Privacy Policy

Last updated: 31 October 2026

1. Controller

Your personal data is processed by İbrahim Öztürk, the operator of hekaty.com, under Türkiye’s Personal Data Protection Law No. 6698 (KVKK) and, for users in the European Union, the General Data Protection Regulation (GDPR). Contact: [email protected]

2. What we process

Account: e-mail address, name, a one-way hash of your password (never the password itself); if you sign in with Google or GitHub, the e-mail address and name that service gives us.
Content: your briefs, the files you upload (images, video, audio), your brand details, and the videos, images and logos the Service creates for you.
Usage and security: credit history, job logs, IP address and a device cookie we set in your browser (to prevent multiple accounts and abuse).
Site usage: the pages you open, the buttons you press and the messages you see (never what you type), your country and device type; to improve the Service. We use no cookie for this and keep these records for 90 days.
Payment: your subscription status and the customer and subscription IDs Dodo Payments sends us. Your card details are processed by Dodo Payments and never reach us.

3. Why (legal basis)

to provide the Service and perform our contract with you (account, content creation, credits, subscription),
legal obligations (billing and record keeping),
legitimate interests (security, preventing fraud and abuse, improving the Service),
your consent where it is required (e.g. sharing your content in the community).

4. Who we share it with

We do not sell your data. To provide the Service we share only what is needed with these service providers (processors):

our server hosting provider and Cloudflare (network and security),
Anthropic (Claude: scripts and design), OpenAI (image generation), Google and fal.ai (AI video footage), Microsoft (voice-over in some languages),
Dodo Payments (payments and invoicing, Merchant of Record), Resend (sending e-mail), Google and GitHub (if you sign in with them).

Some of these providers are located outside Türkiye (e.g. in the USA and the EU); your data is transferred with the safeguards required by KVKK and the GDPR. We may also share data with authorities where the law requires it.

5. How long we keep it

We keep your data while your account is open. When you close your account we delete your content and account data within 30 days; records we must keep by law (e.g. payment records) are kept for the legal period. Security records (IP, device) are kept for at most 12 months.

6. Cookies

We use only necessary cookies: one that keeps you signed in, a short-lived one for Google/GitHub sign-in, and a device cookie that prevents abuse. Your language and display preferences are stored in your browser. We do not use advertising or tracking cookies.

7. Your rights

Under Article 11 of KVKK and the GDPR you can ask whether we process your data, request information, ask for correction, deletion or a copy of your data, object to processing and withdraw consent. Write to us at the address above; we answer within 30 days. You may also complain to the Turkish Personal Data Protection Authority or, in the EU, to your local data protection authority.

8. Security

Connections are encrypted (HTTPS), passwords are stored as one-way hashes, and only you can access your files (except what you share in the community). No system is perfectly secure; if a breach occurs we will notify as the law requires.

9. Children

The Service is not meant for anyone under 18 and we do not knowingly collect their data.

10. Changes

We may update this policy; we will announce material changes on the site or by e-mail.