This policy is prepared by CRAFT AJANS REKLAM VE BİLİŞİM HİZMETLERİ TİCARET LTD. ŞTİ. ("Roisel") under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"). Roisel processes data in two roles: as data controller for its own customers' (panel users') data; and as data processor for the shoppers of brands that use the widget on their own sites.
Data controller
CRAFT AJANS REKLAM VE BİLİŞİM HİZMETLERİ TİCARET LTD. ŞTİ.
Esentepe Mahallesi, Büyükdere Caddesi, No: 175, Ferko Signature İçkapı No:7 Şişli/İstanbul
Email: info@roisel.com
Panel users: data we process
- Account data: first and last name, email, password (stored only as an irreversible hash), role, and invitation details.
- Billing data (company owner): legal name, individual/corporate type, tax office, tax or national ID number, billing address, city, and phone.
- Transaction and subscription data: chosen plan, credit movements, payment status and amount. Your card number and security code never reach Roisel's servers and are not stored by Roisel; they go from the payment form directly to the payment institution iyzico. When the subscription starts, your card is stored by iyzico and iyzico charges it at the start of each period; Roisel does not keep the card number or a card key, only the subscription and customer references issued by iyzico and the card's masked summary (last 4 digits, brand) to show in the panel.
- Usage and security data: session cookie, an audit log of administrative actions in the panel (without values), and your IP address for rate limiting. The IP address is held only in the limiter's memory and is not written to persistent records.
- Demo and contact forms (marketing site): full name, email, phone, brand or company name, website, e-commerce platform, your message or note, the module you are interested in, the language of the form and the page and campaign tags you arrived with (source, utm), and your optional marketing consent. The IP address and browser details are not written to these records.
Purposes and legal bases
| Purpose | Legal basis (KVKK art. 5) |
|---|---|
| Creating accounts, providing the Service, support | Conclusion or performance of a contract |
| Invoicing, taking payment, accounting and tax obligations | Legal obligation; performance of a contract |
| Security, preventing abuse and fraud, rate limiting | Legitimate interest |
| Service notices (approval, payment, credit alerts) | Performance of a contract; legitimate interest |
| Renewing the subscription automatically at the end of each period (a failed payment is retried by iyzico) | Explicit consent (the renewal confirmation when the subscription starts); performance of a contract |
| Replying to demo and contact requests | Steps necessary for the conclusion of a contract; legitimate interest |
| Emails about Roisel products and campaigns (optional box on the form) | Explicit consent |
| Establishing, exercising, and defending legal claims | Establishment, exercise, or protection of a right |
Widget users: Roisel as processor
When you use the Smart Size Assistant or Virtual Try-On on a brand's site, the brand decides why and how your data is processed; the brand is the controller and is responsible for the privacy notice and explicit consent. Roisel processes your data only on the brand's instructions and to provide the Service. Data processed:
- Photo: a photo sent for analysis in the Size Assistant is not stored. A photo you upload to Virtual Try-On is deleted as soon as the try-on finishes; the resulting image is kept for at most 24 hours.
- Measurements: height, weight, bra size, body type, and optional measurements. Recommendation records keep ranges (bands), not exact values.
- Fit feedback: the size you bought and a tight/right/loose choice; it contains no identity, IP, or device details.
- Usage measurement: events such as opening the widget, steps, and viewing results, product code, device class, and time. IP address, full URL, and persistent device identifiers are not kept.
Please direct requests about this data first to the brand that publishes the widget.
Who receives your data
Your data is not sold. To provide the Service it may be shared with:
- Payment institution: iyzico (payment processing, billing fields, and your card stored for the subscription).
- AI providers: OpenAI (body type estimation from a photo) and FASHN (virtual try-on image). These are located abroad.
- Infrastructure and hosting providers.
- Public authorities where required by law.
Transfers abroad
When photos are processed by AI, your data is transferred to OpenAI and FASHN abroad. This transfer relies on the explicit consent you give separately in the widget and on KVKK art. 9; in the Smart Size Assistant you can decline and continue by entering measurements without a photo. Panel data is processed in the countries where our infrastructure providers operate, in line with KVKK art. 9.
Retention
| Data | Period |
|---|---|
| Account and company data | While the account is open; afterwards for statutory retention periods |
| Invoice and payment records | For the retention period set by law |
| Session | Up to 14 days |
| Card summary and iyzico references (subscription and customer reference, last 4 digits, brand) | Kept while the subscription lasts; the card itself is held by iyzico. Payment and consent records (including last 4 digits and brand) are kept for the statutory retention periods. |
| Demo and contact requests | 12 months |
| Virtual Try-On photo | Deleted as soon as the try-on finishes |
| Virtual Try-On result image | Up to 24 hours |
| Raw measurement events | 180 days |
| Daily summary counters (non-personal) | 25 months |
| Fit feedback | 24 months |
| Recommendation and try-on records | 24 months; anonymized afterwards |
Cookies and device storage
See the Cookie Notice for details.
Security
Passwords are stored with a salted, slow hash; session tokens are kept in the database only as hashes; uploaded files are stored encrypted; connections use HTTPS. No system is entirely risk-free, so we cannot guarantee absolute security.
Your rights (KVKK art. 11)
You have the right to learn whether your personal data is processed; request information if it is; learn the purpose and whether it is used accordingly; know the third parties it is transferred to at home or abroad; request correction of incomplete or inaccurate data; request deletion or destruction under KVKK art. 7; request that these actions be notified to recipients; object to an adverse result arising from analysis exclusively by automated systems; and claim compensation for damage caused by unlawful processing.
Send requests in writing to the contact details above; we conclude them within thirty days at most, depending on their nature. If we cannot verify your identity, records held under a session ID cannot be linked to you and may not be found. If you are dissatisfied with the response, you may complain to the Personal Data Protection Board.
Children
The Service is not directed at people under 18 and we do not knowingly collect data from children. If you notice a child's data has been processed, tell us and we will delete it.
Changes
We may update this policy. We will announce material changes on the site or by email; the date at the top shows the latest update.