Privacy Policy

Mathome Yazılım Eğitim Danışmanlık Sanayi ve Ticaret Limited Şirketi (Gebze OSB Mah. Kemal Nehrozoglu Cad. No: 507/9 İç Kapı No: Z01, Gebze / Kocaeli, Türkiye) operates Zivdeo and is the controller of the personal data described in this policy. You can reach us about privacy at support@zivdeo.com.

Our customers are businesses and, for the personal catalogue (“For me”), individuals. When a business uploads photos or other content that shows or concerns other people (for example staff, clients or visitors), the business is the controller of that content and we process it on its behalf under our Data Processing Addendum. If you are one of those people, please contact the business that used your image; we will help it respond. When an individual uploads photos for a personal edit, we process them only to produce the edit the person asked for: we do not build face databases, do not identify people across photos, and do not use personal photos to train models.

• Account data. When you sign in with Google, Google shares your name, email address and profile picture with us. When you sign in with Apple, Apple shares your name and an email address, which may be a private relay address Apple forwards to you. Our authentication provider keeps them with your sign-in record; our database stores your email address, an account identifier, your role and your settings (such as favourite use-cases and default quality tier).
• Business and brand data. Your workspace name and the brands you save: logo, colours, phone number, email, address, website and social handle. These are usually business details but can identify a person.
• Content. The photos and facts you submit (“Inputs”), the images we produce (“Outputs”), and the record of each generation: its inputs, the creative plan, prompts, automated review results and status. In our dealer app, the vehicles you add: VIN, title, year, make, model, trim, body style, colour, stock number, price and mileage.
• Capture data. When a business photographs a vehicle with our capture tools (our capture SDK inside its app, or our app), the photos are Inputs. We remove EXIF and location metadata from them on our servers before we store them. With each photo we keep a capture record: device model, operating system, lens, capture time and timings, camera tilt (pitch and roll), the values of the on-device photo checks, whether a vehicle was detected in the frame and how confident the detection was, how far the phone moved between photos, a rough outline of the vehicle computed on the phone, the camera’s field of view and estimated height, the horizon angle, a light-direction estimate, and a candidate plate area, camera settings at the shutter (zoom, exposure, how the shutter fired, the phone’s thermal state), the retake count and the reason a shot was skipped, plus the capturing user’s identifier as the business’s own system gives it to us. The capture record never contains a location or an image. With a photo the app may also send a black-and-white mask image of the vehicle’s outline, stored with that photo and deleted with it.
• Billing data. Your balance, top-ups and the charge for each generation. Payments are processed by Dodo Payments, which sends us the order details (such as name, email, country, amount and tax) but never your full card details.
• API and integration data. API keys (we store only a one-way hash and a short prefix), webhook URLs, webhook secrets and any metadata you attach to requests.
• Technical data. Server logs with IP address, browser or client type, requested URL, timestamps and errors, used to run and secure the Service.
• Support. What you write to us and our replies.

• To provide the Service: run generations, keep your library, revisions and balance, deliver webhooks, answer support. Basis: performance of our contract with you.
• To secure the Service and prevent abuse and fraud, including automated screening of content against our Acceptable Use Policy. Basis: our legitimate interests in a safe service.
• To improve quality: our team reviews generation records and may re-run them internally to compare models, fix errors and improve our use-cases. Results stay internal. Basis: our legitimate interest in a better service.
• To keep accounting and tax records and meet legal obligations. Basis: legal obligation.
• To show Outputs publicly in our showroom or marketing, only when you opt in for that generation. Basis: your consent, which you can withdraw at any time.
• To tell you about important changes to the Service or these policies. Basis: contract and legitimate interests.

We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not use your Inputs or Outputs to train AI models. We do not make decisions about individuals that have legal or similarly significant effects based solely on automated processing.

We share personal data only with:

• Service providers that process it for us under contract: cloud hosting, database, file storage and authentication; AI model and inference providers that render and edit images; large language model providers that plan and review generations; and email delivery. They may use it only to provide their services to us. We send AI providers only what a generation needs, and where a provider lets us switch off retention of request data, we do. A current list of our providers is available on request.
• Dodo Payments, our online reseller and Merchant of Record, which processes your payments as an independent controller under its own privacy policy.
• The US National Highway Traffic Safety Administration (NHTSA): when you look up a VIN, we send only the VIN to its public vehicle database to decode it, and keep its answer for 90 days.
• Recipients you choose, such as the webhook endpoints you configure.
• Authorities, courts and advisers where the law requires it or to establish, exercise or defend legal claims.
• A successor in a merger, acquisition or sale of assets, subject to this policy.

Your uploads and Outputs are served through long, unguessable links so that you, your tools and your webhook endpoints can open them without signing in. Anyone who has such a link can open that file, so treat links like the files themselves and share them only with people you trust.

We are based in Türkiye and our service providers process data in the United States and other countries. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we use the European Commission’s Standard Contractual Clauses (and the UK and Swiss equivalents) or another lawful transfer mechanism, together with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.

• Account, brand and content data (Inputs, Outputs and generation records): for as long as your account is open. You can ask us to delete specific content earlier.
• Capture photos are Inputs and are kept the same way, with their capture records. Uploads that are never finished are deleted 7 days after their last data arrived.
• You can delete your account yourself, in the Zivdeo app (Account, then Delete account) or on the web (Account page). Your sign-in record and user data are deleted at once. When you are the last member of your workspace, the workspace is closed at once (its API keys and saved card go with it) and its content (generations, uploads, outputs, brands, vehicles, dealers and capture sessions) is deleted shortly after. Workspaces connected to other systems (API keys, dealers of a platform) or with an open payment dispute are closed by our support team on request; while pieces are still being made, deletion waits until they finish. We keep the ledger and balance records for billing (see below) and the deleted account's internal identifiers for two days, so an earlier sign-in cannot reopen it.
• Anything not deleted at once (copies made while processing a piece, and accounts closed another way or on request): within 30 days. Residual copies in backups and logs are overwritten within a further 90 days.
• Server logs: up to 30 days, longer only when needed to investigate a security incident.
• Billing and ledger records: for as long as commercial and tax law requires, currently up to 10 years.
• Support correspondence: up to 3 years after the conversation ends.
• Copies our providers make while processing a request are kept only as long as their terms with us allow.

We encrypt data in transit, restrict access to the people and systems that need it, store API keys only as hashes, sign our webhooks, and use providers with mature security programmes. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as the law requires.

Depending on where you live, you may have the right to access, correct, delete or receive a portable copy of your personal data, to object to or restrict our processing, and to withdraw consent at any time (this does not affect processing before the withdrawal). Residents of US states with privacy laws may also have the right to know what we collect and to opt out of sale or sharing; we do neither. We will not treat you differently for exercising your rights.

To exercise a right, email support@zivdeo.com from the address on your account. We may need to verify your identity, and we answer within the time the law sets (usually one month). If you are in the EEA, the UK or Switzerland, you can also complain to your local data protection authority.

We use only storage that the Service needs to work:

• your sign-in session, kept by our authentication provider in your browser's storage;
• preferences such as your default quality tier and the brand you picked last, kept in your browser's local storage.

We do not use analytics, advertising or tracking cookies. If we ever add them, we will update this policy and ask for your consent where the law requires.

Zivdeo is a business service and is not directed to anyone under 18. We do not knowingly collect personal data from children.

We may update this policy. We will post the new version here with a new date and, for material changes, tell account holders by email or in the product before they take effect.