Privacy Policy

1. Information we process

• Account and creator data: display name, username, email, authentication information, profile photo, bio, professional details, social links, services, portfolio, brands, testimonials, highlights, settings, subscription status, custom domain, and verification status.
• Client and visitor data: inquiry contact details and content, project information, messages, client-access activity where recorded, payment references or confirmations, and uploaded receipts.
• Private identity-verification data: your user-entered real/legal name, the minimum verified full name retrieved from an approved Didit decision, provider/session references, workflow, verification method and status, authenticity-evidence URLs or explanations you submit, review decisions, name/username change history, and audit timestamps. This information is not part of your public profile.
• Didit processes government-ID information, facial and liveness information, biometric data, and device, IP, and security signals. Showli does not store ID images, selfies, biometric templates, raw webhooks, full decision payloads, or unnecessary document details.
• Technical and security data: IP-related information, browser or device information where available, timestamps, logs, authentication events, rate-limit events, and Turnstile or other anti-abuse results.
• Subscription and financial-administration data: plan, status, billing-period request, externally paid amount, currency, method, reference, approval history, and related notes. Showli does not currently collect or store payment-card details or directly process creator-client funds.

2. Why we use information

• Create and secure accounts; authenticate users; publish and personalize creator profiles.
• At your request, verify government identity and review whether a public profile authentically represents the person or professional identity it claims to represent; prevent impersonation, fraud, and misleading identity claims.
• Deliver inquiries, projects, client access, messages, file links, payment-status tracking, custom domains, and customer support.
• Review manual Pro activation requests; maintain operational, moderation, verification, and audit records.
• Detect abuse, enforce rate limits, investigate security events, maintain the service, comply with law, and establish, exercise, or protect legal rights.
• Understand and improve product reliability and usability using operational information; Showli currently has no advertising or behavioral-analytics tracker.

3. Legal grounds

Depending on the context and applicable law, processing may be necessary to form or perform our service agreement, comply with legal obligations, establish or protect rights, pursue proportionate legitimate interests such as security and service operation, or rely on explicit consent where legally required. Consent is not presented as the sole basis for all processing, and the appropriate ground may differ by jurisdiction and activity.

4. Showli and creator roles

Showli processes information to provide and secure the platform. Creators receive inquiry, client, and project information for their own professional relationships and may independently decide how to use it outside Showli. A creator’s off-platform practices are their responsibility; creators should provide appropriate notices and comply with privacy law for their own business activities.

5. Service providers

We use service providers acting for infrastructure and operations, including Supabase for database, authentication, and storage; Vercel for hosting and domain infrastructure; Resend where configured for email delivery; Cloudflare Turnstile for anti-abuse verification; and Didit for optional identity verification. Providers may receive the information necessary for their function. External payment and file-link providers are selected or used outside Showli and operate under their own terms.

Didit hosts the underlying identity-verification experience and applies its configured retention controls. Showli does not receive or store the ID images, selfies, biometric templates, or full decision payload used in that process.

6. Sharing

We share information with the creator or client involved in an inquiry or project, with service providers needed to operate Showli, when you direct us to share it, and when required to comply with law, protect rights or safety, investigate abuse, or respond to a valid legal process. We do not sell personal data for advertising.

7. International transfers

Our providers may process or store information outside Türkiye. Cross-border transfers are handled subject to applicable data-protection requirements and safeguards where required. Provider locations and infrastructure can change, so we do not promise a specific data-center location.

8. Retention

We generally retain account and service information while the relationship exists. Inquiry, project, message, payment, verification-status, security, and audit records are retained as operationally necessary and for applicable legal, security, dispute, or recordkeeping needs. The Didit workflow is currently configured for one-month provider retention and deletion of its biometric template with the session. Deleted Showli content may persist temporarily in backups, and legal obligations may require longer retention.

9. Security

We use reasonable technical and organizational measures, including authenticated access, authorization controls, private storage where appropriate, rate limiting, anti-abuse checks, and security logging. No service or transmission is perfectly secure; protect your credentials and private project links.

10. Your choices and rights

Depending on applicable law, you may request access, information, correction, deletion or destruction, restriction, objection, portability, or withdrawal of consent where relevant. We may verify identity and explain lawful limitations or retention requirements. You may also complain to the competent data-protection authority.

11. Rights under Türkiye’s KVKK

Under Article 11 of Law No. 6698, where applicable, you may ask whether personal data is processed; request information; learn the purpose and whether data is used accordingly; learn recipients in Türkiye or abroad; request correction; request deletion or destruction under applicable conditions and notification of those actions to recipients; object to a result arising exclusively from automated analysis that is against you; and seek compensation where unlawful processing causes damage. Requests may be sent to the contact below, and applicable complaint rights remain available.

12. Children

Creator accounts are intended only for people aged 18 or older. We do not knowingly offer creator accounts to minors.

13. Cookies and local storage

Showli uses essential authentication and security technologies, a locale preference cookie, a short-lived recovery cookie when needed, and dashboard-theme local storage. Cloudflare Turnstile may use browser technologies for security. We currently do not use advertising cookies or non-essential analytics trackers. See the Cookie Policy for details.

14. Changes

We may update this Policy to reflect product, provider, or legal changes. Material updates will be communicated appropriately and identified by the updated date.