Privacy Policy

Last updated 11 November 2026

This policy explains what personal information Combup collects when you use it in New Zealand (combup.com/nz and the Combup app), why we use it, who we share it with, where it is held, how long we keep it and how you can access and correct it. We handle personal information in line with the Information Privacy Principles (IPPs) in the Privacy Act 2020. In short: we use your information to run the service you ask for, we don't sell it, we don't use it for targeted advertising, and you can delete your account and data at any time.

Who we are

Combup is operated by EMİRHAN GÜVEN GÜVEN YAZILIM HİZMETLERİ, a sole proprietorship registered in Türkiye, which is responsible for your personal information. Postal address: Cennet Mah., Hürriyet Caddesi, Koza Apt. No: 83, Door 3, 34290 Küçükçekmece, Istanbul, Türkiye. Email: [email protected].

Personal information we collect

Account: your email address, your name if you give it, and an irreversible hash of your password. If you sign in with Google or Apple, we receive an account ID, your email address (or Apple's private relay address) and your name. We never receive your Google or Apple password.
Chats: the messages you write to the smart assistant, its replies and the products shown. They are kept with your account until you delete them or your account. We count how many questions you ask each day to apply your allowance.
Photos for photo search (Premium): when you search with a photo, the image is read in memory on our server only for that search: we detect the clothing item and compute a visual fingerprint to compare it with products. We don't store the photo or the fingerprint, we don't use it to identify anyone, and we don't share it. Only a count of the search is kept for your daily allowance.
Saved items and preferences: the products you save and any size or style preferences you choose to keep with your account.
Subscription records: if you buy Premium, Paddle sends us the limited information we need to manage it: Paddle customer, transaction and subscription IDs, the subscription status, the end of the current period and the result of each payment. We never receive your card number.
Search statistics: a structured summary of searches (filters such as category and colour) linked to an irreversible hash of a random browser ID, used to show trends, and anonymous counters such as which product was opened or when someone continued to a store, deleted after 90 days.
Technical data: IP address and browser information in temporary server logs, used for security and to prevent abuse.

We collect this information directly from you or from your use of the service. You can browse and search Combup without an account. We don't collect your precise location, and we don't ask for sensitive information such as health information or racial or ethnic origin. Please don't share it in chats. If you also use Combup in another country with the same account, the features you use there are described in that country's privacy notice.

Why we collect and use it

To provide Combup (your account, search, the assistant, chat history, saved items, photo search and Premium) and to answer your support, payment and refund requests.
To keep Combup secure, prevent abuse and fraud and apply daily limits.
To understand general usage and improve Combup, including improving our own search systems from chats with the assistant. Email addresses, phone numbers, postal addresses and ID numbers are masked automatically before such records are stored. You can ask us to stop at any time by emailing [email protected], and we'll stop for your account straight away.
To send emails: account and subscription emails (welcome, receipts, security) are part of the service. Other emails, such as tips, product news and offers, are sent only with your consent, as the Unsolicited Electronic Messages Act 2007 requires, and every one has a working unsubscribe link.
To keep tax and accounting records and respond to lawful requests.

We don't use or disclose your personal information for other purposes unless you consent or the law allows it. The assistant's suggestions are product recommendations only; we don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

The smart assistant

Your messages to the assistant are sent to our AI service provider in the United States so that it can generate a reply. The provider processes them only on our behalf. Please don't share sensitive personal information in chats. Suggestions are for general information and can be wrong; see the Terms.

We disclose personal information only to service providers that handle it on our behalf, and only as needed for the purposes above:

Hosting: Hetzner, with servers in Germany.
Network and security: Cloudflare.
Smart assistant: an AI service provider based in the United States.
Email delivery: Resend.
App notifications: Expo and the push notification services of Apple and Google, if you allow notifications in the app.
Sign-in: Google or Apple, if you choose to sign in with them.
Fonts: our web pages load typefaces from Google Fonts, which receives your IP address and browser information to deliver them.
Payments: Paddle.com Market Ltd., our Merchant of Record, which handles payment, tax, receipt and fraud-prevention information under its own privacy policy.

We may also disclose personal information when the law requires it, to protect the rights and safety of our users, or to a successor if Combup is sold or merged, which would remain bound by this policy. We don't sell personal information and we don't share it with advertisers.

Disclosure outside New Zealand

Combup is operated from Türkiye, and your information is stored on servers in Germany. Some of the service providers listed above handle information in the United States, the European Union or the United Kingdom. Before disclosing information overseas we make sure, through our providers' data processing terms, that it will be protected by safeguards comparable to those in the Privacy Act 2020 (IPP 12). We protect information with encryption in transit, access controls and regular backups. You can ask us for more information about these arrangements.

Cookies and similar technologies

Necessary cookies: a secure cookie that keeps you signed in and a short-lived cookie that protects Google sign-in. Cloudflare may set a cookie that protects the site against automated abuse. Paddle's checkout may use Paddle's own cookies to process your payment.
Browser storage: we keep a random ID for your browser and a note that you've signed in before in your browser's local storage. The ID keeps your guest searches separate, helps us protect the service from abuse and lets us count searches in aggregate, as described above.

Combup New Zealand pages don't load advertising or third-party analytics scripts and don't set advertising cookies. If this changes, we'll ask for your consent first.

How long we keep it

Account, chat and saved item data are kept until you delete them or your account. Subscription and payment records are kept after account deletion only as long as tax and accounting laws require, up to 10 years. Receipts are issued and kept by Paddle. Server logs are temporary. Records of your email choices are kept as long as needed to show we honoured them. Deleted data can remain in backups for up to 30 days before it is removed from them too. When we no longer need personal information, we delete or de-identify it.

Access, correction and deletion

You can ask for access to the personal information we hold about you and get a copy of it.
You can ask us to correct information that is inaccurate, out of date, incomplete or misleading.
You can delete your account and all your chats at any time with Delete account in the account menu, or ask us to delete specific information.
You can opt out of marketing emails at any time with the unsubscribe link.

To make a request, email [email protected] from the email address on your account, so we can confirm it's you. We'll respond within 20 working days. There is no fee. If we refuse a request, we'll tell you why in writing.

Complaints

If you think we've breached the IPPs or mishandled your personal information, please email [email protected] first and describe the problem. We'll acknowledge your complaint and respond within 20 working days. If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner: privacy.org.nz.

Data breaches

If a data breach is likely to result in serious harm to you, we'll notify you and the Privacy Commissioner as required by the Privacy Act 2020.

Children

Combup isn't intended for children under 13 and we don't knowingly collect personal information from them. If we learn that a child under 13 has given us personal information, we delete it. If you believe this has happened, email [email protected].

Changes to this policy

When we change this policy we update the date above. For material changes we tell you by email or in the service before they take effect.

Contact

Questions or requests: [email protected]. EMİRHAN GÜVEN GÜVEN YAZILIM HİZMETLERİ, Cennet Mah., Hürriyet Caddesi, Koza Apt. No: 83, Door 3, 34290 Küçükçekmece, Istanbul, Türkiye.