Privacy Policy

This policy explains what personal data SFX Loom collects, why, who we share it with and what your rights are. The data controller is Can Çağlar Kırıcı, an individual seller trading as SFX Loom, located in Istanbul, Türkiye. Contact: support@sfxloom.com. We process personal data in line with the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where it applies, the EU and UK General Data Protection Regulation (GDPR).

What we collect

• Account data: your email address, and your name and profile photo URL if you sign in with Google. We never see your Google password.
• Content: the Prompts you write, the settings you choose, and the Sounds and versions you generate, trim and save.
• Usage and billing records: your generation history, credit balance and credit transactions, and your subscription status.
• Payment data: payments are handled by Paddle, our Merchant of Record. We do not receive or store your card details. Paddle shares with us your customer ID, subscription and transaction status, and the country used for tax.
• Technical data: IP address, browser type and request logs created automatically by our hosting provider when you use the Service, used for security and troubleshooting.
• Optional feedback: the reason you give, if you choose to give one, when cancelling a subscription.

Please don’t include personal data about yourself or others in Prompts — they are sent to third-party AI providers.

Why we use it (and our legal basis)

• To create your account, keep you signed in, generate and store your Sounds, and provide support — performance of our contract with you.
• To calculate credits, process subscriptions and refunds, and keep accounting records — contract and legal obligations.
• To secure the Service, prevent abuse and fraud, and enforce our Terms — legitimate interests.
• To understand why people cancel, when you choose to tell us — your consent, which you can withdraw at any time.

We don’t sell your personal data, and we don’t use it for advertising or to build advertising profiles.

Who we share it with

We use these service providers to run the Service. Each processes data only as needed to provide its service to us:

• Google (Firebase and Google Cloud) — sign-in, database and storage of your Sounds. Servers in the United States.
• Vercel — website and application hosting, including request logs.
• WaveSpeed AI — routes generation requests to the AI models. Receives your Prompts and settings, but not your name or email.
• AI model providers (ElevenLabs, Kuaishou/Kling) — generate Sounds from your Prompts via WaveSpeed. These providers process Prompts and generated audio under their own terms and privacy policies, which may allow them to use such content to operate and improve their services.
• Paddle — checkout, payments, invoices, tax and subscription management, acting as Merchant of Record under its own privacy policy.

We may also disclose data if required by law, to protect our rights or users’ safety, or as part of a transfer of the Service to a successor, who will be bound by this policy.

International transfers

Our providers process data outside Türkiye, including in the United States, the European Union, Singapore and Hong Kong. Where required, transfers rely on the safeguards offered by those providers (such as standard contractual clauses) and, for transfers from Türkiye, on the mechanisms provided under KVKK. By using the Service you acknowledge that your data will be processed in these countries.

Cookies

We use one strictly necessary cookie, __session, to keep you signed in, and store your theme and view preferences in your browser’s local storage. We don’t use analytics or advertising cookies. Paddle may set its own necessary cookies when its checkout opens.

How long we keep it

• Account data, Sounds and history: for as long as your account is open.
• When you delete a Sound, its files and versions are permanently deleted from our storage.
• When you delete your account, we delete your account data and Sounds. Billing and credit records may be kept, in a form no longer linked to your profile where possible, for as long as tax and accounting laws require.
• Hosting request logs are kept for a short period set by our hosting provider.

Your rights

Depending on where you live, you can ask us to tell you what data we hold about you and give you a copy, correct it, delete it, restrict or object to how we use it, or transfer it to you in a portable format, and you can withdraw any consent you gave. Under KVKK (Article 11) you also have the right to learn whether your data is processed, its purpose, and the third parties it is transferred to, and to request compensation for unlawful processing. Email support@sfxloom.com — we reply within 30 days. You can also complain to your data protection authority (in Türkiye, the Personal Data Protection Authority — KVKK).

Security

Data is encrypted in transit, stored with providers that encrypt it at rest, and protected by access rules that let each user read only their own data. Sound files are private and downloaded through short-lived signed links. No system is perfectly secure, so please use a strong, unique password.

Children

The Service is not for anyone under 18, and we don’t knowingly collect data from children.

Changes

We’ll update the date at the top when this policy changes and notify you of material changes by email or in the app. Our Terms of Service also apply.