Privacy Policy

Last updated 11 November 2026

This policy explains what personal data Combup collects when you use it in Canada (combup.com/ca and the Combup app), why we use it, who we share it with, where it is processed, how long we keep it and what rights you have under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, if you live in Québec, Québec's Act respecting the protection of personal information in the private sector. In short: we use your data to run the service you ask for, we don't sell it, we don't use it for targeted advertising, and you can delete your account and data at any time.

Who we are

Combup is operated by EMİRHAN GÜVEN GÜVEN YAZILIM HİZMETLERİ, a sole proprietorship registered in Türkiye, which is the controller of your personal data. Postal address: Cennet Mah., Hürriyet Caddesi, Koza Apt. No: 83, Door 3, 34290 Küçükçekmece, Istanbul, Türkiye. Email: [email protected].

Personal data we collect

Account: your email address, your name if you give it, and an irreversible hash of your password. If you sign in with Google or Apple, we receive an account ID, your email address (or Apple's private relay address) and your name. We never receive your Google or Apple password.
Chats: the messages you write to the smart assistant, its replies and the products shown. They are kept with your account until you delete them or your account. We count how many questions you ask each day to apply your allowance.
Photos for photo search (Premium): when you search with a photo, the image is read in memory on our server only for that search: we detect the clothing item and compute a visual fingerprint to compare it with products. We don't store the photo or the fingerprint, we don't use it to identify anyone, and we don't share it. Only a count of the search is kept for your daily allowance.
Saved items and preferences: the products you save and any size or style preferences you choose to keep with your account.
Subscription records: if you buy Premium, Paddle sends us the limited information we need to manage it: Paddle customer, transaction and subscription IDs, the subscription status, the end of the current period and the result of each payment. We never receive your card number.
Search statistics: a structured summary of searches (filters such as category and color) linked to an irreversible hash of a random browser ID, used to show trends, and anonymous counters such as which product was opened or when someone continued to a store, deleted after 90 days.
Technical data: IP address and browser information in temporary server logs, used for security and to prevent abuse.

We don't collect your precise location, and we don't ask for special category data such as health or ethnicity. Please don't share it in chats. If you also use Combup in Türkiye or the US with the same account, the features you use there are described in their own privacy notices.

How we use it

To provide Combup (your account, search, the assistant, chat history, saved items, photo search and Premium) and to answer your support, payment and refund requests: this is necessary to perform our contract with you.
To keep Combup secure, prevent abuse and fraud and apply daily limits: our legitimate interest in protecting the service and its users.
To understand general usage and improve Combup, including improving our own search systems from chats with the assistant: our legitimate interest in making the service better. Email addresses, phone numbers, postal addresses and ID numbers are masked automatically before such records are stored. You can object at anytime by emailing [email protected], and we'll stop for your account straight away.
To send emails: account and subscription emails (welcome, receipts, security) are necessary for our contract with you. Other emails, such as tips, product news and offers, are sent only with your consent where the law requires it, and you can unsubscribe at anytime with the link in each email.
To keep tax and accounting records and respond to lawful requests: compliance with our legal obligations.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. The assistant's suggestions are product recommendations only.

The smart assistant

Your messages to the assistant are sent to our AI service provider in the United States so that it can generate a reply. The provider processes them only on our behalf, as our processor. Please don't share sensitive personal data in chats. Suggestions are for general information and can be wrong; see the Terms.

We share personal data only with service providers that process it on our behalf, and only as needed for the purposes above:

Hosting: Hetzner, with servers in Germany.
Network and security: Cloudflare.
Smart assistant: an AI service provider based in the United States.
Email delivery: Resend.
App notifications: Expo and the push notification services of Apple and Google, if you allow notifications in the app.
Sign-in: Google or Apple, if you choose to sign in with them.
Fonts: our web pages load typefaces from Google Fonts, which receives your IP address and browser information to deliver them.
Payments: Paddle.com Market Ltd., our Merchant of Record, which processes payment, tax, receipt and fraud-prevention data as a controller under its own privacy policy.

We may also disclose personal data when the law requires it, to protect the rights and safety of our users, or to a successor if Combup is sold or merged, which would remain bound by this policy. We don't sell personal data and we don't share it with advertisers.

Cookies and similar technologies

Strictly necessary cookies: a secure cookie that keeps you signed in and a short-lived cookie that protects Google sign-in. Cloudflare may set a cookie that protects the site against automated abuse. Paddle's checkout may use Paddle's own cookies to process your payment.
Browser storage: we keep a random ID for your browser and a note that you've signed in before in your browser's local storage. The ID keeps your guest searches separate, helps us protect the service from abuse and lets us count searches in aggregate, as described above.

Combup Canada pages don't load advertising or third-party analytics scripts and don't set advertising cookies, so there's nothing to opt in to. If this changes, we'll ask for your consent first.

Where your data is processed

Combup is operated from Türkiye, and your data is stored on servers in Germany. Some of the service providers listed above process data in the United States, the European Union or the United Kingdom. This means your personal information is processed outside Canada and, if you live in Québec, outside Québec, and may be accessible to the courts and authorities of those countries under their laws. We use providers that commit by contract to protect personal information and to use it only on our behalf. You can ask us for more information. We protect data with encryption in transit, access controls and regular backups.

How long we keep it

Account, chat and saved item data are kept until you delete them or your account. Subscription and payment records are kept after account deletion only as long as tax and accounting laws require, up to 10 years. Receipts are issued and kept by Paddle. Server logs are temporary. Records of your email choices are kept as long as needed to show we honoured them. Deleted data can remain in backups for up to 30 days before it is removed from them too.

Your rights

You have the right to:

access the personal information we hold about you and get a copy of it;
have inaccurate or incomplete information corrected;
withdraw your consent where we rely on it, subject to legal or contractual restrictions;
have your data deleted: you can delete your account and all your chats at any time with Delete account in the account menu, or ask us to delete specific data; and
if you live in Québec, ask for the information you gave us in a structured, commonly used technological format, and ask us to stop disseminating it.

To use these rights, email [email protected] from the email address on your account, so we can confirm it's you. We'll answer within 30 days. There is normally no fee. The person responsible for the protection of personal information at Combup is its owner, Emirhan Güven, who can be reached at the same address.

If you're unhappy with how we handle your information, please tell us first so we can try to put it right. You can also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, if you live in Québec, to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

Children

Combup isn't intended for children under 13 and we don't knowingly collect personal data from them. If we learn that a child under 13 has given us personal data, we delete it. If you believe this has happened, email [email protected].

Changes to this policy

When we change this policy we update the date above. For material changes we tell you by email or in the service before they take effect.

Contact

Questions or requests: [email protected]. EMİRHAN GÜVEN GÜVEN YAZILIM HİZMETLERİ, Cennet Mah., Hürriyet Caddesi, Koza Apt. No: 83, Door 3, 34290 Küçükçekmece, Istanbul, Türkiye.