Privacy Policy

Last updated 29 October 2026

This policy explains what personal data Combup collects when you use it in the United Kingdom (combup.com/uk and the Combup app), why we use it, who we share it with, where it is processed, how long we keep it and what rights you have under UK data protection law, including the UK GDPR and the Data Protection Act 2018. In short: we use your data to run the service you ask for, we don't sell it, we don't use it for targeted advertising, and you can delete your account and data at any time.

Who we are

Combup is operated by EMİRHAN GÜVEN GÜVEN YAZILIM HİZMETLERİ, a sole proprietorship registered in Türkiye, which is the controller of your personal data. Postal address: Cennet Mah., Hürriyet Caddesi, Koza Apt. No: 83, Door 3, 34290 Küçükçekmece, Istanbul, Türkiye. Email: [email protected].

Personal data we collect

Account: your email address, your name if you give it, and an irreversible hash of your password. If you sign in with Google or Apple, we receive an account ID, your email address (or Apple's private relay address) and your name. We never receive your Google or Apple password.
Chats: the messages you write to the smart assistant, its replies and the products shown. They are kept with your account until you delete them or your account. We count how many questions you ask each day to apply your allowance.
Photos for photo search (Premium): when you search with a photo, the image is read in memory on our server only for that search: we detect the clothing item and compute a visual fingerprint to compare it with products. We don't store the photo or the fingerprint, we don't use it to identify anyone, and we don't share it. Only a count of the search is kept for your daily allowance.
Saved items and preferences: the products you save and any size or style preferences you choose to keep with your account.
Subscription records: if you buy Premium, Paddle sends us the limited information we need to manage it: Paddle customer, transaction and subscription IDs, the subscription status, the end of the current period and the result of each payment. We never receive your card number.
Search statistics: a structured summary of searches (filters such as category and colour) linked to an irreversible hash of a random browser ID, used to show trends, and anonymous counters such as which product was opened or when someone continued to a store, deleted after 90 days.
Technical data: IP address and browser information in temporary server logs, used for security and to prevent abuse.

We don't collect your precise location, and we don't ask for special category data such as health or ethnicity. Please don't share it in chats. If you also use Combup in Türkiye or the US with the same account, the features you use there are described in their own privacy notices.

How we use it and our lawful bases

To provide Combup (your account, search, the assistant, chat history, saved items, photo search and Premium) and to answer your support, payment and refund requests: this is necessary to perform our contract with you.
To keep Combup secure, prevent abuse and fraud and apply daily limits: our legitimate interest in protecting the service and its users.
To understand general usage and improve Combup, including improving our own search systems from chats with the assistant: our legitimate interest in making the service better. Email addresses, phone numbers, postal addresses and ID numbers are masked automatically before such records are stored. You can object at any time by emailing [email protected], and we'll stop for your account straight away.
To send emails: account and subscription emails (welcome, receipts, security) are necessary for our contract with you. Other emails, such as tips, product news and offers, are sent only with your consent where the law requires it, and you can unsubscribe at any time with the link in each email.
To keep tax and accounting records and respond to lawful requests: compliance with our legal obligations.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. The assistant's suggestions are product recommendations only.

The smart assistant

Your messages to the assistant are sent to our AI service provider in the United States so that it can generate a reply. The provider processes them only on our behalf, as our processor. Please don't share sensitive personal data in chats. Suggestions are for general information and can be wrong; see the Terms.

We share personal data only with service providers that process it on our behalf, and only as needed for the purposes above:

Hosting: Hetzner, with servers in Germany.
Network and security: Cloudflare.
Smart assistant: an AI service provider based in the United States.
Email delivery: Resend.
App notifications: Expo and the push notification services of Apple and Google, if you allow notifications in the app.
Sign-in: Google or Apple, if you choose to sign in with them.
Fonts: our web pages load typefaces from Google Fonts, which receives your IP address and browser information to deliver them.
Payments: Paddle.com Market Ltd., our Merchant of Record, which processes payment, tax, receipt and fraud-prevention data as a controller under its own privacy policy.

We may also disclose personal data when the law requires it, to protect the rights and safety of our users, or to a successor if Combup is sold or merged, which would remain bound by this policy. We don't sell personal data and we don't share it with advertisers.

Cookies and similar technologies

Strictly necessary cookies: a secure cookie that keeps you signed in and a short-lived cookie that protects Google sign-in. Cloudflare may set a cookie that protects the site against automated abuse. Paddle's checkout may use Paddle's own cookies to process your payment.
Browser storage: we keep a random ID for your browser and a note that you've signed in before in your browser's local storage. The ID keeps your guest searches separate, helps us protect the service from abuse and lets us count searches in aggregate, as described above.

Combup UK pages don't load advertising or third-party analytics scripts and don't set advertising cookies, so there's nothing to opt in to. If this changes, we'll ask for your consent first.

Where your data is processed

Combup is operated from Türkiye, and your data is stored on servers in Germany. Some of the service providers listed above process data in the United States, the European Union or the United Kingdom. When personal data is transferred to a country that the UK doesn't recognise as providing adequate protection, we rely on the safeguards in our providers' data processing terms, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where the provider is certified. You can ask us for more information about these safeguards. We protect data with encryption in transit, access controls and regular backups.

How long we keep it

Account, chat and saved item data are kept until you delete them or your account. Subscription and payment records are kept after account deletion only as long as tax and accounting laws require, up to 10 years. Receipts are issued and kept by Paddle. Server logs are temporary. Records of your email choices are kept as long as needed to show we honoured them. Deleted data can remain in backups for up to 30 days before it is removed from them too.

Your rights

Under UK data protection law you have the right to:

access your personal data and get a copy of it;
have inaccurate data corrected;
have your data erased: you can delete your account and all your chats at any time with Delete account in the account menu, or ask us to delete specific data;
restrict how we use your data in some circumstances;
data portability: receive the data you gave us in a commonly used format;
object to processing based on our legitimate interests, and to direct marketing at any time; and
withdraw consent at any time where we rely on it, without affecting what we did before.

To use these rights, email [email protected] from the email address on your account, so we can confirm it's you. We'll answer within one month. There is normally no fee.

If you're unhappy with how we use your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk.

Children

Combup isn't intended for children under 13 and we don't knowingly collect personal data from them. If we learn that a child under 13 has given us personal data, we delete it. If you believe this has happened, email [email protected].

Changes to this policy

When we change this policy we update the date above. For material changes we tell you by email or in the service before they take effect.

Contact

Questions or requests: [email protected]. EMİRHAN GÜVEN GÜVEN YAZILIM HİZMETLERİ, Cennet Mah., Hürriyet Caddesi, Koza Apt. No: 83, Door 3, 34290 Küçükçekmece, Istanbul, Türkiye.