Privacy Notice

1. Data controller

Your personal data is processed by Şerare Group Organizasyon Limited Şirketi (“Glowlog”) as data controller. Address: Tomtom Mah. İstiklal Cad. Beyoğlu İş Merkezi No: 187 İç Kapı No: 147, Beyoğlu, Istanbul, Türkiye. Email: kvkk@glowlog.tr.

2. Categories of personal data

• Identity: name or username.
• Contact: email address.
• Customer transactions: your product shelf entries, product photos, routines, calendar and completion records.
• Preferences: skin type, sensitivity and care priorities, language and time zone.
• Security: password hash, session records, IP address and browser details, notification subscription details.
• Special category data (only with your separate explicit consent): face/skin photos and skin condition information derived from them.
• Usage statistics: anonymous page-view data collected without cookies and without identifying you (Vercel Web Analytics).

3. Purposes

• Creating and managing your account,
• Providing the product shelf, routine, calendar and reminder features,
• Sending notifications before your care sessions,
• Responding to requests and complaints,
• Running information security processes and preventing abuse,
• Meeting legal obligations and informing competent authorities.

4. Collection method and legal grounds

Your data is collected electronically and partly automatically through the sign-up form, in-app forms, photos you upload and cookies or similar technologies. It is processed under KVKK Art. 5/2-c (necessary for the performance of a contract), 5/2-ç (compliance with a legal obligation) and 5/2-f (legitimate interests, provided your fundamental rights are not harmed). Special category data (skin photos and skin condition information) is processed only on the basis of your explicit consent under Art. 6, which you may withdraw at any time.

5. Transfers

Your data may be shared with infrastructure providers (hosting, database, file storage) needed to run the service, and with competent public authorities when legally required. Our database and storage provider Supabase Inc. hosts data in the European Union (Frankfurt, Germany), so your data is transferred abroad. This transfer relies on the standard contractual clauses published by the Turkish Personal Data Protection Authority under KVKK Art. 9, notified to the Authority within the legal deadline. We never sell your data to third parties for advertising or marketing.

6. Retention

We keep your data while your account is open. When you delete your account in the app, your data and uploaded photos are permanently deleted. Records that must be kept longer by law (e.g. access logs under Law No. 5651) are kept for that period and then deleted, destroyed or anonymised.

7. Your rights under KVKK Art. 11

• Learn whether your personal data is processed,
• Request information about the processing,
• Learn the purpose of processing and whether data is used accordingly,
• Know the third parties in Türkiye or abroad to whom data is transferred,
• Request correction of incomplete or inaccurate data,
• Request deletion or destruction under the conditions in KVKK Art. 7,
• Request that corrections, deletions or destructions be notified to third parties who received the data,
• Object to an adverse outcome resulting solely from automated analysis,
• Claim compensation for damages caused by unlawful processing.

8. How to apply

Send requests with information identifying you to kvkk@glowlog.tr from the email address registered with us, or in writing to Tomtom Mah. İstiklal Cad. Beyoğlu İş Merkezi No: 187 İç Kapı No: 147, Beyoğlu, Istanbul, Türkiye, in line with the Communiqué on the Procedures and Principles for Applications to the Data Controller. Requests are resolved free of charge as soon as possible and within thirty (30) days at the latest; if the request requires additional cost, the Authority’s fee schedule may apply. You can also delete your account and data yourself from the Settings page.

9. Not a medical service

Glowlog is not a health service or medical device; its information and suggestions do not replace diagnosis or treatment. Please consult a dermatologist about skin concerns.

10. Routine Journals (community)

Journals and comments you share in Routine Journals are public under your display name and may appear in search engines; your email is never shown. Posts are checked automatically before publishing (including by Anthropic’s AI service). Before/after photos are published only with your separate explicit consent and only as the cropped area you choose. You can delete your journal or comments at any time.