Privacy Policy
Last updated: 9 October 2026
Draft: this text is a draft until it has been reviewed by counsel; it may change.
This policy explains how the CiltMate mobile app and the ciltmate.com website process personal data. It is also the information notice (aydınlatma metni) under Türkiye’s Personal Data Protection Law No. 6698 (KVKK).
In short
- Your skin conditions and your pregnancy or breastfeeding status are health data: they are processed only with the explicit consent you give in the app.
- Your data is stored in the European Union (Frankfurt).
- We never send your name, email or user id to the AI.
- No ads, and your data is not sold.
- When you delete your account in the app, your data is deleted at once.
What we process
Account
The user id and email address your identity provider gives us when you sign in with Apple or Google. With Apple you can choose Apple’s private relay address instead of your own. CiltMate has no password.
Skin profile and health data
Your age, skin type, skin concerns and priorities, the ingredients you want to avoid, and your pregnancy or breastfeeding status. We use them to set aside ingredients that are not right for you, to work out compatibility and to prepare your plan.
Plan, routine and tracking
Your plan, the products in your routine, your daily ticks and your answers at the four-week check-in.
Notifications
Your notification settings (on or off, reminder times) and, if you allowed notifications, your device’s notification token.
Subscription
If you subscribe to CiltMate Pro: your subscription status and the store’s transaction id. We never see your card: payment happens at Apple or Google, which tell us only the result.
Usage and error records
Events about how the app is used (for example, that a plan was created), under a random user number, without your name or email. Error reports carry only an error code, counts and durations; your skin profile, health data and products never go into them.
Support
Your email address and message when you write to us.
Why, and on what legal basis
| Purpose | Legal basis (KVKK) |
|---|---|
| Your account, skin profile analysis, plan and tracking | Entering into and performing a contract (art. 5/2-c) |
| Your health data (skin conditions, pregnancy, breastfeeding) | Your explicit consent (art. 6) |
| Security, fixing errors, preventing abuse | Legitimate interest (art. 5/2-f) |
| Legal obligations | Required by law; legal obligation (art. 5/2-a, ç) |
You can withdraw your explicit consent at any time by writing to privacy@ciltmate.com. Withdrawing does not affect the processing before it.
AI
We use Google’s Gemini API to write the descriptions of the steps in your plan. What is sent is your skin profile and your plan’s context; your name, email and user id are not. The paid Gemini API does not use the data sent to it to train Google’s models.
Product information, scores and compatibility results do not come from the AI: they are calculated from defined rules. Safety rules are never left to the AI either.
Who receives your data
We do not sell your data or share it for advertising. To run the service we share only what is needed with these providers:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and sign-in | European Union (Frankfurt) |
| Google (Gemini API) | Plan descriptions, without identity | Global |
| Apple and Google | Sign-in, delivering notifications, app stores and payments | Global |
| Expo | Delivering notifications (device token, title, text) | United States |
| RevenueCat | Managing subscriptions | United States |
| Sentry | Error reports (codes and counts) | European Union |
| Resend | Sending email | European Union |
| Cloudflare | Hosting this site and forwarding email | Global |
Some of these providers are outside Türkiye. Transfers abroad are made with safeguards that meet article 9 of the KVKK.
How long we keep it
For as long as your account exists. When you delete your account, your data is deleted from our database at once and drops out of backups within their rotation. If the law requires us to keep a record, we keep it only for that period.
Your rights
Under article 11 of the KVKK you can:
- learn whether your personal data is processed and, if so, ask for information about it,
- learn the purpose of the processing and whether it is used accordingly,
- know who it has been transferred to, in Türkiye or abroad,
- have it corrected if it is incomplete or wrong,
- have it deleted or destroyed, and have those it was transferred to told so,
- object to a result against you that comes solely from automated analysis,
- claim compensation if you suffer damage from unlawful processing.
Send your request to privacy@ciltmate.com. Writing from your account’s email address makes it easier for us to confirm it is you. We answer within 30 days at the latest. If our answer does not satisfy you, you can complain to the Personal Data Protection Board (KVKK Kurulu).
Minimum age
CiltMate is for people aged 16 and over; the app does not let anyone younger create a profile.
This website
ciltmate.com uses no cookies. It may use Cloudflare Web Analytics, which sets no cookies and shows only total visits, not who you are.
Changes
When we update this policy we change the date above, and we announce important changes in the app too.