Last updated: 26 October 2026
1. Scope and controller
FotonAI is an AI-powered photo creation and editing app provided by InsightTech Bilişim Sanayi ve Ticaret Anonim Şirketi. This notice describes how we process personal data through the iOS app. Our controller contact details appear below.
2. Information we process
For photo-based generation, we process the original photo you select, one or more reference images, prompts, and style selections. We may process your Firebase anonymous or authenticated user identifier, credit balance, generation counts and dates, subscription and purchase status, and technical security/error information. If you submit a content report, we may receive the report reason, optional explanation, style/prompt metadata, user identifier and a reduced preview of the generated result. Messages you send to support are also processed.
3. AI processing and external services
When you request photo-based generation, your selected photo and instructions travel over an encrypted connection to our Firebase Cloud Functions backend and are forwarded to external AI services to produce the result. Our current primary route uses an OpenAI image model through OpenRouter; a fallback route uses Google Gemini image generation through Google Cloud Vertex AI. OpenRouter acts as an intermediary, and the underlying model provider also receives relevant input. We request separate affirmative permission before transferring photo data to external AI services. If you decline, that photo-based operation does not start.
4. Do we store photos?
In ordinary image generation, we do not write your original photo or generated output into a persistent Firebase Firestore or Firebase Storage photo archive. Data may still exist temporarily in server memory and processing systems, network traffic, device storage, technical logs or the systems of our external AI providers. We do not claim that no copy can ever be retained by processors, backups or providers. Providers’ retention, logging and training practices depend on their policies and the specific model; we cannot independently guarantee them.
5. Content report previews
If you report a generated image, we may store a compressed preview in access-restricted Firebase Storage and associated metadata in Firestore for review by authorized administrators. Such previews are separate from ordinary generation. Administrators may delete the report and preview. Reports may carry a 90-day intended retention marker, but automatic deletion at that deadline is not presently verified; we do not promise automatic 90-day deletion.
6. Purposes
We process relevant information to create requested images, manage authentication, credits, purchases and subscriptions, maintain security, detect abuse and fraud, review content reports, provide support, troubleshoot and comply with legal obligations. The precise analytics, crash reporting or advertising data handled depends on the SDKs enabled in the app; applicable privacy choices and platform permissions govern any tracking or personalized advertising.
7. Recipients and services
The service may rely on Google Firebase and Google Cloud (authentication, functions, database and storage); OpenRouter, OpenAI and Google Vertex AI/Gemini (AI image processing); Apple (in-app purchases); RevenueCat (subscription entitlements); and, where enabled, Google AdMob (advertising and rewarded-ad verification). Each recipient receives information relevant to its role and may have distinct processing practices. We do not make unverified guarantees that every AI provider never trains on inputs or deletes them within a fixed period.
8. International transfers
Some processing occurs outside Türkiye. In particular, the current Google Vertex AI image endpoint is configured in the US-central1 region. Cross-border transfers must be supported by applicable legal mechanisms and safeguards. This policy does not itself replace any required transfer agreement or other legal mechanism.
9. Retention and deletion
The ordinary generation flow does not persist photos in our Firestore/Storage environment. Account records, credits and use statistics may remain while the account operates or as legally necessary. Retention differs for moderation reports, payment webhook events, logs and external providers. Account deletion removes the user Firestore tree, Firebase Auth account and relevant users/{uid}/ Storage objects, and purges identifying report information. De-identified moderation records, legally necessary payment records and some third-party records may remain. You may contact us about access and deletion requests.
10. Security
We use measures such as Firebase Authentication, App Check, access controls, restricted administrator access to report previews, and encrypted connections. No digital transmission or storage is entirely risk-free.
11. Your choices and rights
You can withdraw permission for future transfers of photos to external AI services through the app’s available privacy controls or by contacting us. Further photo-based generation will then require renewed permission. Account deletion is available in Settings. Depending on applicable laws, you may request access, correction, deletion and other rights. Identity verification may be required. Deleting your FotonAI account does not cancel an Apple subscription.
12. Children and images of others
Applicable age and parental-permission requirements apply to children’s personal data. You must have appropriate rights and permissions to submit images of other people. Non-consensual intimate imagery, harassment and unlawful use are prohibited.
13. Changes
We may notify you of material changes through the app or another suitable channel and request fresh permission when material changes to data recipients or purposes require it.
14. Contact
Data controller: InsightTech Bilişim Sanayi ve Ticaret Anonim Şirketi. Address: Küme Evleri Tekno Kent, No:22, Muradiye Mahallesi, Celal Bayar Üniversitesi Kampüsü, Yunusemre, Manisa 45140, Türkiye. Privacy requests: info@insighttech.com.tr.
