AI 3D Privacy and Data Protection Notice

1. Scope and operator

This notice explains optional AI 3D connected through a parent’s own provider account in PEKO releases that offer it. It supplements the app privacy policy. On-device drawing recognition and 2D animation are separate from this online feature. Some distributions may omit it; its presence is not an assertion that a provider has approved use by children.

PEKO’s operator is Sercan Göger (Corylustech), Turgut Reis Mahallesi, Karaosmanoğlu Caddesi, Esenler / İstanbul; contact privacy@pekogames.com. This notice remains a draft because the operator telephone has not been supplied. Whether a provider acts as a controller or processor depends on its actual relationship and processing; we do not claim that all providers act only on our instructions.

2. What data is processed?

• On the device: provider selection, permission choices and text version/date, usage mode, daily/weekly limits, connection result, generation history and downloaded models. The key is kept in the platform’s secure store.
• Sent to the provider: the selected drawing as a PNG image, model/generation options, the parent’s API key for authentication and necessary technical fields such as a job identifier. The image may be uploaded or embedded in the request, depending on the integration. Connection and credit checks also make authenticated requests to the provider.
• During the connection: the provider and its network services may process IP addresses, timestamps and connection/security records. PEKO does not separately attach a name, voice recording, photo or location as generation input; names or personal information drawn into the image can still be present. We do not promise that no personal data is ever sent.

Requests go directly from this device to the selected provider, without a PEKO generation server in between. This does not mean the provider uses no subcontractors. PEKO’s separate diagnostics/statistics flows are explained in the main privacy policy.

3. Purpose, choices and legal basis

The purpose is to generate a 3D model from a selected drawing, download the result, manage the connection and apply local usage limits. You can use core drawing and 2D play without permitting this service.

The four choices in the connection flow are a local record of which wording was accepted and when. Reading a notice is not consent to every processing activity. A parent PIN is not identity/parental-authority verification or a COPPA verifiable parental consent method. Opening a provider account does not itself make processing a child’s data lawful.

Where processing requires consent, valid, informed, specific and freely given consent from the person or their legally authorised representative is required. Other grounds, such as contractual necessity, a legal obligation or legitimate interests, apply only where their actual conditions are met. Child-directed availability, age rules, international transfer grounds and required agreements must be verified before release; the four switches do not establish all of these.

4. Providers and international transfers

The current app catalog has connectable integrations for Meshy, Tripo, Hyper3D Rodin and Replicate. Policy links and unsupported services are listed in the AI services guide. Technical compatibility does not imply permission for every country, age or account.

Provider infrastructure may be outside Türkiye; locations, subprocessors and agreements depend on the provider and account. A consent checkbox alone does not make an international transfer lawful without the applicable safeguards or other required conditions. PEKO does not claim to have signed/filed standard transfer contracts with every provider or to keep all data exclusively in Türkiye or the EU.

5. Retention, training and output rights

There is no single retention period shared by all providers. Expiry of a file or download link does not establish that account, payment, security, backup or training data has also been deleted. Check the provider’s applicable policy and plan for retention and deletion options.

Provider terms may permit use of inputs and outputs for service improvement or model training. For example, Meshy’s non-Enterprise terms include input/output training provisions. We do not promise that no provider uses drawings for training. Submit only content you have the necessary rights to use and respect the privacy of anyone concerned.

Downloaded models and local usage records may remain until the relevant device files or app data are removed. Results may be inaccurate, unsuitable or subject to someone else’s rights; ownership, exclusivity and commercial-use permission are not automatically guaranteed.

6. Withdrawal and deletion

1. Disable the provider or withdraw permission under Parent area → AI 3D services. This stops new submissions; not every provider supports cancelling a remote job already started, and charges may already have arisen.
2. Disconnecting removes the API key from this device. It does not delete the provider account, invalidate the key on the provider’s servers or erase previously submitted data. Revoke the key in the provider dashboard when needed.
3. For provider-side inputs, outputs, account records and other data, use the request/deletion route in that provider’s privacy policy. We cannot claim to delete those records automatically from PEKO.
4. For local models, drawings, history and backups, follow the deletion guide. Manage exported copies and operating-system backups separately.

Withdrawal does not retrospectively invalidate earlier lawful processing. Deletion may be subject to applicable retention obligations or protection of legal rights; it does not create a right to retain everything indefinitely.

7. Rights and requests

Under Turkish data protection law, rights include learning whether data is processed, requesting information, learning the purpose and whether use matches it, identifying recipients, requesting correction and deletion/destruction where conditions apply and notification to recipients, objecting to an adverse result based exclusively on automated analysis and seeking compensation for unlawful processing. Where applicable, GDPR/UK GDPR access, restriction, portability, objection and supervisory-authority complaint rights are also preserved.

For PEKO’s processing, email privacy@pekogames.com. Describe the request, relevant feature and reply address; do not send an API key, parent PIN or unnecessary information about a child. Necessary, proportionate identity/authority checks may be requested. KVKK requests are answered within 30 days and GDPR requests normally within one month; lawful extensions, exceptions and formal procedures are explained in the main privacy policy. A separate request to the provider may be needed for its own processing.