Privacy Policy

Car Z for Android · Effective date: 8 October 2026

This policy explains what personal data the Car Z app uses, why, who processes it for us, how long we keep it and what rights you have. It is also our information notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and Articles 13–14 of the EU General Data Protection Regulation ("GDPR").

1. Who we are

The data controller is VIBEPALM YAZILIM HİZMETLERİ ANONİM ŞİRKETİ ("VIBEPALM", "we", "us"), 1.1.C1 Blok İç Kapı No:Z01, No:143/8, Muallimköy Mahallesi, Deniz Caddesi, Bilişim Vadisi T.G.B. 1. Etap Sitesi, Gebze, Kocaeli 41400, Türkiye. Website: vibepalm.com. E-mail: business@vibepalm.com. App support: carzapp7@gmail.com.

We publish Car Z on Google Play under the developer name VIBEPALM.

2. Scope

This policy covers the Car Z Android app (package com.carz.vibepalm), distributed through Google Play, and this website. The website sets no cookies, runs no analytics and loads nothing from third parties. Our hosting provider (Netlify, Inc.) processes technical connection data, such as your IP address, to deliver the pages.

3. How your account works

• On first launch the app creates an anonymous account with Google Firebase Authentication. It is identified by a random User ID, which you can see and copy in Profile → User ID.
• The app has no sign-up. The Welcome screen has a small "Already have an account? Sign in" link that accepts an e-mail and password, but it only works for accounts that we create ourselves, for example the account Google Play uses to review the app. Normal users are never asked for an e-mail or password.
• Because the account is anonymous, we cannot identify you by name. To exercise your rights or contact support, give us your User ID or a Google Play order number (GPA.…).

4. Data we process

We collect data electronically through the app: some automatically when you use it, some from what you choose or type, and some from our service providers (for example Google Play and RevenueCat, for purchase status, and Adjust, for campaign attribution).

We do not collect: your name, phone number, contacts, your device's location (the app has no location permission), camera access, files other than the photos you pick, or payment card details. The app has no camera permission: you pick photos with Android's own photo picker, which gives the app only the photos you select. Only on Android 8 and 9 does the app ask for the storage permission, when you choose to save a result to your gallery or turn on automatic saving, and it uses it only to save that file. Newer Android versions need no permission for this.

5. AI processing of your photos

1. You pick a photo with the Android photo picker. On your phone the app re-encodes it as a JPEG, which removes embedded metadata such as GPS location. The app keeps up to 5 recently used photos on your device for 30 days so you can reuse them.
2. When you tap Generate, the photo and your options are sent over an encrypted connection to our server (Google Cloud Functions, United States). The app does not show a separate consent pop-up for this. Processing your photo is the service you request, and it starts only when you start a generation.
3. Our server builds the instruction (prompt) and sends the photo to Replicate, Inc., which runs the AI model. For photos this is normally Google's Gemini 2.5 Flash Image model. A few styles may use xAI's Grok Imagine model. For videos, Gemini first edits a frame from your photo, then a video model creates the clip: normally Kuaishou's Kling models, or xAI's Grok Imagine video model for some styles.
4. Our server does not save the photo you uploaded. It only keeps a fingerprint (hash) of it to detect repeated requests. Replicate deletes API inputs and outputs automatically after a short time (about one hour under Replicate's current policy).
5. We do save the results on Google Cloud Storage so the app can deliver them and so an interrupted or repeated request returns the same result without charging you twice. For how long, see section 9.
6. Results are shown only to you and stored in the Album on your phone. Nothing is published inside the app.

We do not use your photos or results to train AI models, for advertising, or to identify people. We do not create face templates or any other biometric data. Please upload only photos you have the right to use. If a photo shows another person, you need that person's permission.

6. Purposes and legal bases

We do not rely on your consent for any of the processing below. If we ever need consent for something new, we will ask for it separately in the app.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

7. Service providers and recipients

We share data only with the service providers below, and only as far as each one needs to do its job for us. They process it on our behalf under their contract and data-protection terms, except where the table says a provider acts under its own terms. We do not sell personal data. The only data we share for marketing is the attribution and ad-measurement data that goes to Adjust and, through Adjust, to Meta (see below).

We may also disclose data to courts, public prosecutors or other authorities when the law requires it, and to a successor if our business is transferred, under the same protections.

8. Transfers outside Türkiye

All of the providers above are located, or store data, outside Türkiye, mainly in the United States; Adjust is in the European Union (Germany). Data is therefore transferred abroad whenever you use the app. We make these transfers in line with Article 9 of KVKK and its secondary legislation, using appropriate safeguards such as the standard contracts set by the Personal Data Protection Authority where they apply, and otherwise the exceptional grounds the law allows, such as the transfer being necessary to perform the contract with you. For users in the EEA, transfers to the United States rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses.

9. How long we keep data

When a retention period ends, we delete or anonymise the data.

10. Account deletion

You can delete your account in the app at Profile → Delete Account, or ask us by e-mail. The full instructions are on car-z-app.netlify.app/delete-account.

What in-app deletion does

• Your Firebase sign-in account is deleted immediately. The old User ID can no longer be used, and its credits and Pro access are lost.
• Your account record on our server is marked as deleted, with the date.
• On your phone, the app clears its local data (settings, cache, recently used photos, the Album list) and starts over with a new, empty anonymous account.
• Our server then automatically deletes the data linked to the old User ID: the account record (except a minimal deletion marker), generated photos and videos (including edited video frames), video job records, device records, usage records, content reports and notification tokens. This normally happens within about an hour, and within a few hours at most. A second check runs at least an hour later and deletes anything that arrived after the first pass.

What is kept after deletion

We keep purchase and credit records (product, Google Play order number, credits, dates) only as long as Turkish tax and commercial-record laws require (up to 10 years), use them for nothing else, and then delete them. For the same period we keep a minimal deletion marker on the account record (the deletion date and the last credit balance) and a deletion receipt that shows the deletion was done: the old User ID, dates and how many items were deleted, with no other personal data. RevenueCat keeps its customer record until you ask us by e-mail to delete it. Crash data expires after 90 days and server logs after about 30 days. Google Play keeps its own records of your orders. On your phone, the files behind the Album stay in the app's private storage until you uninstall the app or clear its data, and copies saved to your gallery stay until you delete them. Adjust's data about your device is not linked to your account, so in-app deletion does not remove it; we ask Adjust to forget your device when you ask us by e-mail. Data that Meta has already received through Adjust is kept by Meta under its own data policy.

Deletion by e-mail

If you no longer have the app, or you also want the RevenueCat customer record and your Adjust data deleted, e-mail carzapp7@gmail.com with your User ID (copy it from Profile before you delete the account) or a Google Play order number. Within 30 days we delete the account, the same server data that in-app deletion removes, and the RevenueCat customer record, and we ask Adjust to forget your device. Only the records listed above stay, for the period stated. Crash data and server logs expire on their own schedule (90 and about 30 days).

Deleting your account does not cancel a Google Play subscription. Cancel it in Google Play subscriptions.

11. Your rights

Under KVKK (Article 11)

You have the right to:

• learn whether your personal data is processed, and request information about it if so;
• learn the purpose of the processing and whether the data is used for that purpose;
• know the third parties in Türkiye or abroad to whom it is transferred;
• ask for incomplete or inaccurate data to be corrected;
• ask for your data to be deleted or destroyed under the conditions in Article 7 of KVKK;
• ask for corrections, deletions or destruction to be notified to the third parties the data was transferred to;
• object to a result against you that arises solely from automated analysis of your data;
• claim compensation if you suffer damage because your data was processed unlawfully.

Under the GDPR (users in the EEA)

You have the rights of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests. You may also complain to the data-protection supervisory authority of the country where you live or work.

How to apply

Send your request in writing to our address above, or with a secure electronic or mobile signature, or from your e-mail address, to business@vibepalm.com. You may also send it to carzapp7@gmail.com. Include your User ID or Google Play order number so we can find your data. We may ask for more information to confirm the request comes from the account holder. We answer within 30 days, free of charge. If answering involves an extra cost, we may charge only the fee set in the tariff of the Personal Data Protection Board. If you are not satisfied with our answer, or we don't answer in time, you can complain to the Personal Data Protection Board (KVKK Kurulu) within 30 days of our answer, or within 60 days of your application.

12. Children

Car Z is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child under 16 has used the app, write to us and we will delete the related data. Users under 18, or under the age of digital consent in their country, should use the app only with the permission of a parent or guardian.

13. Security

All data between the app, our servers and our providers is encrypted in transit (HTTPS/TLS). Google Cloud encrypts stored data at rest by default. Every server request must come from a signed-in account and pass Firebase App Check (Google Play Integrity). Access to production data is limited to staff who need it. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

14. Notifications

The app sends one kind of notification: "your video is ready". It asks for notification permission the first time you start a video, never during onboarding. The app attaches a notification token to each video job even if you don't allow notifications; Android then simply doesn't show the message. We do not send marketing notifications. You can turn notifications off in Profile or in Android settings.

15. Advertising ID and what we don't do

Car Z shows no ads and contains no ad-network SDK. The app does have Android's advertising ID permission (AD_ID) so that Adjust can read your Google advertising ID. It is used only for install and campaign attribution, analytics and measuring our own ad campaigns (including on Meta), never to show you ads in the app. If your phone has no Google advertising ID at all (for example, a phone without Google Play services), Adjust uses the Android ID instead.

How to limit it

• On Android 12 and later, open Settings → Google → Ads (on some phones Settings → Privacy → Ads) and tap Delete advertising ID. Car Z and Adjust then receive only a string of zeros instead of your ID, and Adjust does not switch to the Android ID.
• On any version you can tap Reset advertising ID to replace it with a new one, which breaks the link with earlier data. On older Android versions you can also turn on Opt out of Ads Personalization; Adjust receives this choice together with the ID.
• There is no switch inside Car Z to turn Adjust off. Even without an advertising ID, Adjust still counts the install, sessions and in-app events under its own Adjust device ID. To stop this completely, uninstall the app. You can also object by e-mail or ask us to delete your Adjust data (section 10); we will then ask Adjust to forget your device.

What we don't do

• No ads in the app and no ad-network SDKs.
• No sale or rental of personal data. We share attribution data only as described in section 7 (Adjust and, through Adjust, Meta), to measure our own campaigns.
• We do not send Adjust or Meta your User ID, name, e-mail, photos, results or anything you type.
• No location, contacts, microphone or camera access.
• No Firebase Analytics in the app. Adjust is the only analytics and attribution tool we use.

16. Changes to this policy

We may update this policy when the app or the law changes. We will publish the new version on this page with a new effective date. For material changes we will also tell you in the app before they take effect.

17. Contact

VIBEPALM YAZILIM HİZMETLERİ ANONİM ŞİRKETİ, 1.1.C1 Blok İç Kapı No:Z01, No:143/8, Muallimköy Mahallesi, Deniz Caddesi, Bilişim Vadisi T.G.B. 1. Etap Sitesi, Gebze, Kocaeli 41400, Türkiye
App support: carzapp7@gmail.com · Data protection and legal: business@vibepalm.com

A Turkish version of this policy is available at car-z-app.netlify.app/tr/privacy.