Privacy Policy

Who we are

Garmo ("Garmo", "we", "us") is an AI fashion photography service based in Türkiye. For the purposes of KVKK, Garmo is the data controller for the personal data described in this policy.

For any privacy question or request, write to support@garmo.studio.

Data we collect

Account data

• Your name and email address.
• Your password, stored only as a one-way hash. We cannot see it.
• If you sign in with Google: your Google account ID, name, email address and profile picture.
• Whether you have confirmed your email address, and the one-time codes we send for that and for password resets (stored only as hashes).

Content you create

• Product photos you upload.
• Reference photos for custom models and scenes, and the names, descriptions and settings you give them.
• The images Garmo generates for you, your favourites and your shoot history.

Billing data

• Your credit balance and a history of credits added and spent.
• Records of the credit packs you buy and any refunds. Payments are handled by our payment provider; we never receive or store your full card details.

Technical data

• IP address, browser user agent and the time of each sign-in.
• Failed sign-in attempts, used to protect accounts from password guessing.
• Visit records for our site and Studio: the pages you open, the site or campaign link that sent you, your browser's time zone (which tells us your country), language, device and browser, and steps such as opening our plans or starting a checkout. A random code in a cookie (garmo_vid) recognises your browser when you come back. When you sign in, these records are linked to your account, including visits made before you signed up and while signed out. We do not store your IP address in them.

How we use it

We process personal data only for the purposes below, on the legal grounds set out in Article 5 of KVKK.

• To provide the service — creating your account, signing you in, generating images, keeping your library and history. Ground: performance of our contract with you.
• To handle payments and credits — selling credit packs, granting credits, processing refunds. Ground: performance of contract and our legal obligations (tax and accounting).
• To send service emails — verification codes, password resets and important notices about your account. We do not send marketing email without your consent.
• To keep Garmo secure — preventing fraud, abuse of free credits and unauthorised access. Ground: our legitimate interest, without harming your fundamental rights.
• To understand our audience and improve Garmo — counting visits, seeing where they come from, which pages people read and how they find their way to Studio and to a plan. This uses our own first-party cookies and no third-party service. Ground: our legitimate interest.
• To comply with the law — answering lawful requests from authorities. Ground: legal obligation.

Your photos

Images are generated by our custom AI models. To create an image, the photos and settings for that shoot are sent to the cloud computing infrastructure that runs these models, processed, and the result is stored in your account.

If you upload photos of a person (for example as a custom model), you must have that person's permission to do so. Studio asks you to confirm this before a custom model is created.

When you delete a product photo, model or scene, it is removed from your library. When you delete your account, all of your uploads and generated images are deleted.

Who we share it with

We do not sell your personal data and we do not share it for advertising. We share it only with service providers who help us run Garmo, and only what each one needs:

• Google — if you choose "Continue with Google", to sign you in.
• Resend — to deliver our emails (your email address and the message content).
• Dodo Payments — our payment provider and merchant of record, which processes payments, invoices, taxes and refunds. Dodo Payments' own privacy policy applies to the data you give it at checkout.
• Cloud AI infrastructure — to run our custom models on the photos and settings of each shoot.

We may also disclose data when required by law or by a court or authority order.

Transfers abroad

Some of the providers above are located or store data outside Türkiye. Where personal data is transferred abroad, we do so in line with Article 9 of KVKK, relying on appropriate safeguards such as standard contracts, or on the transfer being necessary to perform our contract with you.

How long we keep it

• Account data, uploads and generated images — for as long as your account is open. They are deleted when you delete your account.
• Payment, invoice and credit records — for as long as Turkish tax and commercial law requires, even after the account is deleted.
• Sign-in records and one-time codes — for a limited period, for security.
• Anonymous visit counts from before November 2026 — kept as statistics. They cannot be linked back to you.
• Visit records — for up to 13 months. Those linked to your account while you were signed in are deleted with the account, and the rest are no longer linked to you.

To delete your account, write to support@garmo.studio from the email address on the account.

Cookies

Garmo uses two cookies needed for the service: one keeps you signed in to Studio, and one remembers the language you use Garmo in. Your light or dark theme choice is saved in your browser's local storage.

For our own statistics we also use first-party cookies: a random visitor code that recognises your browser for up to a year (garmo_vid), the site or campaign link that brought you and your time zone (garmo_ref and garmo_tz, 30 days), and the page and button you signed up from (garmo_entry, 30 days). They are read only by Garmo. We do not use advertising or third-party tracking cookies.

Security

We protect your data with encrypted connections (HTTPS), hashed passwords and codes, limits on sign-in and code attempts, and access controls on our systems. No system is perfectly secure, so please use a strong, unique password.

Your rights

Under Article 11 of KVKK you have the right to:

• learn whether your personal data is processed, and request information about it;
• learn the purpose of the processing and whether it is used for that purpose;
• know the third parties, in Türkiye or abroad, to whom it is transferred;
• ask for incomplete or inaccurate data to be corrected;
• ask for your data to be deleted or destroyed, and for the third parties it was shared with to be told about the correction or deletion;
• object to a result against you that arises only from automated analysis of your data;
• claim compensation for damage caused by unlawful processing.

Send your request to support@garmo.studio. We will answer within 30 days at the latest. If you are not satisfied with our answer, you may complain to the Personal Data Protection Authority (KVKK Kurumu).

Children

Garmo is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.

Changes to this policy

We may update this policy from time to time. The date at the top shows the latest version. If a change is significant, we will tell you by email or in Studio before it takes effect.