Privacy policy

Last updated: 2026-11-13

This policy explains which personal data Hayalia collects, why, how long we keep it and what rights you have. It is written to meet the EU General Data Protection Regulation (GDPR), the Turkish Personal Data Protection Law No. 6698 (KVKK) and similar laws.

1. Contact us

For any privacy question or request, use the contact page. Details of the data controller are at the end of this notice.

2. What we collect

• Account: name, e-mail address, password (stored only as a one-way hash, never readable), language, two-step verification settings and the date you accepted the terms.
• Your content: files and texts you upload, the results created for you and your project settings.
• Your voice recording and photos (if you upload them): the recording you upload to copy your voice, the voice made from it and its sample reading; the photos you upload to have a character drawn (stored with location and device details removed). Also the date and IP address when you confirmed your permission.
• Usage and billing: credit balance and history, jobs and their prices, gift codes you used.
• Payment: Paddle collects your payment details. We receive your name, e-mail, country, the amount and a transaction reference. We never see your full card number.
• Messages: support requests, e-mails you send us and your newsletter preference.
• Site assistant: what you write to the chat assistant on our site and its answers are stored so we can improve the answers and prevent abuse. Please do not share sensitive information there.
• Technical data: IP address and browser type of signed-in sessions, failed sign-in attempts and error records. Visit statistics are counted without cookies and without personal data: we only count the page address and the referring site per day.

3. Why we use it and legal basis

• To create your account and deliver the jobs you order: performance of our contract with you.
• We use your voice recording and photos only to create the voice and draw the character you asked for. Because voice and facial features may count as sensitive personal data, we do this on the basis of the explicit consent you give when uploading. You can withdraw it at any time by deleting the voice or photo.
• To process payments, keep accounting records and meet tax rules: contract and legal obligation.
• To keep the service and your account secure and to prevent abuse and fraud: our legitimate interest.
• To answer your support requests and send messages about your account and jobs: contract.
• To send our newsletter: only with your consent, which you can withdraw at any time with the link in every e-mail.
• To meet requests from courts and authorities: legal obligation.

Under KVKK, these correspond to the grounds in Article 5: performance of a contract, legal obligation, legitimate interest and, where needed, explicit consent.

4. Who receives your data

We do not sell personal data and we do not use it for advertising. We share it only with providers that help us run the service and only as far as needed:

• Hosting: our servers are in a data center in Germany (European Union).
• AI processing: to complete a job, the text, images or audio of that job are sent to the AI processing provider that performs it. Most of these providers are located in the United States. Only the content of the job is sent to these providers; your name, e-mail address and payment details are not.
• E-mail delivery: to send verification, security and job e-mails.
• Paddle (Paddle.com Market Ltd, United Kingdom): our Merchant of Record. Paddle processes payment data as an independent controller under its own privacy notice.
• Authorities: when the law requires it.

5. International transfers

Some of our providers are located outside your country, mainly in the United States. We transfer data only with the safeguards the law requires, such as standard contractual clauses, and only the data needed for the job.

6. How long we keep data

• Account data: as long as your account is open.
• Projects and files: until you delete them or close your account. They are then removed from our live systems within 30 days and from backups within a further 14 days.
• Voice recordings and photos: until you delete them, or delete the project or your account. When you delete them they are removed from our server at once and are no longer used in any job.
• Billing records: as long as tax and commercial laws require.
• Security records and assistant conversations: only as long as needed for security and quality, normally no longer than 12 months.

7. Security

We use encrypted connections (HTTPS), store passwords only as hashes, limit staff access to what each role needs, protect team accounts with two-step verification and keep regular backups. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

8. Your rights

You can ask us to:

• tell you whether we process your data and give you a copy;
• correct wrong or incomplete data;
• delete your data or close your account;
• restrict or object to processing;
• give you your data in a portable format;
• tell you to whom your data was transferred, inside or outside the country;
• withdraw a consent you gave.

Under KVKK Article 11 you may also object to a result against you that arises only from automated analysis, and claim compensation for damage caused by unlawful processing.

Send your request through the contact page. We answer within 30 days and may ask you to confirm your identity. You also have the right to complain to a data protection authority: in Türkiye the Personal Data Protection Authority (KVKK), in the EU the authority of your country.

If you live in California: we do not sell or share your personal information for cross-context behavioral advertising.

9. Children

Hayalia is not intended for people under 18. If we learn that a child has given us personal data, we delete it.

10. Automated decisions

We do not make decisions with legal or similarly significant effects about you solely by automated means. Our AI tools process your content only to create what you ask for.

11. Changes

We may update this policy. We announce important changes by e-mail or on the site before they apply.

12. Data controller

The data controller is Fikret Şanal, who operates Hayalia. You can send your requests through the contact page.