AlphaThis notice explains how your personal data is processed when you use the Lotzy desktop app and the lotzy.ai website, in line with the duty to inform under Article 10 of Türkiye’s Law No. 6698 on the Protection of Personal Data (“KVKK”). If the Turkish and English texts differ, the Turkish text prevails.
- For your account we only take your name, email address and (if you sign in with Google) profile photo.
- Your API keys, prompts, reference images and generated files are never sent to Lotzy’s servers. They stay on your computer or go directly to the AI service you choose.
- We don’t sell your data or use it for advertising.
1. Data controller
Your personal data is processed by Lotzy as the data controller. For requests and questions: lotzy.ai/feedback.
2. What we process
| Data | Source | Why |
|---|---|---|
| Name, email, profile photo, account ID | Sign-up with Google or email | Creating your account, verifying sign-in, reviewing your access request |
| Access status, sign-up and approval dates, the Terms version you accepted | Sign-up and sign-in | Managing alpha access and proving acceptance of the agreement |
| Feedback messages, optional email, app version | Feedback forms (website and app) | Fixing bugs and replying to you |
| Website usage data (pages visited, time spent, approximate location, device/browser details, cookie IDs) | Google Analytics on lotzy.ai | Measuring how many people visit the site and improving it |
| IP address and technical logs | Website and sign-in infrastructure (Google Firebase) | Security, preventing abuse, running the service |
What we don’t process: Your API keys are stored encrypted on your computer. Your prompts, reference images and generated images/videos stay in folders on your computer. Generation requests go directly from your computer to the service you choose (e.g. Higgsfield, OpenAI, Anthropic) and are subject to that service’s own privacy policy. Lotzy does not see or store this content.
3. Legal bases
Your data is processed under KVKK Article 5/2 because it is necessary to set up or perform a contract (account, access, support), to comply with our legal obligations, to establish, exercise or protect a right (acceptance records), and for our legitimate interests provided your fundamental rights and freedoms are not harmed (security, improving the service). Where non-essential analytics cookies or transfers abroad require it, your explicit consent is requested.
4. Transfers and service providers
Your data is shared only with the service providers needed to run the service: Google (Firebase Authentication, Cloud Firestore, Firebase Hosting, Google Analytics). Their servers may be located abroad, so your data may be transferred abroad in line with KVKK Article 9. Apart from requests by authorized public bodies, your data is not shared with third parties, sold or used for advertising.
5. Cookies
lotzy.ai uses Google Analytics cookies for visit statistics. When you sign in, browser storage is used to remember your session. You can delete or block cookies in your browser settings; some parts of the site may then not work as expected.
6. How long we keep data
Account data is kept while your account is open and, after it is closed, for the statutory limitation periods in case of disputes. Feedback is kept for a reasonable time after the issue is resolved. Analytics data is kept for up to 14 months under Google Analytics retention settings. Data past its retention period is deleted, destroyed or anonymized.
7. Your rights
Under KVKK Article 11 you have the right to learn whether your data is processed and to request information about it, to learn the purpose of processing and whether it is used accordingly, to know the third parties it is transferred to, to request correction of incomplete or inaccurate data, to request deletion or destruction when the legal conditions are met, to request that these actions be notified to the parties it was transferred to, to object to a result against you arising from analysis by automated systems, and to claim compensation for damage caused by unlawful processing.
You can send requests through the feedback form, stating the email address of your account. Requests are answered free of charge within 30 days at the latest. You can ask for your account and data to be deleted the same way.
8. Security
Data is sent over encrypted connections; only you and the authorized administrator can access account records. Even so, no transmission over the internet can be guaranteed to be fully secure.
9. Changes
We may update this notice from time to time. The current version is always published on this page, and we announce important changes separately.