Privacy Policy

Effective date: 28 October 2026

Your Magazine is made of personal things — your photos, your memories, the names of the people you love. This policy explains, in plain language, what personal information we collect, why, who helps us handle it, where it goes, how long we keep it, and the choices and rights you have.

In short:

• We use your photos and words only to run the Service and to make and deliver your Magazine.
• We do not sell your personal information and we do not use advertising trackers. We use Google Analytics only if you allow it in our cookie banner, and it never receives your name, e-mail address, photos or the text of your Magazine. Separately, Cloudflare's privacy-oriented Web Analytics counts page views and measures how fast our pages load, without cookies (section 3.2). We do not use your photos or texts to train AI models.
• When you use our AI assistant, the text involved is sent to our AI providers in the United States. Your photos are not sent to them. An AI assistant app of your own that you connect to Dear Edition is different: it sees what you allow, including small previews of your photos if you say yes, and what your friends contributed if you ask it to read that (section 7).
• Your Magazine is printed and shipped by trusted production and delivery partners who receive what they need to make and deliver it. To deliver your Order, the buyer's e-mail address and the delivery address go to our printing partner and to the carrier, so that the carrier can send you its delivery notices.
• Our website sits behind a security and delivery provider, Cloudflare (United States). When you visit dearedition.com, it sees your IP address and the details of your request so that it can block attacks and abusive traffic and deliver pages faster. The same provider also counts page views and measures page-loading speed for us, without cookies (sections 3.2, 8 and 9).
• When something breaks in the Service, a short technical error report also goes to Sentry, an error-diagnostics service (Functional Software, Inc., United States) whose servers for us are in Frankfurt, Germany. We do not put your name, e-mail address, Account ID, photos or Magazine text in it, we remove personal details automatically, and Sentry sets no cookies and uses no storage on your device (sections 3.2, 8 and 14).
• You can download a copy of your information and delete your Account yourself in your account settings, or write to us at info@dearedition.com.

Capitalised words (such as Service, Magazine, Content, Order and Partners) have the meanings given in our Terms of Service.

1. Who is responsible for your information

1.1 Controller. The controller is Sinem Çalışkan, a sole proprietor trading as Dear Edition and based in Türkiye, who is responsible for your personal information ("we", "us"). Our postal address is in section 1.2. In Türkiye we are the veri sorumlusu (data controller) under Law No. 6698 (KVKK).

1.2 How to reach us about privacy.

• E-mail: info@dearedition.com
• Post: Hilal Mahallesi, 706. Sokak, Çankaya, Ankara, Türkiye
• Data protection contact: info@dearedition.com

1.3 Our representatives.

• In the European Union: to be added
• In the United Kingdom: to be added
• Person in charge of the protection of personal information (Québec) and privacy officer (Canada): to be added

You can contact any of them instead of us.

2. What this policy covers

This policy applies to the website dearedition.com in all its languages, the editor at editor.dearedition.com, our assistant Dee, our e-mails, and printed Orders. It covers everyone whose information we handle through the Service:

• people who visit our website or use the editor, with or without an Account;
• customers who place Orders, and the people who receive a Magazine;
• Contributors who add notes or photos through a contribution link;
• guests who post to an event page or live wall;
• people who appear in, or are written about in, Magazines;
• people who join a waiting list or contact us.

Corporate customers who use our business features have a separate agreement with us that explains how we handle their employees' information.

3. The information we collect

3.1 Information you give us

3.2 Information we collect automatically

We do not use your IP address to work out where you are. Your delivery country and language come from your own choices. (Our security provider does use IP addresses, to recognise attacks and abusive traffic, as explained in section 8.)

3.3 Information we receive from others

• Google, if you sign in with Google (name, e-mail address, profile picture).
• Our payment provider, which tells us whether a payment succeeded or failed, and, if your bank declines, the bank's error code. We never receive your full card number.
• Our Partners and carriers, which tell us when your Magazine is in production, has shipped and has been delivered, with tracking details.
• Other users, for example a friend who includes you in a Magazine, a Contributor who sends a note, a gift giver who enters your delivery address, or a person who reports content you shared.
• AI assistant apps you connect to Dear Edition, which send us the instructions and photos you ask them to add to your Magazine.

4. Information about other people

Magazines are about people. When you upload a photo of your family or write about a friend, you give us personal information about them.

• Please only share what you have the right to share. Where the law requires it, get the permission of the people in your photos and stories before you include them — and for children, the permission of a parent or guardian. Think about whether each detail is needed, especially for children and for sensitive topics such as health.
• Contributors. When you invite friends to contribute, we collect the name they choose to give (or none, if they send anonymously), their notes, photos and answers. We show them a short notice before they send anything. We remove location and device details from their photos. If you use an AI assistant app connected to Dear Edition, you can ask it to read what your Contributors sent (their names, notes and answers, and — with your yes — small previews of their photos); the notice we show Contributors says so, and section 7 explains what the app receives.
• Recipients. When you send a Magazine to someone else, we use their name, phone number and address only to deliver it.
• Gift notes and surprise pages are shown to the people you choose.

If you appear in someone else's Magazine and want something removed, write to info@dearedition.com. We will look into your request and, where appropriate, ask the Account holder to remove it or remove it ourselves.

5. Children

The Service is meant for adults. We do not knowingly allow children under 13 to create Accounts or to give us their personal information directly, and our Accounts and Orders require users to be 18 or over. If we learn that a child under 13 has given us personal information without a parent's or guardian's consent, we will delete it.

Many Magazines include photos of and stories about children, added by their parents, grandparents or other adults. We treat this information with care: we use it only to make the Magazine, we do not use face recognition, and we do not use it for advertising or AI training. If you are a parent or guardian and want information about your child removed from a Magazine made by someone else, contact us at info@dearedition.com.

6. Why we use your information, and our legal bases

Data protection laws in the EEA, the UK and Türkiye require us to explain the legal basis for each use. In the table, "Contract" means we need the information to provide the Service or an Order you asked for (GDPR/UK GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)); "Legal obligation" means the law requires it (Art. 6(1)(c); KVKK Art. 5(2)(ç)); "Legitimate interests" means it is necessary for a reasonable interest of ours or of others, balanced against your rights (Art. 6(1)(f); KVKK Art. 5(2)(f)); "Consent" means you agreed (Art. 6(1)(a); KVKK açık rıza), and you can withdraw it at any time.

Is providing information required? You need to give us an e-mail address to create an Account, and delivery details to place an Order; without them we cannot provide that part of the Service. Everything else is up to you.

7. Our AI features and your information

The AI Terms explain our AI Features in detail. In summary:

• Only text goes to our AI providers. When you use the assistant, we send our AI provider your message, the text of your Magazine and the notes the assistant keeps, so it can answer. We do not send your photos. Background removal ("cut-out") runs on your own device and sends nothing to anyone.
• Customer service. When you ask Dee about an order, a delivery, a cancellation, a return, your account or our policies, Dee answers from our published policies. What it tells you about your own Order (its status, dates and tracking) comes from our own system, not from the AI provider, and we do not send your Order, address or payment details to the AI provider for this. Only the words of your question go to it. A person on our team answers every support request.
• Draft replies for our team. To help our team answer a support request faster, a team member may ask Dee to draft a reply. The request's messages and a few facts about the linked Order (its status, dates and tracking number — never your address or payment details) are then sent to our AI provider. A person reads and edits every draft before anything is sent to you.
• AI assistant apps of your own. If you connect an AI assistant app that you use (for example Claude (Anthropic), ChatGPT (OpenAI), Gemini (Google), Perplexity (Perplexity AI), Grok (xAI), Muse (Meta) or Le Chat (Mistral AI); Mistral AI is in France, the others in the United States) to Dear Edition, that app receives what you allow it to read, including page previews that show your photos, and its provider handles it under your own agreement with them, not as our service provider (section 8). You can see each app you have connected, and when it last used the connection, and end the connection under Account settings > Connected apps; ending it stops the app's access at once.
• Small previews of your photos (only with your yes). A connected app can also ask us for one picture with up to 24 of your photos, each shown small (about 256 pixels wide), so that it can help you choose a cover or the best shots. We give it the picture only when the app tells us you said yes in the chat; we keep your yes with that Magazine, make the picture when asked and do not keep it. It carries no location or camera details, and we do not analyse the photos or recognise faces. See section 11.2 of the AI Terms.
• What your friends contributed. If you ask a connected app to read what your Contributors sent, it receives from us each Contributor's name (or "anonymous"), note and answers, and how many photos they sent — no device or location details. If you ask it to use their photos, we first copy them into your own photo library, where they are handled like your other photos. Contributors are told this on the contribution page.
• Layouts we learn from. A page that a connected app designs for you is yours. We may also learn from such pages which arrangements work well, to suggest them to other customers: our software keeps only the arrangement (the number of photo frames; the kinds, sizes, shapes and positions of the parts; the mood; the nearest design-kit colour; a rough text length) — none of your photos, words, names, stickers or identifiers — plus short one-way codes of Account and Order identifiers, to avoid counting the same one twice. A member of our team reviews each layout, drawn with sample words and empty photo frames, before it is offered to anyone. A published layout contains nothing of yours and stays if you delete your Account. This is based on our legitimate interest in improving our design suggestions; if you do not want your pages used this way, write to info@dearedition.com and we will stop using them for it. See section 11.4 of the AI Terms.
• Voice input is sent to our speech-to-text provider, converted into text and not stored by us.
• Safety check. Messages you send to the assistant may pass through an automated safety filter run by one of our AI providers.
• Providers. Our AI providers are Anthropic and OpenAI, both based in the United States. We send them a pseudonymous identifier instead of your name or e-mail address.
• No training. Our contracts with our AI providers do not allow them to use the information we send to train their models, and we do not use it to train models ourselves.
• Retention. Your conversation with the assistant is stored on your own device, not on our servers. Our AI providers keep what we send them only as their terms allow — under their current terms, generally no longer than 30 days, unless a longer period is needed to investigate misuse or is required by law. What a connected AI assistant app has received is kept by its provider under its own terms and your settings with it, not by us.
• You can choose not to use AI. You can make and order a Magazine entirely in the editor without sending anything to an AI provider.

8. Who we share information with

We do not sell your personal information. We share it only with the people and companies below, and only what each needs.

Our staff. Authorised members of our team can access information when they need it for their role — for example to prepare an Order for printing, help you with a problem report, or investigate a security issue or a report of abuse.

Want the names? You can ask us for the names of the specific companies that receive your information, including our Partners. Write to info@dearedition.com.

9. International transfers

We are based in Türkiye, our main hosting is in the European Union, and some of our providers and Partners are in the United States. Your information may therefore be handled in countries other than your own, which may have different data protection laws. This is how those transfers work today:

• From the EEA, the UK and Switzerland: the standard data processing terms of our cloud hosting provider (Google), of Google Analytics, of our main AI provider (Anthropic), of our e-mail delivery provider, of our error-diagnostics provider (Sentry) and of our website security and delivery provider (Cloudflare) include the European Commission's standard contractual clauses (with the UK addendum where their terms provide for it; Cloudflare's also have a Swiss addendum) and, where a provider is certified under it, the EU–U.S. Data Privacy Framework (Cloudflare states that it is certified, including the UK Extension and the Swiss–U.S. framework). With our other providers and Partners — for example OpenAI and our production partner for Orders delivered outside Türkiye — we are completing data processing agreements. Occasional transfers that are necessary to deliver your Order — for example handing your parcel to a carrier abroad — may rely on the exceptions the law allows.
• From Türkiye: under Article 9 of KVKK, transfers abroad to countries without an adequacy decision of the Personal Data Protection Board require appropriate safeguards, such as the Board's standard contracts signed with each recipient and notified to the Personal Data Protection Authority. We are in the process of signing these standard contracts with our recipients abroad, including Cloudflare, and notifying the Authority.
• From Canada and Québec: your information may be processed outside Canada (in the EU, Türkiye and the United States) and may be accessible to the courts, law enforcement and national security authorities of those countries. For Québec residents, we are completing the assessment the law requires before personal information is communicated outside Québec, and the written agreements that go with it.

You can ask us which safeguards apply to a particular recipient, and for a copy of them, by writing to info@dearedition.com.

10. How long we keep information

We keep information only as long as we need it for the purposes in section 6, or as long as the law requires. The Data Retention and Deletion Policy gives the details. In summary:

• Your Account and Magazines are kept until you delete them or your Account. We do not currently delete inactive Accounts automatically.
• Order, invoice and consent records are kept for the period Turkish commercial and tax law requires, currently up to 10 years from the end of the calendar year in which the Order was placed, even after your Account is deleted.
• The fixed copy and print files of an ordered Magazine are kept so we can deal with reprints, complaints and disputes. If you delete your Account, we delete them once the period for complaints about the print has passed. Otherwise we have not yet set a fixed deletion period; until we do, they are kept and you can ask us to delete them once your Order is complete.
• Your conversation with the assistant stays on your device until you clear it.
• Google Analytics data (only if you allowed analytics) is kept for 14 months, then deleted by Google. Your cookie choice is kept in your browser for 12 months; then we ask again.
• The record of your acceptance of our Terms and this Privacy Policy is kept with your Account and deleted with it.
• Reports about content (the report, our decision, the statement of reasons and any complaint) are kept for three years after we decide, then deleted, so that we can deal with complaints and legal claims. They are not deleted when the reporter, or the person whose content it was, deletes their Account.
• Connected AI apps: the record of an app you connected is kept while the connection lasts; access lasts up to 1 hour at a time and permission to renew it up to 30 days, unless you disconnect sooner. Your yes to small photo previews is kept with that Magazine and deleted with it; we do not keep the preview pictures. What an app has already received is kept by its provider under its own terms, not by us.
• Layouts we learn from: a layout (the arrangement of a page, with no photos, words, names, stickers or identifiers) and its counting codes are kept until we remove them. They are not deleted when you delete a Magazine or your Account.
• Support requests (your messages, our answers and the screenshots or photos you attached) are kept while the request is open and for two years after it is closed, then deleted. A request waiting for your reply closes by itself after a few days without one (we remind you first). They are included when you download your data and deleted when you delete your Account.
• Server logs are kept by our hosting provider for a limited period for security purposes. Technical error reports are kept in the same way, currently about 30 days.
• Error reports in Sentry are kept for at most 90 days, and timing samples for at most 30 days, then deleted by Sentry (its retention periods for our plan).
• Cloudflare Web Analytics data. Cloudflare keeps the detailed measurements for about 7 days, then reduces them to a sample (about a tenth) and shows us roughly the previous six months, according to its current documentation. We do not keep a copy.
• Cloudflare's logs. Cloudflare keeps the logs it makes as it relays requests to our website only for a limited time, under its own privacy policy and data processing addendum, and deletes them when that time ends. The security events that we can see in Cloudflare's dashboard are currently kept for about 30 days.
• We do not keep separate backup copies of our database. When you delete something, it is removed from our live systems; deleted files may remain recoverable in our storage provider's systems for a short time before they are permanently erased.

11. How we protect your information

We use technical and organisational measures designed to protect your information, including:

• encrypted connections (HTTPS) between your device and the Service;
• a security and delivery provider (Cloudflare) in front of our website that filters denial-of-service attacks, malicious requests and abusive automated traffic before they reach our servers;
• encryption of stored data by our cloud provider;
• access rules that keep each person's Magazines, photos and orders separate, so other users cannot open them through the Service;
• role-based access for our team, limited to people who need it;
• payment through our payment provider's secure form, so your card details never reach us;
• storing the secret links we create (for example contribution and surprise links) only in a form that cannot be turned back into the link;
• keeping your messages to the assistant out of our logs.

Your photos. When you open your photos in the editor or in your Account, we give your browser web addresses for them only after you have signed in, and those addresses stop working within about two hours. Photos you upload are stored without a permanent public web address. Please do not copy photo addresses out of your browser and share them: anyone with that address can open the photo until it expires. The copies we make for printing your Orders are not reachable through a web address.

No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify the relevant authorities and you as the law requires.

12. Your rights

You can exercise any of the rights below by writing to info@dearedition.com from the e-mail address of your Account (or, if you have no Account, by telling us how we can find your information). We may need to confirm your identity first. We will not charge you, unless the law allows a fee for excessive or repeated requests. We will reply within the time limit set by the law that applies to you — one month in the EEA and the UK, 30 days in Türkiye and Canada, 45 days in the United States — and tell you if we need to extend it as the law allows.

You can also do two things yourself, in your account settings under "Your data":

• Download my data prepares one ZIP file with your Account details, saved addresses and Important days, your Magazines, the photos in your library, your Orders, the consents you gave, what friends contributed to your Magazines and your other activity in the Service, in commonly used formats (JSON files and the original photo files). The download link works for 15 minutes, and the file is kept for 7 days.
• Delete my account deletes your Account. What is deleted and what the law requires us to keep is explained in section 4 of the Data Retention and Deletion Policy.

If you cannot use these, or want something else, write to us and we will help — including sending you a copy of your information in a commonly used electronic format.

12.1 Everyone

You can ask us to tell you what information we hold about you and give you a copy; correct it; delete it; and stop sending you messages you no longer want. You can withdraw any consent at any time; this does not affect what we did before you withdrew it.

12.2 EEA and UK residents

Under the GDPR and UK GDPR you also have the right to restrict our use of your information; to object to uses based on our legitimate interests; to data portability; and not to be subject to decisions based solely on automated processing that have legal or similarly significant effects (we make none — section 15). You can complain to a data protection authority, for example in the country where you live (see section 17). In the UK, you can first complain to us, and we will acknowledge your complaint within 30 days.

12.3 Residents of Türkiye

Under Article 11 of KVKK you can ask whether your personal data are processed and, if so, request information about it; learn the purpose and whether data are used for that purpose; know the third parties to whom data are transferred in Türkiye or abroad; ask for correction of incomplete or inaccurate data and deletion or destruction under Article 7, and for these to be notified to the third parties to whom the data were transferred; object to a result against you arising solely from automated analysis; and claim compensation for damage from unlawful processing. Applications follow the Communiqué on the Procedures and Principles of Application to the Data Controller. The full notice is in the KVKK Aydınlatma Metni.

12.4 United States residents

Depending on the state where you live, you may have the right to know what personal information we collect and how we use and disclose it, to access and receive a copy of it, to correct it, to delete it, to opt out of its sale, sharing for targeted advertising or profiling, and to appeal our decision on your request. We offer these rights to all US residents, whether or not a state law requires us to. We will not treat you differently for using them. You can use an authorised agent; we may ask the agent for proof of authority. If we refuse your request, you can appeal by replying to our decision; we will answer within the time your state's law sets, and if you are still not satisfied you can contact your state attorney general. California residents should also read the California Privacy Supplement.

12.5 Canada and Québec residents

You can access and correct your personal information and withdraw consent, subject to legal and contractual limits. You can contact our privacy officer (section 1.3) and complain to the Office of the Privacy Commissioner of Canada. Québec residents can also ask us to stop disseminating their information or to de-index any link attached to their name where the law provides for it, ask for their computerised information in a structured, commonly used technological format, and complain to the Commission d'accès à l'information du Québec. See the Québec addendum.

13. Service e-mails, reminders and marketing

• Service e-mails — sign-in links, order confirmations and delivery updates — are part of the Service and we send them whenever you use it.
• Reminders (for example "your draft is waiting" or reminders of important days) are off unless you switch them on in your notification settings.
• News and offers. If you agree, we send you occasional e-mails about new designs, gift ideas and occasions coming up, offers, a Magazine you left unfinished or at checkout, and — after an Order — a thank-you, a request for a review and, about a year later, a reminder of the occasion. You agree by ticking the optional box (never ticked for you) when you sign in, at checkout, or in Account › Notification settings. We then send one e-mail asking you to confirm, and nothing more until you do ("double opt-in"); a choice made before we start sending news and offers is recorded, and the confirmation e-mail follows when we start. We keep a record of when and how you agreed, the wording you agreed to and its version, and the language and country it was given in.
• Existing customers. Where the law allows it — in the EEA, the UK and the US — if you bought from us we may also e-mail you occasionally about products similar to the one you bought, unless you ticked "Don't email me about products like this one" at checkout or have said no since. In Canada this applies for two years after your purchase. In Türkiye and everywhere else we write only to people who agreed.
• Türkiye. Commercial electronic messages are sent only with your prior approval under Law No. 6563, and your approval is recorded in the Commercial Electronic Message Management System (İYS), where you can also withdraw it.
• How often, and how to stop. Never more than one marketing e-mail a day, at most a few a week, and not at night in your time zone. Every marketing e-mail has an unsubscribe link that works with one click (also the "Unsubscribe" button your e-mail app may show), and you can switch news and offers off in your notification settings at any time; that stops all of them, including the ones to existing customers. Service e-mails about your Orders are not marketing and keep coming.
• Measuring. We may see whether a marketing e-mail was delivered, opened and which link was clicked, only to send fewer and better e-mails; we keep these as counts, not as a profile of you. We do not use your Content, photos or Magazine text for marketing, and we never share your address with other companies for their marketing.

14. Cookies and similar technologies

We use the cookies and browser storage needed to run the Service and remember your choices, such as your language and delivery country, and — only if you allow it in our cookie banner — Google Analytics cookies to measure how our website is used. Separately, Cloudflare's Web Analytics script counts page views and measures page-loading speed; Cloudflare states that it sets no cookies and uses no local storage for this, so it is not part of the banner's choices (Cookie Policy, section 3.3). Sentry, which receives our error reports, sets no cookies and uses neither local storage nor session storage in your browser (Cookie Policy, section 3.4). When the security checks of our website provider, Cloudflare, act (for example on a request that looks automated), it may also set strictly necessary security cookies, which need no consent. We do not use advertising or social-media tracking. You can change your choice at any time with the Cookie settings link at the bottom of every page; if you withdraw consent, we stop Google Analytics and delete its cookies. Details, including every cookie we set and how long it lasts, are in the Cookie Policy.

15. Automated decisions

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Some automated tools help us run the Service fairly and safely: fair-use limits on the assistant, an automated safety filter on messages to the assistant, and the temporary hiding of a Community design after several reports, until a person reviews it. You can always ask a person to review a decision that affects you.

16. No sale, no targeted advertising; Do Not Track

We do not sell personal information, we do not share it for cross-context behavioural or targeted advertising, and we do not use it for profiling that produces legal or similarly significant effects. We have not done so in the past 12 months. We do not track you across other websites, and neither Google Analytics (which we use only with your consent) nor Cloudflare Web Analytics (which sets no cookies) is used for advertising. If your browser sends a Global Privacy Control signal, we treat it as a no to Google Analytics; the cookie-free Cloudflare Web Analytics measurement is not switched off by it (Cookie Policy, section 3.3).

17. Complaints

We would like the chance to resolve your concern first — write to info@dearedition.com. You can also complain to a data protection authority:

• EEA: the authority in the country where you live or work, or where the issue happened — listed at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en
• United Kingdom: the Information Commissioner's Office — https://ico.org.uk/make-a-complaint/
• Türkiye: the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) — https://www.kvkk.gov.tr
• Canada: the Office of the Privacy Commissioner of Canada — https://www.priv.gc.ca
• Québec: the Commission d'accès à l'information du Québec — https://www.cai.gouv.qc.ca
• California: the California Privacy Protection Agency — https://cppa.ca.gov — or the California Attorney General
• Other US states: your state attorney general.

18. Changes to this policy

We will update this policy when our practices or the law change, and change the effective date at the top. If a change is significant, we will tell you in advance by e-mail or in the Service. If a change requires your consent, we will ask for it.

19. Contact

Sinem Çalışkan – Dear Edition · Address: Hilal Mahallesi, 706. Sokak, Çankaya, Ankara, Türkiye · E-mail: info@dearedition.com · Phone: 05425883573