Version 2026-08-25 · Last updated 25 August 2026
The data controller is İlhan Seyhan, an individual developer operating the GUFFLO mobile application.
| Contact | gufflo@seyilstudios.com |
|---|---|
| Postal address | Kemal Türkler Mahallesi, Sümer Caddesi, Sancaktepe / Istanbul, Türkiye |
| EU representative | The app is not currently offered in the European Union. When it becomes available to EU users, a representative under GDPR Art. 27 will be appointed and announced here. |
| Category | What it is | Why |
|---|---|---|
| Photographs containing faces | The selfies or photos you choose to upload | To generate the video you requested. Nothing else. |
| Generated videos | The output produced from your photos | To deliver the result to you |
| Account data | Email address; display name and language, if you set them | To sign you in and show the app in your language |
| Credit and purchase records | Credit balance, ledger entries, store transaction identifiers | To honour purchases and prevent double-charging |
| Job records | Which template you used, status, timestamps, error codes | To run the generation and support you if it fails |
| Consent records | Which confirmations you accepted and when | To evidence that consent was given |
| Reports you submit | Reason and optional description | To review content you flag |
| Processing | Legal basis | |
|---|---|---|
| Processing photographs containing faces | Explicit consent — GDPR Art. 9(2)(a); KVKK Art. 6(2). You may withdraw it at any time. | |
| Running your account and generating videos | Performance of a contract — GDPR Art. 6(1)(b) | |
| Purchase and credit records | Legal obligation and contract — GDPR Art. 6(1)(b)/(c) | |
| Moderation and abuse prevention | Legitimate interests — GDPR Art. 6(1)(f) |
| Data | Retention |
|---|---|
| Uploaded photographs | Deleted 24 hours after upload, automatically |
| Generated videos | Deleted 7 days after generation, automatically |
| Account, credit and purchase records | Until you delete your account; purchase records may be kept longer where tax or consumer law requires |
| Consent records | Kept as evidence of consent for as long as the account exists |
Deletion of media is permanent. Once the retention window passes, the file is removed from storage and cannot be recovered — including by us.
We do not sell your personal data, we do not share it for advertising, and we do not use your photographs or videos to train any AI model.
The following processors handle data on our behalf:
| Processor | Purpose | Data |
|---|---|---|
| Supabase | Database, file storage, authentication | All account data and media |
| Apple / Google | In-app purchases | Purchase events; we never see your payment details |
| RevenueCat | Purchase validation | Store transaction identifiers and your account identifier |
| Cloudflare | Scheduled deletion job and internal admin hosting | No user content; counts only |
| Google (Gemini / Veo API) and fal.ai (Kling) | Video generation | Your uploaded photographs |
Our infrastructure is hosted on Supabase in the ap-northeast-1 (Tokyo, Japan) region. If you are in the European Economic Area, the United Kingdom or Türkiye, your data may be transferred outside your region. Where that happens we rely on the European Commission's Standard Contractual Clauses, or on the equivalent mechanism required by your local law.
Wherever you live, you can:
To exercise any of these, email gufflo@seyilstudios.com. We respond within 30 days.
Facial images are special category data under GDPR Art. 9. We process them only on your explicit consent, only to produce the video you asked for, and we delete them within 24 hours. You may lodge a complaint with your national supervisory authority.
See our separate KVKK Aydınlatma Metni, which sets out your rights under Article 11 of Law No. 6698 and how to exercise them.
We do not sell or share personal information as those terms are defined by the California Consumer Privacy Act. Facial images are "sensitive personal information"; we use them solely to perform the service you requested and not to infer characteristics about you. California residents may request access, correction, deletion and portability, and will not be discriminated against for doing so.
Biometric identifiers. Where state biometric law applies — including the Illinois Biometric Information Privacy Act, the Texas CUBI Act and Washington's biometric statute — we obtain your consent before collecting any facial data, we use it only to generate your requested video, we never sell or otherwise profit from it, and we permanently destroy it within 24 hours of upload. That 24-hour window is our published retention schedule and destruction policy for the purposes of those laws.
GUFFLO is not intended for anyone under 16, and we do not knowingly collect data from children. If you believe a child has used the app, contact us and we will delete the account and its data.
Photographs and videos are stored in private buckets that are never publicly readable. Access is granted only through short-lived signed links issued to the signed-in owner. Database access is enforced by row-level security, so one account cannot read another's data. Payment credentials never reach us.
When we change this policy we update the version at the top of the page. If the change materially affects how we handle your face data, we will ask for your consent again inside the app before you can generate another video.