Version: draft-2026-08-25 · Status: ⚠️ DRAFT — not reviewed by a lawyer
Controller: {{LEGAL_ENTITY}}, {{REGISTERED_ADDRESS}} Contact: {{PRIVACY_EMAIL}} · DPO: {{DPO_CONTACT}} (if appointed)
This policy is written to satisfy GDPR Art. 13/14 and KVKK Art. 10. It describes what the software actually stores, which is checkable against the schema in src/coralmesh/db/models.py.
| Data | Why | Lawful basis | Kept for |
|---|---|---|---|
| Email address, name | Identify the account, send service email | Contract | Life of the account |
| Password (argon2id hash) | Sign you in | Contract | Life of the account |
| Session records — device name, platform, IP, user agent, timestamps | Show you your signed-in devices; detect stolen sessions | Legitimate interest (security) | 30 days after the session ends |
| Uploaded content — product photos, brand assets, reference video | Generate what you asked for | Contract | Until you delete it |
| Prompts and generation parameters | Produce output; let you reproduce a result | Contract | Until you delete the generation |
| Generated output | The thing you came for | Contract | Until you delete it |
| Credit and cost ledgers | Bill you correctly; the ledgers are append-only | Contract + legal obligation | 10 years (tax) |
| Invoices | Accounting | Legal obligation | 10 years (tax) |
| Moderation events and decisions | Enforce the Content Policy; handle appeals | Legal obligation + legitimate interest | 2 years |
| Registration signals — IP, a random device id, email domain | Stop bulk fake signups (see §6) | Legitimate interest | 90 days |
| Audit log of administrative actions | Accountability for anything staff do to an account | Legitimate interest | 3 years |
| Social account tokens, if you connect one | Publish on your behalf | Consent | Until you disconnect |
| Published-post metrics | Show you which variant performed | Contract | Until you delete the post |
We do not collect browsing behaviour across other sites, advertising identifiers, or location beyond what an IP address implies. There is no third-party analytics or advertising script on the studio.
The device id is a random value we generate and store in your browser. It is not a fingerprint: it is not derived from your screen size, fonts or canvas rendering, and clearing site data clears it. It answers one question — has this browser already opened several accounts.
Generation requires sending your prompt and any uploaded image to an AI provider. The Data Processing Addendum lists every sub-processor, what it receives and where it is.
Summary:
| Sub-processor | Receives | Purpose |
|---|---|---|
| fal.ai | Prompts, uploaded images, reference video | Generation |
| OpenRouter | Prompts and scene text | The scripting agent |
| Stripe | Email, billing details, card (directly — we never see it) | Payment |
{{HOSTING_PROVIDER}} | Everything, as the infrastructure | Hosting |
{{STORAGE_PROVIDER}} | Uploaded and generated media | Object storage |
{{MAIL_PROVIDER}} | Email address, message content | Verification and reset email |
{{ERROR_TRACKING}} | Error reports — stack, endpoint, request id | Diagnosing faults |
Error reports are configured not to include request bodies or headers, because those carry bearer tokens and customer prompts.
We do not sell personal data. There is no arrangement under which anybody receives it for their own purposes.
Your content is not used to train models — not ours, and not by allowing a provider to. Where a provider's default terms permit training on submitted data, we contract out of it; where we cannot, we do not use that provider.
If this ever changes it will be opt-in, announced in advance, and off by default.
Primary storage and processing are in {{DATA_REGION}}.
Some sub-processors are outside that region. Transfers rely on Standard Contractual Clauses, or on an adequacy decision where one exists. The DPA records which applies to each.
Under GDPR and KVKK you can ask for access, correction, deletion, restriction, portability, and to object to processing based on legitimate interest. Where processing is based on consent you can withdraw it at any time.
Two of these do not need an email:
accident is recoverable, then content is deleted and personal data anonymised.
For anything else, {{PRIVACY_EMAIL}}. We answer within 30 days.
Anonymisation rather than row deletion is deliberate: invoices and audit entries point at the user record, and a dangling reference is worse for everybody than an anonymous one. What is removed is everything that identifies you.
You may complain to a supervisory authority — in Turkey, the KVKK Board (kvkk.gov.tr); in the EU, your national authority.
Two automated processes affect you:
Registration scoring. Signals — how many accounts came from this IP recently, whether the email domain is a known throwaway, whether the browser has opened accounts before — produce a score. The score decides how much friction the free grant costs: nothing, a CAPTCHA, or a card check. It never refuses an account and never affects a paying customer.
Content moderation. Rules plus a language model check prompts before generation and sample output afterwards. A rejection blocks that generation. Repeated violations escalate.
Both are appealable to a person: moderation through the appeal button on the rejection, registration scoring by writing to {{SUPPORT_EMAIL}}.
Passwords are argon2id with a per-row salt. API keys are hashed and never stored in plaintext. Refresh tokens are stored as hashes and rotate on every use; a reused token revokes every session for that account, because that is what a stolen token looks like.
Tenant data is separated by PostgreSQL row-level security, enforced by the database rather than by application code — the API connects as a role that cannot bypass it.
Integration credentials entered in the admin panel are encrypted at rest with a key that is never in the database.
Everything is over TLS. Backups are encrypted before they leave the cluster.
The service is not for anybody under 18. We do not knowingly collect data from children. If you believe a child has an account, write to {{PRIVACY_EMAIL}} and we will remove it.
Material changes are announced by email 30 days in advance. The version string at the top changes with the document, and the version you agreed to is recorded against your account.
{{LEGAL_ENTITY}} · {{REGISTERED_ADDRESS}} · {{PRIVACY_EMAIL}} · {{DPO_CONTACT}} · {{SUPPORT_EMAIL}} · {{DATA_REGION}} · {{HOSTING_PROVIDER}} · {{STORAGE_PROVIDER}} · {{MAIL_PROVIDER}} · {{ERROR_TRACKING}}
apply depending on scale.
does the device id need consent?