Privacy Policy

Last Updated: October 23, 2026

1. Scope and Controller

This Privacy Policy explains how personal data is processed through the mayalisting.com website and app (the "Platform"). The data controller is MayaListing. Details under Turkey's Personal Data Protection Law No. 6698 ("KVKK") are in the KVKK Notice. Contact: destek.mayalisting@gmail.com

2. What We Process

• Account data: name and email address. Your password is stored only as an irreversible hash; we cannot see it. If you sign in with Google, we use the name and email address Google shares with us.
• Images you upload and generated content: the images you upload for analysis and the titles, descriptions, keywords and file names generated from them. If an image shows a person's face or other personal data, that data is processed too; only upload images of other people if you have the necessary permission.
• Usage and subscription data: plan, usage counts, renewal and subscription status, activity history.
• Payment data: your card details never reach us; Lemon Squeezy takes the payment as the seller. We only receive the subscription status, a customer number and your email address.
• Technical and security data: IP address, browser details and server logs. The IP address is also used in daily usage counters to prevent abuse and overload.
• Support correspondence: the content of emails you send us.
• Cookies and similar data: see section 4.

3. Why We Use It

To create your account and keep you signed in, analyze your images and generate metadata, show your analysis history, manage your subscription and usage limits, prevent abuse and security risks, answer support requests, meet legal obligations and, only with your consent, measure site usage and the effectiveness of our ads.

4. Cookies and Browser Storage

Essential cookies and browser storage keep you signed in, remember your language and theme and store your cookie choice; the service needs them to work. Google Analytics and Google Ads cookies are enabled only if you accept them in the cookie notice; if you decline, these tools do not use cookies. You can change your choice at any time with the "Cookie Preferences" link at the bottom of the page.

5. How Your Images Are Processed

Images are processed only to generate metadata for you. They are not sold, not used for advertising and not used by us to train any AI model. For analysis, a downscaled copy is sent to the Google Gemini API; under Google's paid API terms, Google does not use this content to train its models. The downscaled copy is kept in a private store only you can access, to show in your analysis history.

6. Service Providers and International Transfers

We work with the following providers, which process data on our behalf and on our instructions:

• Supabase (database, sign-in, image storage): servers in the European Union (Frankfurt).
• Vercel (website and server hosting): server logs and IP addresses.
• Google (Gemini AI analysis, Google sign-in, support email; Analytics and Ads only with consent).
• Lemon Squeezy (payments and subscriptions, acting as the seller of record).

Some of these providers process data outside Turkey, in particular in the European Union and the United States. International transfers are made with the safeguards required by Article 9 of the KVKK and, for users in the European Economic Area, by the GDPR (such as the European Commission's Standard Contractual Clauses). Apart from lawful requests by competent authorities, your data is not shared with anyone else.

7. Automatic Replies to Support Emails

The first reply to emails sent to our support address may be prepared automatically by processing your email with Google Gemini. Automatic replies are for information only; refund, billing and technical matters are also reviewed by a person.

8. Retention

• Account data, analysis history and images: until you delete them or delete your account.
• Daily usage counters tied to IP addresses: at most 30 days.
• Payment and invoice records: for the period required by tax law.
• Server logs and support correspondence: as long as needed for that purpose.

9. Your Rights and Deleting Your Data

Your rights under Article 11 of the KVKK are listed in the KVKK Notice. You can permanently delete your account, analysis history and images at any time with "Delete Account" on the Account page; any paid subscription is cancelled. You can delete a single analysis from the history page. Users in the European Economic Area can also exercise their GDPR rights of access, rectification, erasure, restriction, portability and objection, and lodge a complaint with their local supervisory authority.

10. Security

Data is encrypted in transit (TLS). Images are kept in a private store and shown only to their owner through time-limited links. In the database, each user can access only their own records.

11. Children

The Platform is not intended for anyone under 18.

12. Changes

When we update this policy we show the effective date on this page, and we also email you about significant changes.