This notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, to explain how your personal data is processed when you use the Virtual Hair Studio. In case of any discrepancy, the Turkish version prevails.
1. DATA CONTROLLER
TEO Güzellik Merkezi — Mall of İstanbul, Floor B1, Çınar Entrance / Car Park P1, Başakşehir / İstanbul, Türkiye · info@teoguzellikmerkezi.com · +90 212 801 13 00
2. PERSONAL DATA PROCESSED
- Visual data: the photo you upload (an image of your face and hair) and the image generated from it.
- Transaction data: the hairstyle you choose.
- Security data: a one-way hash (SHA-256) of your internet connection's IP address combined with the date, and a daily try counter linked to that hash. The IP address itself is not recorded.
We do not ask for your name, phone number, e-mail or any other identity or contact details. No facial template is extracted from your photo, and it is not subjected to face recognition, identity verification or any biometric processing aimed at uniquely identifying you. Even so, because the photo contains an image of your face, it is processed only with your explicit consent and the adequate measures required by the Personal Data Protection Board for special categories of data are applied.
3. METHOD OF COLLECTION AND LEGAL GROUNDS
Data is collected electronically, by automated means, when you upload your photo on this page yourself.
- Processing of your photo and the generated image: your explicit consent (KVKK Art. 5/1; Art. 6/2 if the photo is deemed special-category data).
- Transfer of your photo abroad: your explicit consent (KVKK Art. 9), given after being informed of the possible risks described in section 5.
- IP hash and try counter: our legitimate interest in securing the service and preventing misuse (KVKK Art. 5/2-f).
4. PURPOSES
- Creating and showing you an AI-generated visual simulation of the chosen hairstyle on your photo,
- Preventing misuse of the service, applying the daily try limit and ensuring information security.
Your data is not used for marketing, profiling or advertising.
5. TRANSFERS, INCLUDING ABROAD
Abroad: Your photo is transferred, solely to generate the image, to the Gemini API service of Google LLC (United States of America), acting as data processor. Google's servers may be located in the USA and other countries. Under its paid service terms, Google does not use your photo or the result to improve its products or train AI models; it may keep logs for a limited period only to detect misuse and meet legal obligations.
Possible risks: There is no adequacy decision of the Board for the countries of transfer. The level of data protection there may differ from Türkiye; authorities may be able to access data under local law; and it may be harder for you to exercise your rights directly against the processor abroad. To mitigate these risks, the photo is sent over an encrypted (TLS) connection, is not linked to your identity and is not stored by us.
Within Türkiye: Our website runs on the servers of our hosting provider in Türkiye; the photo is held there only in memory during processing and is never written to disk. Your data is not shared with any other third party.
If you tap "Get this look at TEO", WhatsApp opens with a draft message containing only the name of the chosen style; your photo is not attached. If you send the message, WhatsApp's own terms apply.
6. RETENTION AND DELETION
- Your photo and the generated image are not stored on our server and are not written to log files; they are deleted from server memory once the process is complete (usually 10–20 seconds).
- The result is shown only in your own browser and disappears when you close the page.
- The IP hash and try counter are kept for at most 2 days and then deleted automatically.
7. SECURITY MEASURES
All communication is TLS-encrypted; the access key for the AI service is kept only on the server and closed to outside access; uploaded files are checked to be real photos and size-limited; requests are accepted only from our website; the number of tries is limited; neither the photo nor the result is permanently saved anywhere.
8. YOUR RIGHTS
Under KVKK Art. 11 you have the right to learn whether your personal data is processed and to request information about it; to learn the purpose of processing and whether data is used accordingly; to know the third parties to whom data is transferred in Türkiye or abroad; to request rectification of incomplete or inaccurate data; to request erasure or destruction; to request that these actions be notified to third parties to whom data was transferred; to object to a result against you arising exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing.
9. HOW TO APPLY
In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you can submit your request in writing to our address above, by registered e-mail (KEP), with a secure electronic or mobile signature, or from an e-mail address you have previously given us to info@teoguzellikmerkezi.com. Requests are concluded free of charge within 30 days at the latest; if the action involves an additional cost, the fee in the Board's tariff may be charged.
10. OTHER
If you are under 18, please do not use this service without the consent of your parent or guardian. Please upload only your own photo or that of a person who has explicitly allowed you to. Our general privacy notice: teoguzellikmerkezi.com/en/kvkk
Last updated: 1 October 2026
