messaging data: necessary for the conclusion and performance of a contract (Art. 5/2-c); legitimate interests of the data controller (Art. 5/2-f).
- Security, abuse prevention, moderation, device identifier, ban records: legitimate interests (Art. 5/2-f); legal obligation (Art. 5/2-ç).
- Server access (traffic) logs: expressly provided for by law and legal obligation (Law No. 5651; Art. 5/2-a and ç).
- "See my scores" analysis and tips: necessary for the performance of a contract (Art. 5/2-c); explicit consent for the face data used in the analysis (Art. 6/2).
- Face vectors (biometric): explicit consent (Art. 6/2).
- Training of AI models (see Section 6): legitimate interests; explicit consent for data containing faces.
4. Purposes of Processing
- Creating, verifying and managing your account.
- Publishing your photos, videos and stories; calculating AI scores, providing the "See my scores" analysis and tips, and operating the rankings and duels.
- Enabling social features such as comments, likes, follows, duels, messaging and "Similar Faces".
- Suggesting people to you (mutual follows, the owners of photos you liked or saved, your university) and arranging your feed (moving photos you have already seen further down).
- Sending push and in-app notifications.
- Providing clothing analysis, similar-outfit search and Studio features (face/hair editing, outfit try-on and the wardrobe).
- Detecting abuse, fake accounts and rule violations; reviewing reports; enforcing bans.
- Fulfilling our legal obligations and responding to official requests.
- Detecting errors, ensuring security, improving the service.
5. Automated Processing and Scoring
Your photos are processed automatically: face detection, face vector extraction, beauty/attractiveness/style scores, clothing segmentation, and shot and outfit signals for tips. Scores are only the estimates of our AI models and are given on a scale relative to photos of the same gender. There is no community voting; likes do not affect scores. Scores are subjective and for entertainment, not a judgement about your personality or worth. Tips are about how the photo is taken, the outfit and the Studio, not about your face or body.
- Score visibility: other users cannot see a photo's scores unless you show them; you can show each category separately. You always see your own scores.
- Profile average: calculated from the scores of your shared photos, including the scores you hide. It is visible to other users if your account is not private, the "Show my average scores" switch in Settings is on and you have at least two shared photos or a shared photo whose scores you made visible in all three categories; for a private account, only to the followers you approve. You can hide it by turning the switch off.
- See my scores: other users cannot see a photo you analyse without sharing it; it does not enter your profile average, the rankings or model training. Up to 20 analyses can be made per day.
- Rankings: based on the AI scores of shared photos. The scores you hide are also used to determine the ranking order; your photo's score is shown in the list only for the categories you show. Private accounts and accounts without a verified face are not ranked.
- Duels: two users' photos are put to other users' vote with the question "Who's more wow?"; duel votes do not affect scores.
You may object to the results of automated processing under Article 11 of KVKK (Section 10). Because scoring is the App's core function, an objection may require your account to be closed.
6. Training of AI Models
- Our scoring models are currently trained on licensed and publicly available datasets.
- We plan to use the content you share to train our models in the future. Analyses you do not share with "See my scores" are not used for training. Training data containing faces will be used only with your explicit consent obtained separately for this purpose; declining does not affect the service.
- Training data is never shared with third parties and never used to train any model outside Wowstage. The models do not contain your raw photo or your identity.
- When you delete your account or content, the related data is removed from future training sets.
7. Transfers of Your Personal Data
7.1. Other users and public pages
- Your profile and posts are visible to other users. Your photos' scores are visible only in the categories you show, and your profile average under the conditions in Section 5; your photos that enter the rankings appear in the ranking lists. Analyses you do not share are not shown to other users. The private-account setting shows your posts only to followers you approve.
- Garment images in your public photos (the garment only; not your face or identity) may be used by other users as a reference in Studio outfit try-on. On a private account only the followers you approve can do so, and people you block never can. The results other users generate are on their own photos; they contain neither your photo nor your face (Terms of Use, Section 7).
- When you share a link to a post, profile or article, a preview page outside the App (title, description, image) is generated on the Site for whoever opens the link. Hidden, blocked and private-account content is not shown on these pages.
7.2. Service providers (data processors)
Your data is transferred to the following providers only to the extent the service requires:
- Netvia Bilişim Yazılım Danışmanlık Tic. Ltd. Şti. (Türkiye): server hosting. Our servers are located in Türkiye, in a data centre in Istanbul; personal data is stored on an encrypted disk volume on the server and only we have access to the server; the provider operates the physical infrastructure.
- GNET İnternet Telekomünikasyon A.Ş. (Güzel Hosting) (Türkiye): backups and e-mail service. Backups are stored encrypted in a data centre in Istanbul, Türkiye; only we hold the decryption key. E-mails you send us and the e-mails the app sends you (e-mail verification link, address claim code, password reset and password change notices, university verification code) are handled through this provider's e-mail service; mailboxes are hosted in Türkiye.
AI operations (scoring, clothing analysis, Studio) run on our own servers; your images are never sent to any third party for this purpose.
7.3. International transfers
Our servers, our backups and your data are located in Türkiye.
7.4. Legal authorities
Data is shared with the relevant authority upon a court order, a prosecutor's request or a duly issued request from a public body authorised by law. When such a request is received, the account concerned is placed on "legal hold" and exempted from deletion until the request is concluded.
Beyond the above, your data is never sold, rented or shared with advertising networks.
8. Retention and Deletion Periods
- Active account: until you delete it.
- Account deletion (Settings > Delete Account): your account is closed immediately, all your content becomes invisible, your sessions and push registrations end, and your face vectors and your unshared "See my scores" analyses are destroyed at that moment. After 30 days, your photos, videos, stories, Studio images, comments, likes, follows, collections and all other data are permanently deleted; the account record is anonymised so that it contains no identifying information. The same e-mail cannot re-register during this period. Deletion cannot be undone.
- Withdrawing consent: your face vectors (the reference vector and the vectors of your photos) are deleted at that moment and your face verification is revoked; all your photos and videos are removed as if you had deleted them and permanently deleted after 30 days, your unshared analyses are permanently deleted at once, and your Studio history (before/after images) is permanently deleted at once; none of it comes back even if you consent again. Your account stays open; until you consent again you cannot upload photos or videos or use Studio, and until you verify your face again you cannot take part in features that require verification (e.g. rankings). The score record of the removed content keeps counting with its frozen values, as under the deletion rule.
- Deleting a single photo or video: the item is hidden immediately; its face vector, visual embedding, clothing analysis data and every Studio wardrobe copy taken from it (for all users) are deleted at that moment; the image files are permanently deleted after 30 days. The item's score record continues to count in your average, frozen at its values at the time of deletion, so that scores cannot be altered by deleting content; this record contains no image or face data and is not re-scored when the AI models are updated.
- "See my scores" analyses: an analysis you do not share is permanently deleted after 30 days, or at once when you delete it (the photo, the analysis data and the record). A photo that cannot be analysed (for example when no face is found) is deleted after 1 day. The face vector of an unshared analysis is never stored. An analysis you share becomes a post and follows the rules for posts.
- Studio results, comments, article comments: permanently deleted the moment you delete them. Deleting a comment also deletes its replies. A Studio result you shared to the feed is a separate post; deleting it is also immediate and permanent.
- Studio wardrobe: the garment copies you added are kept until you remove them; they are deleted at once when the source photo's owner deletes or hides the photo or their account is purged, and on day 30 when your own account is purged. Studio results you generated with a garment are your own content: they are not deleted when the source photo is (the result contains neither the source photo's image nor its face); only a new try-on with that garment is no longer possible.
- Content removed by moderation: the face vector is deleted at removal; files and the record are permanently deleted after 30 days (appeal window). For messages, the "Messages" item applies.
- Stories: leave the feed after 24 hours and are permanently deleted within 30 days; stories you add to highlights are kept until you remove them.
- Messages: until you or the other party delete them. The text and files of a deleted message are permanently deleted after 30 days, or after the review if a report about it is still waiting to be reviewed; only a "This message was deleted" line stays in the chat. Messages sent by a deleted account remain in the other party's chat history under the name "Deleted User"; when both accounts are deleted, the conversation is deleted entirely.
- Record kept after permanent deletion: an irreversible keyed hash of your e-mail and username, any ban decision and its reason, and the deletion and purge dates. Purpose: preventing banned accounts from returning, proving that the deletion request was fulfilled, and responding to legal requests. The identity hashes and ban information are deleted after 2 years; the deletion record itself (account number and dates only) after 3 years.
- Device records: kept with your account and deleted when the account is purged; 2 years for accounts subject to a device ban.
- Legal hold: upon a request from a competent authority, the account and its data, including individually deleted content, are exempted from permanent deletion until the request is concluded.
- Server access (traffic) logs: 2 years as required by Law No. 5651; retained for the statutory period even if the account is deleted.
- Backups: deleted data may remain in encrypted backup copies for up to 2 more months and is not included in new backups.
- Application logs: 14 days. Notifications: deleted 90 days after being read. Rejected videos: 7 days.
9. Data Security
- Passwords are hashed irreversibly (bcrypt).
- All traffic is encrypted with HTTPS.
- Database and server access is limited to authorised persons; actions in the admin panel are logged. To review reports and prevent abuse, the authorised team can see content in the admin panel, including unshared analyses.
- Backups are stored encrypted.
- In the event of a data breach, the Personal Data Protection Board and, where required, you will be notified within 72 hours at the latest, in line with the Board's decisions.
Absolute security on the internet cannot be guaranteed; keeping your password confidential and protecting your device is your responsibility.
10. Your Rights and How to Apply
Under Article 11 of KVKK you have the right to:
- learn whether your personal data is processed and, if so, request information,
- learn the purpose of processing and whether the data is used in line with that purpose,
- know the third parties to whom the data is transferred, in Türkiye or abroad,
- request correction if the data is incomplete or inaccurate,
- request erasure or destruction under Article 7 of KVKK,
- request that correction, erasure and destruction be notified to third parties to whom the data was transferred,
- object to a result that is to your detriment arising from analysis exclusively by automated systems,
- claim compensation for damage caused by unlawful processing.
You may submit your applications by e-mail to support@wowstage.app; a postal address for written applications is provided on request. Applications are answered free of charge within 30 days at the latest. If your application is rejected, the answer is found insufficient or no answer is given in time, you retain the right to lodge a complaint with the Personal Data Protection Board.
You can delete your account and your content yourself within the App (Section 8).
11. Cookies and Similar Technologies
- The App does not use cookies. Your session is maintained with an access token stored in your device's secure storage; push registration and the device identifier are described in Section 2.6.
- The legal document and share-preview pages on the Site use only technically necessary session and security (CSRF) cookies; there are no tracking or advertising cookies.
- The App and the Site load their fonts from the app package and from our own server; no request for typography goes to any third party.
12. Children's Privacy
The App is for users aged 18 and over. Accounts found to belong to anyone under 18 are closed immediately and their data is deleted. If you believe a child has created an account, please report it to support@wowstage.app.
13. Changes
This notice may be updated. You will be informed of material changes by in-app notification; the current version and date appear at the top of the document.
This notice is provided in Turkish and English. In the event of any discrepancy between the two versions, the Turkish version prevails.
14. Contact