1. Contact and scope
Fable Phase · Esentepe Mah. Dede Korkut Sok. Ferrigo Şişli / İstanbul · support@fablephase.com
This notice covers visitors, account holders and people using the relevant services. The service provider and data controller is the individual FA PH. Fable Phase is a brand and service name, not a separate company or legal entity.
2. Browsing this site
Pages and some examples are served through Cloudflare. IP addresses, request time, requested address and browser/network information can be processed for delivery and security. Some permitted catalog previews may load from external media/CDN servers and disclose similar request information to those servers. The preview player does not send your private uploaded references for generation.
Language, display choices, saved inspiration and draft text/settings may be stored in your browser. Draft text may contain personal information and can be visible to others using the same browser. Data preferences allow supported local export and measurement choices; this is not a complete export of server account data.
3. Customer service information
Registration/sign-in process name, email, password hash, verification, session and security information. Enabling two-factor authentication also processes information needed for it. Passwords are not stored in readable form. Account email delivery sends the recipient address, message and action link to the email service.
Generation uses prompts, selected references, settings, output and credit movements. Payments use orders, amounts, currency and transaction/membership identifiers; the payment service collects card details. Support uses your message and relevant transaction information. A gift recipient’s email is personal data and requires an appropriate basis to share.
The KVKK Notice maps data to purposes and legal grounds. Share only what the relevant service needs.
4. Visibility and access
Private files are not automatically part of the public gallery. Community sharing is a separate choice for the selected output and prompt. Authorized support/security review follows least-necessary access and accountability. A third party’s request alone does not authorize access to private files.
A lawful request from a competent authority is evaluated for authority and scope and answered with necessary information only. Security measures do not provide an absolute guarantee.
5. Recipients and international processing
Not every recipient receives all data. Disclosure is limited to the relevant task. Private references are not automatically public; generation services receive time-limited file access links.
| Recipient / service | Information and purpose |
|---|---|
| Cloudflare · hosting, D1, Turnstile and storage | Site requests, account/session and security data; files when upload/generation is used. Hosting, bot protection, storage and secure access. |
| Resend · transactional email | Recipient address, verification/reset message and action link. Delivering account messages. |
| Google Workspace · support mailbox | Contact information, correspondence and attachments you send. Handling support and rights requests. |
| AI infrastructure for the selected generation | Prompts, necessary references and settings. Performing the requested image/video/audio task. |
| Whop · payments and subscriptions | Order/product information and transaction-matching identifiers. Matching payments to entitlements. The payment service collects card details; Fable Phase does not store card numbers/CVV. |
| External preview media servers | IP and browser/network data needed to display catalogue files. This does not send your private references. |
| Competent authorities and necessary legal advisers | Limited information for a valid demand or specific dispute. Meeting legal duties and protecting rights. |
5.1. International transfers
Cloudflare, Resend and Google Workspace provide website hosting, account emails and support. Generation or payment also sends the relevant prompts, files and transaction information to the selected generation infrastructure or Whop. These services may involve storage outside Türkiye or access from another country.
The EU region was selected for account databases; this does not mean every file and service stays solely in the EU. The complete recipient/subprocessor country list and applicable transfer safeguards have not yet been verified. This notice does not claim that transfer agreements have been signed or required notifications made.
Routine transfers separately require a lawful mechanism under Article 9 of KVKK. The separate registration checkbox records only that you read this information; it is neither transfer consent nor approval replacing missing legal safeguards.
6. Retention and deletion
The initial retention period for customer uploads and generated outputs in the new production environment is 30 days. Upload retention starts when the upload process begins; ordinary output retention starts when the server accepts the generation request; scheduled credit-free output retention starts when generation is dispatched from its queue. The library shows each file’s actual expiry. Download important files before that date; permanent archiving is not promised.
This initial policy does not change the recorded expiry of historical or test-environment files. Expired files become unavailable for download and enter automatic deletion. Deletion is recorded after storage completion is verified; expiry does not mean that every provider copy disappears at the same moment.
Account, security, payment and dispute records are separate from customer media and are retained only for necessary purposes and applicable legal obligations. AI-provider copies and backups have separate retention assessments; this 30-day file policy does not guarantee deletion of every such copy.
Local drafts can remain in the browser until cleared or their application retention rule runs. Clearing browser data does not automatically delete information already sent to a server. Limited records retained for legal obligations or disputes are identified separately.
7. Choices and consent
Necessary session/security functions are distinct from optional measurement. Where consent is required, no choice is preselected, refusal does not block the basic service and choices can be changed. Use Data preferences to manage the current measurement choice.
Registration, purchase, support requests and terms acceptance are not marketing consent. Any future marketing channel requires a separate purpose, sender and opt-out notice. This acceptance flow currently collects no marketing consent.
8. Requests and rights
Article 11 includes rights to information, correction and, where conditions apply, erasure/destruction and notification to recipients, objection to adverse results from solely automated analysis, and compensation for unlawful processing.
Send a request from your registered email to support@fablephase.com or to the contact address above through legally valid methods. Explain the subject and connection to your account. Only necessary identity checks are requested; do not include identity documents, passwords or unnecessary sensitive information in your initial message.
Requests are answered as soon as possible and within 30 days. They are generally free; where an additional cost is legally chargeable, only the statutory tariff may apply. Statutory rights to complain to the Board and seek judicial remedies remain available.