Version 1.0 · Effective: October 11, 2026. This is the information notice required by Article 10 of Law No. 6698 on the Protection of Personal Data (KVKK) and the Communiqué on the Procedures and Principles of the Obligation to Inform. It also covers the information required by GDPR Article 13. The Turkish version is the authoritative one for users in Türkiye.
1. Data controller and representative
- Data controller: Space Made Code LLC, a limited liability company established in Delaware, USA. Registered agent: 16192 Coastal Highway, Lewes, Delaware 19958, USA. Business address: [BUSINESS ADDRESS]. Email: legal@spacemadecode.com.
- Data controller representative in Türkiye: [NAME / TITLE, ADDRESS, KEP ADDRESS]. VERBİS registration number: [ ].
- EU representative (GDPR Art. 27): [ ].
2. Personal data processed
Identity (name), contact (email), customer transaction (plan, subscription status, billing records, support correspondence), visual records (clothing photos, which may incidentally show a person), location (city-level only), transaction security (sign-in records, IP address, device and browser data, logs), user preferences (wardrobe details, outfits, plans, trips, notes, language, theme, time zone), marketing (email consent and preferences, if given).
3. Purposes
Setting up and managing your account; providing the digital wardrobe, outfit suggestions, planning and weather features; AI tagging and styling with your explicit consent; screening uploads for nudity; selling and billing subscriptions and fulfilling tax and accounting obligations; ensuring information security and preventing abuse; answering requests and complaints; sending marketing communications with your consent; fulfilling legal obligations and responding to authorities.
4. Legal grounds (KVKK Art. 5 / GDPR Art. 6)
- Necessary for the establishment or performance of a contract (KVKK 5(2)(c) / GDPR 6(1)(b)): account, wardrobe, outfits, planning, billing.
- Necessary to comply with a legal obligation (KVKK 5(2)(ç) / GDPR 6(1)(c)): tax and accounting records, responding to authorities.
- Legitimate interests, provided they do not harm your fundamental rights and freedoms (KVKK 5(2)(f) / GDPR 6(1)(f)): security, logs, abuse prevention, upload safety screening, time zone.
- Necessary for the establishment, exercise or protection of a right (KVKK 5(2)(e)): disputes and claims.
- Explicit consent (KVKK 5(1) / GDPR 6(1)(a)): AI tagging and styling, transfer of data abroad where no other safeguard applies, marketing communications, precise browser location (used once, not stored).
5. Method of collection
Electronically, through the Stylium website, wardrobe app, mobile apps, sign-in pages, support emails and contact forms, partly by automated means (e.g. cookies, logs, AI analysis).
6. Recipients and transfer abroad
Personal data is shared with our service providers to the extent necessary for the purposes above: Clerk (USA, sign-in), Supabase (Ireland, database and storage), Vercel (USA, hosting), Anthropic (USA and other regions, AI), Stripe (USA/EU, payments and tax), Resend (USA, email), Cloudflare (global, bot protection), and to authorised public institutions when legally required. Transfers abroad are carried out under KVKK Article 9: on the basis of standard contracts signed with the recipients and notified to the Personal Data Protection Authority within five business days, or, where these are not available, on the basis of your explicit consent for occasional transfers. [Counsel: complete per provider.]
7. Retention
As described in our Data Retention and Deletion Policy: wardrobe data until you delete it or your account; billing records 10 years; AI usage records 90 days; support correspondence 24 months.
8. Your rights (KVKK Art. 11)
You have the right to: learn whether your personal data is processed; request information about it; learn the purpose of processing and whether it is used accordingly; know the third parties in Türkiye or abroad to whom it is transferred; request correction of incomplete or inaccurate data; request deletion or destruction under Article 7; request that third parties to whom data was transferred are notified of corrections or deletions; object to a result against you arising exclusively from automated analysis; and claim compensation for damage due to unlawful processing. To apply, see our User Rights Request Procedure: email legal@spacemadecode.com from the address registered with us, or write to our representative in Türkiye [ADDRESS / KEP]. We respond within 30 days at the latest, free of charge, unless the action requires an additional cost under the Board's fee schedule.