Privacy Policy and Information Notice
Last updated: 20.10.2026
İGUANA REKLAM VE YAZILIM ANONİM ŞİRKETİ (“the Company” or “Data Controller”), registered at Maslak Mah. Sanatkarlar Sk. Eclipse Maslak Sitesi No: 2E-9 Sarıyer / İstanbul, attaches the utmost importance to the security and lawful processing of the personal data you share through the Aluya application (“the Application”). This notice is prepared under Article 10 of Law No. 6698 on the Protection of Personal Data (“KVKK”) to inform you transparently about our data processing activities, their purposes, legal bases and your rights.
1. Categories of Personal Data Processed, Purposes and Legal Bases
| Data Category | Data Processed | Purposes | Legal Basis (KVKK Art. 5) |
|---|---|---|---|
| Identity and Contact | If you register: name, surname and e-mail address. | Creating and verifying the user account, conducting membership processes and providing support. | Directly related to the conclusion or performance of a contract (Art. 5/2-c). |
| User Inputs (Creative Content) | Ideas, topics, editing instructions and text requests entered into prompt/text fields. | Generating user-specific audio, music, lyrics, visual and media content through third-party AI service providers, subject to your consent. | Performance of a contract (Art. 5/2-c). |
| Transaction Security and Technical Data | IP address, device identifiers (Device ID), OS version, device model, error logs (masked) and usage statistics. | Ensuring system security and integrity, preventing misuse/fraud, performance optimization and detecting technical errors. | Expressly provided by law (Art. 5/2-a), legal obligation (Art. 5/2-ç) and legitimate interest (Art. 5/2-f). |
| Customer Transaction and Financial Data | Subscription plan, purchase history, digital credit balance and in-app purchase tokens (credit-card data is not stored by us). | Finance and accounting, payment verification and defining subscription entitlements. | Performance of a contract (Art. 5/2-c) and legal obligation (Art. 5/2-ç). |
1a. Religious Beliefs and Explicit Consent
Aluya creates and plays Christian worship music. The themes, prompts, lyrics, songs, favorites, listening history and feedback you create or use in the app may reveal your religious beliefs. This is special-category personal data under KVKK Article 6 and, for users in the EU/EEA, GDPR Article 9.
We process this data based on your explicit consent under KVKK Article 6 and, for users in the EU/EEA, additionally under GDPR Article 9(2)(a). We ask for your consent in the app before you use it. You cannot use the app without giving consent. We use this data only to provide the app’s features: generating, storing and playing your songs, and personalizing what the app shows you. We do not sell this data or use it for advertising targeting.
You can withdraw your consent at any time in the app under Settings → “Withdraw religious data consent”, or by contacting support at hello@iguana.com.tr (see section 6, Contact). Withdrawing consent signs you out, and you cannot use the app without consent. It does not affect the lawfulness of processing before you withdrew consent.
To have your data erased, you can delete your account as explained in section 3, Data Retention, Erasure and Account Deletion; see also section 5, Your Rights under KVKK Article 11 and How to Apply. For the processors and sub-processors involved, see section 2, International Data Transfers. For how long data is kept, see section 3.
2. International Data Transfers
Owing to the Application's cloud-based architecture and AI infrastructure, personal data and technical logs are transferred to global service providers located abroad pursuant to Article 9 of the KVKK. The Company treats these providers' Data Processing Agreements (DPAs) and international security-standard commitments (ISO 27001, SOC 2, etc.) as supporting elements of its legal-safeguard processes.
AI service providers
To create lyrics, audio and cover art, current versions of the Application send the content you enter to third-party AI service providers only after you give your explicit consent in the Application.
- Text/language services: Receive your idea or prompt, including lyrics you write yourself, edit instructions and the current lyrics, and your theme, audience and language choices to screen the input and write and edit lyrics.
- Audio services: Receive the final lyrics, title and style tags to produce the audio.
- Image services: Receive a picture description derived from the creation (lyrics, title and atmosphere) to generate cover art, including cover art for a release.
No account identifier (name, e-mail or user ID) is attached to these requests. Content you voluntarily enter in free-text fields is processed by those providers, so do not enter personal data you do not want shared. These providers may be located abroad, as described under “International Data Transfers”. Providers may route a request through their own sub-processors or alternative model infrastructure, so the same data may reach those parties under onward transfer.
You can withdraw your consent at any time in the Application. Withdrawal stops further sharing but does not affect processing already carried out. If we start sending a new category of data or use it for a new purpose, we will ask for your consent again.
| Generic Recipient Category | Data Transferred | Purpose and Scope |
|---|---|---|
| Third-party AI service providers (text/language, audio and image) | Text/language: ideas or prompts, user-written lyrics, edit instructions, current lyrics, and theme, audience and language choices. Audio: final lyrics, title and style tags. Image: a picture description derived from the creation (lyrics, title and atmosphere). No account identifier (name, e-mail or user ID) is attached. | Screening input, writing and editing lyrics, producing audio and generating cover art, including cover art for a release, only after explicit consent in the Application. Providers may be located abroad, as described under “International Data Transfers”. Providers may route a request through their own sub-processors or alternative model infrastructure, so the same data may reach those parties under onward transfer. |
| Cloud Infrastructure, Hosting, Storage and Render Providers | Application database records, generated audio/music/visual media, titles, UUID object keys and technical server logs. | Hosting data on secure servers, storing content, serving via CDN and running video-render on global cloud infrastructure. |
| Subscription, Payment and Revenue Management Providers | User ID, device identifiers, subscription status, billing periods and purchase history. | Integration, tracking and management of in-app purchases, premium memberships and digital-credit systems. |
| Analytics, Attribution and Error-Monitoring Providers | Device identifiers, error records, performance metrics and masked usage logs. | Performance monitoring, crash/error detection, marketing attribution (MMP) and experience analysis. |
| Identity/Security Verification and Notification Providers | Device and app-integrity tokens, push-notification tokens. | Blocking bot/malicious attempts, verifying device security and delivering push notifications. |
Legal basis for transfers abroad: These continuous cross-border data flows are carried out on the basis of the Standard Contracts published by the Personal Data Protection Board under Article 9 of the KVKK.
3. Data Retention, Erasure and Account Deletion
- Account and Identity Data: Retained while membership continues; following a deletion request, permanently deleted within 30 days at the latest, subject to legal retention obligations.
- Prompt and Creative-Content Inputs: Retained throughout active membership for performance of the contract and service quality and abuse monitoring. Upon account deletion, outputs whose ownership passes to the Company and which are rendered anonymous (not attributable to the creator on visible surfaces) may remain in the system.
- Technical Logs and IP Records: Retained for at least 1 to 2 years from the transaction date for security and legal reasons (e.g., Law No. 5651).
Users may submit deletion requests through the in-app settings menu or via our account deletion page.
4. Data Security
The Company applies industry-standard technical and administrative measures (data minimization, backend masking, SSL/TLS encryption and secure cloud architectures) to protect personal data against unauthorized access, alteration, disclosure or destruction. However, no data transmission over the internet is 100% secure and cyber-attack risks cannot be entirely eliminated.
5. Your Rights under KVKK Article 11 and How to Apply
Under Article 11 of the KVKK you have the right to: learn whether your personal data is processed; request information if it is; learn the purpose of processing and whether it is used accordingly; know the third parties to whom it is transferred at home or abroad; request correction if it is incomplete or incorrect; request its erasure or destruction; request that such actions be notified to third parties to whom the data was transferred; and request compensation if you suffer damage due to unlawful processing.
You may submit your requests to hukuk@iguana.com.tr from the e-mail address registered in our systems. Requests are concluded free of charge within 30 (thirty) days at the latest.
6. Contact
For general questions about our privacy practices, contact us at hello@iguana.com.tr. For formal KVKK requests, please use hukuk@iguana.com.tr.