1. Scope and contact
Fable Phase · Esentepe Mah. Dede Korkut Sok. Ferrigo Şişli / İstanbul · support@fablephase.com
This notice covers visitors, account holders and people using the relevant services. The service provider and data controller is the individual FA PH. Fable Phase is a brand and service name, not a separate company or legal entity.
2. Data, purposes and legal grounds
Data is collected electronically through visits, registration/sign-in forms, uploads, generation requests, payment notifications and support correspondence. Generation, payment and sharing entries apply when you perform those actions. Article references are to Turkish Law No. 6698.
| Activity and data | Purpose | Legal ground |
|---|---|---|
| Account: name, email, password hash, verification/session and optional two-factor information. | Creating, authenticating and protecting your account. | Necessary contract formation/performance (Art.5(2)(c)). |
| Security: IP, browser/device data, request time, bot checks and limited event records. | Delivering the service and preventing abuse or unauthorized access. | Necessary legitimate interests without harming fundamental rights (Art.5(2)(f)). |
| Generation: prompts, selected images/video/audio, settings, output, job and credit records. | Fulfilling your request, delivering results and accounting for use. | Contract performance (Art.5(2)(c)); protecting rights for dispute evidence (Art.5(2)(e)). |
| Payments: order, amount, currency, transaction/membership identifiers, refunds and disputes. | Fulfilling purchases, reconciliation, mandatory records and disputes. | Contract performance (Art.5(2)(c)); applicable legal duties (Art.5(2)(ç)); protecting rights (Art.5(2)(e)). |
| Support: contact information, subject, messages and relevant transaction data. | Responding, investigating issues and handling rights requests. | Service support (Art.5(2)(c)); duties for data rights requests (Art.5(2)(ç)); protecting rights (Art.5(2)(e)). |
| Sharing: selected output, display name and chosen prompt. | Publishing the community contribution you request. | Requested service performance (Art.5(2)(c)). A private upload alone does not request publication. |
| Optional analytics: page/event and random session identifiers. | Measuring use and improving the service. | Separate, withdrawable consent in Data preferences (Art.5(1)); not a registration requirement. |
3. Recipients and purposes
Not every recipient receives all data. Disclosure is limited to the relevant task. Private references are not automatically public; generation services receive time-limited file access links.
| Recipient / service | Information and purpose |
|---|---|
| Cloudflare · hosting, D1, Turnstile and storage | Site requests, account/session and security data; files when upload/generation is used. Hosting, bot protection, storage and secure access. |
| Resend · transactional email | Recipient address, verification/reset message and action link. Delivering account messages. |
| Google Workspace · support mailbox | Contact information, correspondence and attachments you send. Handling support and rights requests. |
| AI infrastructure for the selected generation | Prompts, necessary references and settings. Performing the requested image/video/audio task. |
| Whop · payments and subscriptions | Order/product information and transaction-matching identifiers. Matching payments to entitlements. The payment service collects card details; Fable Phase does not store card numbers/CVV. |
| External preview media servers | IP and browser/network data needed to display catalogue files. This does not send your private references. |
| Competent authorities and necessary legal advisers | Limited information for a valid demand or specific dispute. Meeting legal duties and protecting rights. |
4. International transfers
Cloudflare, Resend and Google Workspace provide website hosting, account emails and support. Generation or payment also sends the relevant prompts, files and transaction information to the selected generation infrastructure or Whop. These services may involve storage outside Türkiye or access from another country.
The EU region was selected for account databases; this does not mean every file and service stays solely in the EU. The complete recipient/subprocessor country list and applicable transfer safeguards have not yet been verified. This notice does not claim that transfer agreements have been signed or required notifications made.
Routine transfers separately require a lawful mechanism under Article 9 of KVKK. The separate registration checkbox records only that you read this information; it is neither transfer consent nor approval replacing missing legal safeguards.
5. Retention and deletion
New production uploads and outputs have a 30-day retention period, with expiry shown in the library. Its start depends on file type as explained in the Privacy Policy. Expiry blocks access and starts verified deletion. It does not guarantee simultaneous deletion of external generation-provider copies or all backups.
Account/session, security, support, payment and legal records are separate from media. They must be limited to the period necessary for their purpose, applicable retention duties or a specific dispute. A verified complete deletion schedule for all categories has not yet been published. Closure/deletion requests are reviewed through the contact channel; automatic complete account deletion is not available.
Clearing local drafts does not erase previously submitted server data. Credit-pack expiry does not erase account, transaction or legally required records.
6. Choices and sensitive content
Registration has three separate, unchecked boxes: Terms acceptance, acknowledgement of the KVKK notice, and acknowledgement of the international data transfer notice. The presented version, language, time and document record are retained. Acknowledgement boxes do not provide consent.
Manage optional analytics in Data preferences. Verification and password-reset emails do not subscribe you to advertising; creating an account does not grant marketing permission.
You must have the necessary authority and legal basis for other people’s images, voices or data. Do not upload unnecessary health information, identity documents or other sensitive data. Special-category processing requires a separate Article 6 assessment; general contract acceptance is insufficient. Uploading a photograph does not by itself mean biometric identification is performed.
7. Your rights and requests
Article 11 includes rights to information, correction and, where conditions apply, erasure/destruction and notification to recipients, objection to adverse results from solely automated analysis, and compensation for unlawful processing.
Send a request from your registered email to support@fablephase.com or to the contact address above through legally valid methods. Explain the subject and connection to your account. Only necessary identity checks are requested; do not include identity documents, passwords or unnecessary sensitive information in your initial message.
Requests are answered as soon as possible and within 30 days. They are generally free; where an additional cost is legally chargeable, only the statutory tariff may apply. Statutory rights to complain to the Board and seek judicial remedies remain available.