This Privacy Policy explains how Experimental FoodLab (“we”, “the Service”) collects and processes personal data under the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law (KVKK). For Turkish-language users, the binding version is /aydinlatma.
1. Data Controller
The Service is operated by Valeri Hemsi, a natural person based in Türkiye. Contact channel for privacy requests is currently being set up; in the meantime, please use in-app messaging.
2. Personal Data We Collect
We collect only what is necessary to provide the Service:
- Account credentials: email address, username, display name, password (stored as bcrypt hash by Supabase Auth — we never see your password in plaintext)
- Profile content: avatar, bio, taste preferences, “open for work” details, signature dishes
- User-generated content: experiments, recipes, descriptions, AI image generation prompts, messages, votes, saves, follows
- Technical data: IP address, browser info, authentication session cookies (Supabase auth tokens)
3. Purposes of Processing
- To create your account and maintain your session
- To publish your content and process votes, saves, follows, messages
- To enable optional AI image generation for experiments
- To personalize and order content in your feed
- To maintain technical operation of the Service
We do not use your data for marketing, advertising, profiling, or sale to third parties.
4. Legal Basis (GDPR Article 6)
- Article 6(1)(a) — Consent: You opt in via the consent checkbox at signup
- Article 6(1)(b) — Contract: Some processing is necessary to operate the account you signed up for
- Article 6(1)(f) — Legitimate interest: Maintaining security, preventing fraud and abuse
5. Retention
We retain your data as long as your account is active. When you delete your account from /hesabim:
- Profile and PII are permanently deleted
- All UGC (experiments, comments, messages, votes, saves, follows) is deleted
- Your Supabase auth record is removed
Technical backups may persist for up to 30 days before final purge.
6. International Data Transfers
The Service relies on three third-party processors. Each transfer is authorized by your explicit consent under GDPR Article 49(1)(a) and KVKK Article 9.
Supabase
Database and authentication service provided by Supabase Inc. Depending on the project region, your data is processed on EU or US servers. Passwords are stored as bcrypt hashes. supabase.com/privacy
Google Gemini (AI image generation)
Optional image generation for experiments uses Gemini models provided by Google LLC (United States). Your image prompts are transmitted to Google servers. Google states that API data is not used by default to train its models. ai.google.dev/gemini-api/terms
Vercel (hosting)
The Service is hosted by Vercel Inc. (United States). Vercel logs IP addresses, browser metadata, and request timestamps for operational purposes. Form contents and passwords are not logged. vercel.com/legal/privacy-policy
7. Your Rights (GDPR Articles 15–22, KVKK Article 11)
You have the right to:
- Access your personal data (Article 15)
- Rectify inaccurate data (Article 16)
- Erase your data — “right to be forgotten” (Article 17)
- Restrict processing (Article 18)
- Receive your data in a portable format — data portability (Article 20)
- Object to processing (Article 21)
- Withdraw consent at any time (effective going forward)
You can exercise most of these directly from your account page:
- Download all your data as JSON
- Edit your profile
- Delete your account permanently
8. Cookies
We use only strictly necessary cookies:
sb-*-auth-token— Supabase session cookies to keep you logged in
No tracking, analytics, or marketing cookies are used at this time. If any are added in the future, we will request your consent and update this page.
9. Children
The Service is intended for users 18 years and older. We do not knowingly process data of minors. If you believe a minor has created an account, please report it via the in-app channels.
10. Supervisory Authority
If you believe your rights have been violated, you may file a complaint with:
- For Türkiye: Kişisel Verileri Koruma Kurumu (kvkk.gov.tr)
- For EU residents: Your national data protection authority or the European Data Protection Board (edpb.europa.eu)
11. Changes
The current version of this policy is always published here. Material changes will be marked at the top of this page.
Last updated: 17 May 2026