Este documento solo está disponible en inglés. El texto en inglés es el que se aplica.
This policy explains what personal data Moriqa collects when you use moriqa.com, the Moriqa editor, its AI tools and the Moriqa desktop app (together, the "Service"), why we collect it, who we share it with and the choices you have.
We have tried to keep it short and concrete. If anything is unclear, email us at hey@moriqa.com.
1. Who we are
Moriqa ("Moriqa", "we", "us") is an independent product operated from Türkiye. For the purposes of the EU and UK General Data Protection Regulation (GDPR) and Türkiye's Law No. 6698 on the Protection of Personal Data (KVKK), Moriqa is the controller responsible for the personal data described in this policy.
You can contact us about anything in this policy at hey@moriqa.com. We have not appointed a data protection officer because we are not required to; privacy requests are handled directly by the people who run Moriqa.
2. Personal data we collect
We collect only what we need to run the Service. Depending on how you use Moriqa, this can include:
- Account data — your name, email address, profile picture and sign-in method (email and password, or a Google, GitHub or Discord account). Passwords are handled by our authentication provider and are never visible to us.
- Session and security data — your active sessions and the device, browser and approximate location (city and country, derived from your IP address) linked to them, so you can review and sign out of sessions and we can protect your account.
- Images you send to AI tools — the image you choose to process with a feature such as background removal, object removal, upscaling or colorization, and, where a tool needs one, the mask you paint.
- Usage records — counts of the AI operations your account has run, which help us keep the free Service sustainable and prevent abuse.
- Product analytics — aggregated page views, a small set of product events (for example, that a tool was opened or a result was exported) and page performance measurements. These are collected without cookies and are not used to build a profile of you.
- Technical logs — IP address, browser type, time of request and error details recorded by our hosting provider when your browser communicates with our servers.
- Messages and issue reports — the content of emails you send us and, if you use the in-app "Report an issue" form, your email address, your description and, if you choose, a screenshot and basic details about the open project (its name, number of layers and canvas size).
We do not collect payment information, because Moriqa does not currently sell anything. We do not intentionally collect special categories of personal data (such as health or biometric data), and we ask that you do not include them in images or messages you send us.
3. Your projects stay on your device
The Moriqa editor runs in your browser. Projects you create are saved on your own device — as .mori files you choose where to keep, and in your browser's storage for recent projects and preferences. We do not receive or store your projects unless you choose to send an image to an AI tool or attach a screenshot to an issue report.
4. How AI tools handle your images
When you use an AI tool, the image you selected is sent over an encrypted connection to the machine-learning model that performs the task, and the result is returned to your browser. These models run on infrastructure provided by Hugging Face.
- We use your images only to produce the result you asked for.
- We do not use your images, masks or results to train or improve AI models.
- We do not keep copies of your images once the result has been returned, apart from short-lived technical logs kept by our infrastructure provider for security and troubleshooting.
Please only upload images you have the right to use, and do not upload images of other people without their permission.
5. Why we use personal data, and our legal bases
| Purpose | Data used | Legal basis | How long we keep it |
|---|---|---|---|
| Creating and running your account | Account data; session and security data | Performance of our contract with you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) | Until you delete your account |
| Running the AI tools you request | Images, masks and results | Performance of our contract with you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) | Only for as long as it takes to process your request |
| Keeping the free Service fair, secure and working (usage limits, abuse prevention, troubleshooting) | Usage records; technical logs | Our legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) | Usage records while your account exists; logs for the short period set by our hosting provider |
| Understanding and improving the product | Aggregated analytics and performance data | Our legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) | Kept only in aggregated form, with no individual profiles |
| Answering your messages and issue reports | Messages and issue reports | Our legitimate interests, or performance of our contract where your request concerns the Service | As long as needed to resolve your request and any follow-up |
| Meeting legal obligations and defending legal claims | Any of the above, as relevant | Legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)) and our legitimate interests | For the period required by law |
We do not sell your personal data, we do not use it for advertising, and we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
7. International transfers
Our service providers are based in the United States and other countries, so your personal data may be processed outside Türkiye, the European Economic Area and the United Kingdom. Where the law requires it, these transfers rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses offered by our providers and, for transfers from Türkiye, the mechanisms available under Article 9 of the KVKK.
8. How long we keep data
We keep personal data only for as long as we need it for the purposes above. When you delete your account, your account profile is deleted by our authentication provider. Usage records are linked to a random account identifier rather than your name or email address, and we delete them on request. Aggregated analytics cannot be linked back to you.
10. Security
We protect personal data with measures appropriate to the risk, including encryption in transit (HTTPS) for all traffic, database access rules that prevent browsers from reading or changing other people's records, and limiting administrative access to those who need it. No online service can be completely secure, so we also recommend using a strong, unique password or a trusted sign-in provider.
11. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy of it;
- have inaccurate or incomplete data corrected;
- have your data deleted;
- restrict or object to processing based on our legitimate interests;
- receive the data you provided in a portable format;
- withdraw consent where processing is based on consent, without affecting earlier processing; and
- lodge a complaint with a data protection authority.
You can change your name and delete your account at any time from your Moriqa account settings. For anything else, email hey@moriqa.com from the address linked to your account. We may need to verify your identity before acting on a request. We respond within one month under the GDPR and within 30 days under the KVKK, and we will let you know if we need more time where the law allows it.
12. Additional information for people in Türkiye (KVKK)
Under Article 11 of the KVKK, you have the right to learn whether your personal data is processed and to request information about it; to learn the purpose of processing and whether it is used accordingly; to know the third parties in Türkiye or abroad to whom it is transferred; to request correction of incomplete or inaccurate data; to request deletion or destruction under Article 7; to request that corrections or deletions be notified to those third parties; to object to a result against you that arises solely from automated analysis; and to claim compensation for damage caused by unlawful processing.
Send requests to hey@moriqa.com. If your request is refused or not answered in time, you may file a complaint with the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu).
13. Additional information for people in the EEA and the UK
You have the rights listed above under the GDPR and the UK GDPR. You can lodge a complaint with the data protection authority in the country where you live or work, or where you believe an infringement took place.
14. Additional information for people in the United States
If you live in California or another US state with a comprehensive privacy law, you have the right to know what personal information we collect and how we use and disclose it, to request access to it and its correction or deletion, and not to be treated differently for exercising these rights.
- In the past 12 months we have collected the categories described in "Personal data we collect": identifiers (such as name, email address, account ID and IP address), internet or network activity (usage and log data), approximate location, and content you choose to submit.
- We do not sell personal information and we do not share it for cross-context behavioral advertising.
- We do not use or disclose sensitive personal information for purposes that would give you a right to limit it.
- You can make a request yourself, or through an authorized agent with your written permission, by emailing hey@moriqa.com. We will verify the request using information linked to your account and respond within 45 days, extendable once where the law allows.
15. Children
Moriqa is not directed to children. You must be at least 13 years old to create an account, or older where the law of your country requires it (for example, 16 in some EU countries), and users under 18 need the permission of a parent or guardian. If you believe a child has given us personal data, contact us and we will delete it.
16. Changes to this policy
We will update this policy when our practices change — for example, if we introduce paid plans or new service providers. The date at the top shows when it was last changed. If a change materially affects how we use your personal data, we will make that clear on this page and, where appropriate, tell you in the product or by email.
17. Contact
Questions, requests or complaints about privacy: hey@moriqa.com.