Privacy policy
This English version is provided for convenience. The Turkish text is the legally binding version under Turkish law (KVKK).
This policy explains how personal data is collected, processed, stored, and transferred when you use the CossyVita mobile app and the cossyvita.com website. It is also an information notice under Turkey’s Personal Data Protection Law No. 6698 (“KVKK”).
CossyVita is a skincare support app; it does not provide medical diagnosis or treatment.
1. Purpose and scope
This policy covers account creation, skin profile, product scanning and analysis, beauty cabinet, routine, product/routine history, uploading skin photos and AI skin analysis, notifications, subscription, and website visits.
Skin profile, skin photos, and analysis results may include information that can be treated as health-related or as special-category personal data under KVKK. We therefore describe these categories separately rather than grouping them under generic “usage data”. These features are optional.
2. Data controller
The business providing services under the CossyVita brand is the data controller for personal data processed in connection with CossyVita services.
- Brand: CossyVita
- Web: https://cossyvita.com
- Email: destek@cossyvita.com
The legal entity name and a full postal address for notices will be published in this section as registration details are finalized. For now, you can send requests by email.
3. Personal data we collect
Account and identity information
- Email address, name / display name (to the extent you provide them)
- Authentication information (password hashes or Google session information)
- Account status, subscription / entitlement tier (for example free or Premium)
Skin profile and care preferences
- Skin type, concerns, goals, and lifestyle information you report
- App preferences (notifications, marketing consent, and similar)
Product, cabinet, and routine information
- Products you scan or save, label information, ingredient (INCI) texts
- Cabinet, favorites, and routine steps; routine completion records
- Product analysis summaries and personal fit / suggestion texts
Skin photos and AI analysis data
- Face/skin photos you upload for AI skin analysis (front, left, and right angles)
- The analysis result (scores, summary, regional notes, suggestions) linked to your account
- The model name that produced the analysis and technical usage metrics (for example token counts)
Technical and security data
- IP address, request logs, error / crash telemetry
- Session and security events
Device and notification information
- Platform, app version
- A device registration token if you enable notifications (for push)
Payments / subscription
In-app purchases may be processed through the App Store / Google Play and a subscription verification service (RevenueCat). CossyVita does not store your card number; the stores and payment infrastructure have their own privacy policies.
4. Purposes of use
- Account creation, session management, and security
- A personalized product / routine experience based on your skin profile and cabinet
- Product label / ingredient analysis and in-app information
- AI skin analysis and showing results in your account
- Responding to support requests
- Service quality, debugging, and preventing abuse
- Informational / marketing communications if you give explicit consent
- Meeting legal obligations
5. AI-supported skin analysis
Important: CossyVita’s AI-supported skin analysis is for information and personal care support. It is not a medical diagnosis, disease detection, or treatment recommendation. If you have health concerns, consult a healthcare professional. It does not replace a doctor’s assessment.
Skin photos and AI analysis
When you use skin analysis, the skin photos you upload are processed for analysis. They are used to assess how your skin looks, to create informative in-app results about skin characteristics and possible care needs, and to present personalized results to you.
The current flow is:
- Photos are first stored as media linked to your account in object storage (Supabase Storage).
- During analysis, photos are sent together with a summary of your reported skin profile (type, concerns, goals, lifestyle) to an AI model that can process images (the OpenAI API or an OpenAI-compatible endpoint we configure).
- Your name, email address, or password is not added to this AI request.
- Photos are not deleted automatically after analysis. Media records and the analysis result are kept linked to your account so you can see past scans in the app.
- Analysis texts, scores, and suggestions are stored in the CossyVita database.
CossyVita does not guarantee in this text whether a third-party AI provider will use submitted images to train its own model. That depends on the provider’s API and privacy terms at the time.
6. Product analysis and other AI uses
AI may also be used for product scanning and personal suggestions. Actual behavior:
- Product label photos: may be sent to our own OCR service (on our servers) for text extraction. Label images may also be sent to the AI provider for image-based product analysis.
- Product content: brand, product name, INCI / ingredient text, and categories may be sent to AI for product analysis and personal fit texts.
- Routine / cabinet context: in-app care information such as routine steps, goals, and concerns may be sent to AI as text to generate personalized explanations.
- Identity: username and email are not intentionally added to AI chat / image requests.
7. Sign in with Google
If you use “Continue with Google”, basic profile information from your Google account (for example email, name, profile photo) is received through our identity provider (Supabase Auth). We do not see your Google password. Google’s own privacy policy also applies.
8. Legal bases for processing
Under KVKK Art. 5 and, for special-category data, Art. 6, processing may rely on:
- Formation and performance of a contract (account, app service, Premium features)
- Explicit consent — especially uploading skin photos, AI skin analysis, and processing of skin information that may be special-category; marketing communications
- Legitimate interest (security, debugging, improving the service — provided this does not override your rights and freedoms)
- Legal obligation
Where processing is based on explicit consent, you may withdraw it. Withdrawal does not affect the lawfulness of processing before withdrawal; you may no longer be able to use the related feature.
9. Recipients and service providers
We use the following processors to provide the service. They process data only on our instructions and under contractual safeguards, for service purposes.
| Service | Purpose |
|---|---|
| Supabase | Authentication, storage of account and app data, media (photo) object storage |
| OpenAI (or an OpenAI-compatible AI endpoint) | Visual skin analysis, product/ingredient analysis, and personalized text generation |
| Resend | Email sending (for example verification, password reset; sender noreply@cossyvita.com) |
| Sentry | Error and crash tracking (monitoring app/API errors) |
| VPS / cloud hosting | Running the app API, OCR, and website |
| Google sign-in; loading fonts on the site (Google Fonts) | |
| RevenueCat / app stores | Subscription and purchase verification (at account-id level) |
| Firebase Cloud Messaging (if used) | Delivering push notifications |
Limited and proportionate transfers to competent public authorities may be made where legally required.
10. International transfers
Infrastructure for Supabase, OpenAI, Resend, Sentry, Google, and similar providers may not be located in Turkey. In that case your personal data may be transferred to countries where those providers process data, in order to provide the service.
International transfers are intended to comply with the appropriate safeguards and conditions in KVKK Art. 9 (for example standard contracts / provider terms and technical-organizational measures). Details depend on the provider’s processing location at the time.
11. Retention periods
Under KVKK’s purpose-limited storage principle, data is kept for as long as needed for the processing purpose and legal obligations. Our current practice:
| Category | Retention |
|---|---|
| Account and identity | Until the account is deleted |
| Skin profile, product/routine/analysis history | Until the account is deleted or you remove the related record in the app |
| Skin photos | Not deleted automatically after analysis; with account or media deletion / a deletion request |
| AI analysis results | Linked to your account until the account is deleted |
| Security and error logs | A reasonable period for investigating incidents and system security; then deleted or anonymized |
| Records that must be kept by law | The period provided in the relevant legislation |
After account deletion, a copy may remain in backups for a short time; it is removed when the backup cycle completes.
12. Account deletion and data deletion
You can delete your account with “Delete my account” in in-app profile privacy settings, send a deletion request via cossyvita.com/en/delete-account.html, or write to destek@cossyvita.com.
When a deletion request is processed, your authentication record is removed and the account is marked deleted. Extra cleanup may be needed to fully destroy application data (analyses, media, routines); in that case our support team completes your request.
13. Cookies and website technologies
cossyvita.com is a marketing site. We do not use Google Analytics, Meta Pixel, or advertising tracking pixels.
Fonts may be loaded via Google Fonts for the site’s appearance; your browser may send technical data (for example IP) with that request. We do not place non-essential analytics or marketing cookies. You can manage your browser cookie settings at any time.
14. Data security
We use encryption in transit (HTTPS), access controls, and monitoring. Only authorized systems needed to provide the service access photos and analysis data. No system is 100% risk-free; tell us if something looks suspicious.
15. Your rights
To the extent applicable under KVKK Art. 11, you have the right to:
- Learn whether your personal data is processed
- Request information if it is processed
- Learn the purpose of processing and whether it is used in line with that purpose
- Know third parties to whom it is transferred in Turkey or abroad
- Request correction if it is incomplete or inaccurate
- Request erasure or destruction under the conditions in KVKK
- Request that correction / erasure be notified to third parties to whom the data was transferred
- Request restriction of processing and object to processing
- Request data portability under the conditions in the law
- Withdraw consent where processing is based on explicit consent
- Lodge a complaint with the Personal Data Protection Board
For requests: destek@cossyvita.com. We may need to verify your identity. Applications are answered within the timeframes in KVKK and related communiqués.
16. Children’s privacy
The service is not directed at children under 16. We do not knowingly collect data from that age group.
17. Policy changes
We may update this policy. For material changes we notify you in-app or by email. The current version is always at cossyvita.com/privacy.html (Turkish) and cossyvita.com/en/privacy.html (English).
18. Contact
For privacy and KVKK requests: destek@cossyvita.com