Privacy Policy

1. Data Controller

The data controller for personal data processed through the Surprivo service at surprivo.com is Uğur Yeşilbaş, a sole proprietorship (trade name: Paydaai). Address: 2. Anafartalar Mahallesi, 1526 Sokak No:1 Daire:1, Şehzadeler / Manisa, Türkiye. For any privacy request, contact: info@paydaai.com

2. Data We Process

• Card details: who the card is for (the recipient’s name), your relationship, the category and the message you choose.
• Your note: used only at that moment to pick suitable messages and check content; the note itself is not stored in our database.
• Your name and card text: the name you add as the sender and the title, message and sign-off you edit.
• Photo (premium): a photo you add to the card. It is resized in your browser before upload, and extra information such as location (EXIF) is removed. The photo is only shown, through our site, to people who can access the card.
• Opening time (premium): the date and time the card should open.
• Technical data: a one-way hash of your IP address, timestamps and how many times a card was viewed. We do not store your raw IP address.
• Payment data: payment details (card details, billing address, email) are collected and processed directly by Paddle. We never see or store your card details.

3. Purposes and Legal Bases

• Creating, storing and letting you share your card (performance of a contract)
• Preventing abuse, spam and inappropriate content (legitimate interests)
• Handling payment and delivery (performance of a contract)
• Meeting legal obligations (legal obligation)

4. Who We Share Data With

• Paddle.com: as Merchant of Record, for payment, invoicing and tax. Paddle processes your data under its own privacy policy.
• Vercel: website hosting.
• MongoDB Atlas: the database where cards are stored.
• Vercel Blob: storage of photos added to cards.
• OpenAI: card text and any photo you add are sent for content moderation; when you ask for AI text suggestions, the recipient’s name, your relationship and your note are sent. OpenAI states that it does not use data sent through its API to train its models.
• Upstash: the IP hash, to limit excessive requests.
• Public authorities, where we are legally required to.

Some of these providers are located outside Türkiye and the European Economic Area. Such transfers are made with the safeguards required by law (for example, standard contractual clauses).

5. How Long We Keep Data

Card records are kept for as long as the card link is available. To have a card deleted, just send us its link. You can remove a photo from the edit page at any time; removed photos are also deleted from storage. Technical records used to prevent abuse are deleted after a reasonable period.

6. Your Rights

Under Article 11 of Türkiye’s data protection law (KVKK) and, if you are in the European Union or the UK, the GDPR, you have the right to access your data, ask for it to be corrected or deleted, object to its processing, ask for processing to be restricted and request data portability. We respond to requests within one month. You also have the right to complain to the Turkish Personal Data Protection Authority or to the data protection authority in your country.

7. Cookies

We do not use advertising or tracking cookies. The site only uses storage that is strictly necessary for it to work, such as remembering your language. Paddle may use its own essential cookies during checkout.

8. Security

Your data is sent over an encrypted connection (HTTPS) and access is limited to authorised people. IP addresses are only kept as one-way hashes.