Privacy Policy

1. Who controls your data

Seamly — the website at seamly.art, the editor at canvas.seamly.art and the Seamly apps for iPhone and Android — is operated by EBSM OZEL SAGLIK HIZMETLERI BILGISAYAR YAZILIM BILISIM SANAYI VE TICARET LIMITED SIRKETI, a limited liability company registered in Türkiye (“Seamly”, “we”, “us”). We are the data controller for the personal data described here, including as the veri sorumlusu under Türkiye’s Law No. 6698 on the Protection of Personal Data (KVKK) and, where it applies, the EU and UK General Data Protection Regulation. Privacy questions and requests: support@seamly.art.

2. Data we collect

We collect only what is needed to provide and protect Seamly:

• Account data: email address, display name, the identifier from Google or Apple if you sign in with them, a securely hashed password if you sign in with email and password, authentication records and account settings.
• Your content: projects, media, templates and brand assets you choose to create, upload, sync, publish or share. Projects created without cloud sync stay on your device.
• Purchases: your plan, purchase and subscription status, and entitlement records. Web payments are handled by Paddle.com as Merchant of Record, App Store payments by Apple and Google Play payments by Google; Seamly never receives your full card details.
• Referrals: referral codes you share or redeem and the rewards they earn.
• Ambassador applications: the Instagram or TikTok username you apply with, the country you choose on the ambassador page, your browser’s or app’s identifier, version and language, and your account if you are signed in. We use them only to contact you about the ambassador program.
• Service data: IP address, device and browser information, request identifiers, security events, diagnostic logs and crash reports from the iPhone and Android apps.
• Product analytics: pseudonymous events about screens, features, template searches and outcomes, as described in section 7.
• Advertising data (web only, with your consent): ad click identifiers, advertising cookies and, for TikTok, a hashed copy of your email address, as described in sections 4 and 7.
• Ad measurement in the Android app (outside Europe): app opens and your first export, with a random app instance identifier and Google Play’s record of the ad you installed from, as described in section 4.
• Communications: feedback and messages you send to us.

3. Why we use data

We process data to perform our contract with you (accounts, editing, sync, sharing, purchases and support), to meet legal obligations (tax, accounting, fraud prevention and lawful requests), and for our legitimate interests in securing, understanding and improving the service. On the web, optional product analytics, ad conversion measurement (Google Ads and TikTok) and TikTok advertising audiences run only with your consent. In the iPhone and Android apps, pseudonymous product analytics is on by default on the basis of our legitimate interest in learning which features work; you can object at any time by emailing us. Outside the EEA, the UK and Switzerland, the Android app also tells Google Ads, through Google Analytics for Firebase, when an install from one of our ads is opened and finishes a first export, on the same basis, so we pay for ads that bring people who actually use Seamly; objecting stops this too.

4. Sharing and service providers

We share data only with providers that help us run Seamly, under contracts that limit their use of it:

• Paddle.com, our reseller and Merchant of Record for web purchases, receives your email, country, order and payment details to process payments, taxes, invoices, refunds and fraud checks. Paddle handles that data as an independent controller under its own privacy notice.
• Apple processes App Store purchases and Google processes Google Play purchases. Google and Apple also process sign-in when you choose them.
• Adapty manages in-app purchases and subscription status in the iPhone and Android apps, using a random app identifier and the store’s purchase records, so Seamly Pro unlocks on your device. In the Android app, Adapty also records the install: when you installed Seamly from one of our ads, it uses Google Play’s install referrer to tell which ad it was.
• Hosting, database and storage providers (such as Render and Cloudflare R2) store and serve the service, your synced content and backups.
• Email delivery providers send sign-in codes, receipts and service messages.
• PostHog processes pseudonymous product analytics in its EU cloud.
• Firebase Crashlytics (Google) receives crash reports from the iPhone and Android apps: what the app was doing when it stopped, the app and system version, the device model and a random installation identifier. Reports are not linked to your account and are used only to find and fix crashes.
• Google Analytics for Firebase (Google), in the Android app only and only outside the EEA, the UK and Switzerland, receives Firebase’s automatic app events (the first open, sessions, time in the app and app updates) and one event of ours, your first export, with a random app instance identifier, the app and system version, the device model, a rough location from your IP address and Google Play’s install referrer, which names the ad you installed from. Google Ads uses them to tell which of our ads led to people actually using Seamly. It receives no advertising identifier and never your projects, name or email, and we don’t use it for remarketing or personalised ads.
• Cloudflare Web Analytics counts page views and visits on our websites without cookies, browser storage or identifiers.
• Google Ads (Google), on seamly.art and the web editor only and only if you allow analytics, measures which of our ads led to a visit, a sign-up, a purchase or a tap on an App Store or Google Play link. Its tag sets cookies and receives the page address, the ad click identifier and, for a purchase, the amount and currency; never your projects, name or email. We don’t use it for remarketing or personalised ads.
• TikTok, on seamly.art and the web editor only and only if you allow analytics, measures which of our TikTok ads led to a visit, a sign-up, a checkout, a purchase or a tap on an App Store or Google Play link, and lets us show our ads on TikTok to people who visited our websites. Its pixel sets cookies and receives the page address, the ad click identifier, browser and device details, the pages you view and the buttons you tap, a hashed (SHA-256) copy of the email address you type into our sign-up or sign-in form, so TikTok can match these events to a TikTok account, and, for a purchase, the plan, amount and currency; never your projects or name. When you buy Seamly Pro on the web, our server also reports the purchase to TikTok with the same hashed email and TikTok’s click identifier and cookie, which we keep with your order at Paddle, so a free trial that becomes a paid subscription is counted too. If you installed the Android app from one of our TikTok ads, Adapty tells TikTok when that install starts a free trial or buys Seamly Pro. On iPhone, TikTok learns only what Apple’s SKAdNetwork reports: delayed, anonymous counts of installs from its ads and how far they got (a free trial or a purchase), with no identifier for you or your device. TikTok handles this data under its own privacy policy.

We may also disclose data when legally required, to protect people or the service, or as part of a merger, acquisition or reorganisation. We do not sell personal data. Apart from the ad measurement on the web and in the Android app and the TikTok advertising on the web described above, we do not use it for advertising. Turning analytics off in the cookie notice or in Settings stops both.

5. International transfers

Some providers process data outside Türkiye or outside the European Economic Area, for example in the European Union and the United States. Where the law requires it, we rely on adequacy decisions, standard contractual clauses or another lawful transfer mechanism under KVKK Article 9 and the GDPR, and apply appropriate safeguards.

6. Retention

We keep account and cloud-project data while your account is active. Product analytics events are kept for up to 12 months, then deleted or aggregated without account or device identifiers. Crash reports are kept for up to 90 days. Ambassador applications are kept while the program runs, or until you ask us to remove yours. Purchase and invoice records are kept for as long as tax and commercial law requires, which in Türkiye can be up to 10 years. When you delete your account, we also request deletion of account-linked analytics and delete or de-identify other personal data unless a limited record must be kept for security, disputes, tax, accounting or legal compliance. Operational backups expire on their normal rotation. Local projects stay on your device until you remove them or clear site data.

7. Cookies, browser storage and analytics

The Seamly apps use no advertising cookies or advertising identifiers; the Android app’s Google Ads measurement (section 4) uses a random app instance identifier instead. On the web, product analytics (PostHog) and advertising tags (Google Ads and TikTok) stay off unless you allow them in the cookie notice, and you can change your choice in Settings; turning them off removes their cookies. One exception: on canvas.seamly.art/get, the page our phone ads lead to, they are on by default for visitors outside the EEA, the UK and Switzerland (we go by your browser’s time zone) until you turn them off with Privacy choices on that page or in Settings. Visitors in Europe are asked first there too. Separately, Cloudflare Web Analytics counts page views and visits for every visitor; it sets no cookies, stores nothing in your browser and does not identify you. We use essential, user-requested and consented storage as follows:

Analytics events describe screens, features and outcomes using random or opaque identifiers. They exclude project content, media, contact details, raw URLs and raw error messages. When you open a template from a search in the Templates tab, the event also carries the words you searched for, so we can make search find what people look for; they are kept like other analytics events. Events from the iPhone and Android apps also carry the device model and the languages your device and the app are set to.

When you arrive from one of our ads or a tagged link, its campaign tags go with the analytics events above, if you allow them, and with a web purchase’s order at Paddle, so we can tell which ads work. A link without tags counts for the site it was on, such as a search engine or an AI assistant. They name the ad or site, not you. If you allow analytics, Google Ads and TikTok also see them as part of the page address.

8. Your rights

Depending on where you live, you may have the right to learn whether we process your data, access it, correct it, delete it, restrict or object to processing, receive a portable copy, withdraw consent, and learn who we transfer it to — including the rights in KVKK Article 11. You can delete your account in Settings in the web editor or in the iPhone or Android app, or email support@seamly.art from the address connected to your account. We answer requests within 30 days. You may also complain to your local data protection authority; in Türkiye, this is the Personal Data Protection Authority.

9. Security

We use access controls, encryption in transit, signed short-lived access tokens, restricted infrastructure, rate limits and monitoring. No service can promise absolute security, so please use a protected device and tell us promptly if you suspect unauthorised access.

10. Children

Seamly is not directed to children under 16. If you believe a child has provided personal data without appropriate permission, contact us so we can investigate and remove it.

11. Changes

We may update this policy as Seamly changes. We will post the new date here and give prominent notice when a change materially affects your rights.