As MMSS (“Company”, “we”, “us” or “our”), the privacy and security of your personal data is our priority. This Privacy Policy explains how we collect, process, and store your personal data in connection with our AI-based application AI.Tarot.Reading, in compliance with the General Data Protection Regulation (GDPR) of the European Union.
This Privacy Policy has been prepared in compliance with the General Data Protection Regulation (GDPR – Regulation (EU) 2016/679) and, where applicable, Law No. 6698 on the Protection of Personal Data (“KVKK”) of the Republic of Turkey.
If you have any questions about these Terms or need to get in touch with us, please email us at https://onemorething.technology/contact/.
By accessing and using this Website and/or the Application and/or the Web Application, you are deemed to have read and accepted this policy. If you do not agree to the terms of this Policy, you must not continue to use the Website, Application and/or its services.
This policy was last updated on 17 June 2025.
1. Scope
This policy applies in the following situations:
When you use our Application,
When you interact with our services or communicate with us directly.
2. What is Personal Data?
Personal data is any information relating to an identified or identifiable living individual. Different pieces of information that, when collected together, can lead to the identification of a particular person, also constitute personal data.
Examples of personal data include:
Full name
Home address
An email address like name.surname@company.com
Identity card number, etc.
Photograph
Data relating to an individual’s race, ethnic origin, political opinions, philosophical beliefs, religion or other beliefs, appearance and attire, membership in associations, foundations, or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data, are classified as special categories of personal data.
Your personal data may only be processed if permitted by law and the relevant legislation, or with your explicit consent for the processing of such personal data.
3. Data We Collect (What Personal Data Do We Collect and How Do We Obtain It?)
In order to provide our application and services and enhance your experience, we collect the following types of data:
a) Data You Actively Provide:
* Registration information such as your email address or details provided via social media integration
* Photographs you upload (If you upload personal photographs (e.g., facial images) to the Platform for the purpose of generating content, such data may qualify as special categories of personal data under the GDPR (e.g., biometric data that can uniquely identify a person) and under Turkish Law No. 6698 (KVKK).
We only process such data based on your explicit and informed consent, in compliance with Article 9 of GDPR and Article 6 of the KVKK. This data is used solely for the purposes of training and improving AI models or generating personalized outputs.
You may withdraw your consent at any time by contacting us at https://onemorething.technology/contact/. Upon withdrawal, your special category data will be deleted unless otherwise required by law.
You must not upload third-party facial images or other sensitive data without their explicit consent.)
* Prompts you write for image generation
b) Automatically Collected Data:
* Hardware, software, and device details
* IP address, device type, browser type, and operating system
* Preferred language, region
* In-app and website navigation data
* Application usage and interaction records
c) Third-Party Services We Use:
We use Third-Party Services to;
a) Log crash data and report it back to our development team, allowing us to continually improve the service,
b) Send you push notifications,
c) Marketing automation and customer support,
d) Automate messaging to our users based on analytics anonymously.
We also use Google © and Apple © Login for social media integration.
All rights to the products and services mentioned above are reserved.
If you choose to link your existing accounts from other providers (e.g., social media platforms) with our services, we may receive limited data such as your email address, name, and other relevant registration details to simplify account creation.
We may also use non-identifiable data to improve our products and services.
4. Financial Information
Company offers both free and paid access to its products and services. If you opt for paid services, you will be required to enter your banking details via a third-party payment system. Please note that this system is not operated by Company, and we do not collect or store any financial data.
If you choose to access our services for a fee, your banking details will neither be processed nor retained by us.
When necessary, personal and financial data may be shared with competent authorities for fraud prevention, security, legal obligations, and compliance purposes.
We may monitor your interactions with our consultancy and related services when required for security, regulatory, or compliance reasons. All such monitoring is subject to strict confidentiality and data protection provisions.
Non-personal data (i.e., data that does not identify individuals) may be used to enhance our products and services.
Categories of Personal Data We May Collect Based on Your Interaction
* Identity Information: Name, username, email address, language
* Contact Information: Email, phone number, country/region
* Technical Information: IP address, device info, browser type and version, operating system
* Usage Data: In-app interactions, usage preferences, logs
* AI Inputs/Outputs: Inputs to our AI models may be used for training and improvement purposes only after anonymization. Any data used for this purpose will have identifying elements removed to ensure it cannot be linked to individuals.
* Special Categories of Personal Data are strictly not processed without your explicit and informed consent.
* This application is not intended for children under the age of 17, and we do not knowingly collect personal data from such individuals. If such data is discovered, it will be promptly deleted.
Note: Automated Decision-Making and Profiling
There is no automated decision-making process (such as user profiling) applied to users’ data. In accordance with Article 5 of the KVKK, no decisions are made solely based on automated processing which would produce legal or significant effects concerning the data subject.
5. Purposes of Processing
Your personal data is processed for the following purposes:
* To operate and provide our services
* To improve user experience
* To train and optimize AI models
* To provide technical support
* To comply with legal obligations
* To send marketing communications and updates (only with your explicit consent)
6. Legal Bases for Processing
We rely on the following legal bases under Article 6 of the GDPR:
* Performance of a contract – to provide services and support
* Legitimate interest – to ensure security and performance of our application
* Consent – for marketing activities and personalized features (you may withdraw consent at any time)
* Legal obligation – to meet tax, accounting, or regulatory requirements
7. Data Sharing and Transfers
We may share your personal data with the following:
* Cloud service providers (e.g., Digital Ocean, Google Cloud)
* Analytics and performance tools (e.g., Google Analytics, Mixpanel, Sentry, Amplitude)
* API’s of other service providers (e.g., OpenAI)
* Authorities when required by law.
If your data is transferred outside the European Economic Area (EEA), such transfers are conducted under appropriate safeguards in accordance with Articles 44–49 of the GDPR, such as Standard Contractual Clauses (SCCs).
8. Data Retention
Your personal data will be retained only as long as necessary to fulfill the purposes stated above and comply with applicable legal obligations.
Data no longer required will be regularly deleted, anonymized, or securely destroyed.
Any photographs you upload to our Website, Web Application and/or Application are deleted after 30 days.
9. Your Rights
Under GDPR you have various rights in relation to your personal data (as listed below).
All of these rights can be exercised by sending us an e-mail to https://onemorething.technology/contact/.
Verification: in order to verify your request, we will take reasonable steps such as asking you to send us a confirmation from the email address associated with your account, so that we can verify that you are the owner of this email account. If there is no email address associated with your account, we may ask you for proof of ID.
Right to withdraw consent: You have the right to withdraw your consent at any time by notifying us by email to the following address: https://onemorething.technology/contact/. By withdrawing your consent, the lawfulness of the processing based on consent up until the point of withdrawal will not be affected.
Right to object: You have a right to object under the conditions of Article 21 DSGVO. Below you will find more detailed information:
— Right to object where the processing is based on legitimate interests: As a data subject, you have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on Article 6 (1) (e) or (f) GDPR, including profiling based on those provisions. In the event of an objection relating to your particular situation, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
— Right to object where we process your personal data for statistical purposes: If we process your personal data for statistical purposes pursuant to Article 9 (2) (j) DSGVO you have the right to object to such processing for reasons arising from your particular situation. In the event of such an objection, we will no longer process the personal data concerned for this purpose unless the processing is necessary to fulfil a task in the public interest, or the discontinuation of processing is likely to make it impossible or seriously impair the realization of statistical purposes and the continuation of processing is necessary for the fulfilment of statistical purposes.
— Right to object to direct marketing: Where your personal data are processed for direct marketing purposes, you have the right to object at any time to processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, we no longer process your personal data for these purposes.
To exercise your rights of objection, you may contact us at any time by sending an e-mail to https://onemorething.technology/contact/.
Right to be informed: As a data subject, you have a right to obtain access and information under the conditions provided in Article 15 GDPR. This means in particular that you have the right to obtain confirmation from us as to whether we are processing your personal data. If so, you also have the right to obtain access to the personal data and the information listed in Article 15 (1) GDPR. This includes information regarding the purposes of the processing, the categories of personal data that are being processed and the recipients or categories of recipients to whom the personal data have been or will be disclosed.
Right to erasure / “Right to be forgotten”: As a data subject, you have a right to erasure (“right to be forgotten”) under the conditions provided in Article 17 GDPR. This means that you generally have the right to obtain from us the erasure of your personal data and we are obliged to erase your personal data without undue delay when one of the reasons listed in Article 17 (1) GDPR applies. You can do this by deleting your account at any time. If we have made the personal data public and are obliged to erase it, we are also obliged, taking account of available technology and the cost of implementation, to take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you have requested the erasure by such controllers of any links to, or copy or replication of those personal data (Article 17 (2) of the GDPR. The right to erasure (“right to be forgotten”) does not by exception apply if the processing is necessary for one of the reasons listed in Article 17 (3) GDPR. This can be the case, for example, if the processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims (Article 17 (3) (b) and (e) GDPR).
Right to restriction of processing: As a data subject, you have a right to restriction of processing under the conditions provided in Article 18 GDPR. This means that you have the right to obtain from us the restriction of processing if one of the conditions provided in Article 18 (1) GDPR applies. This can be the case, for example, if you contest the accuracy of the personal data. In such a case, the restriction of processing lasts for a period that enables us to verify the accuracy of the personal data (Article 18 (1) (a) GDPR). Restriction means that stored personal data are marked with the goal of restricting their future processing (Article 4 No. 3 GDPR).
Right to data portability: As a data subject, you have a right to data portability under the conditions provided in Article 20 GDPR. This means that you generally have the right to receive your personal data with which you have provided us in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance from us if the processing is based on consent pursuant to Article 6 (1) (a) or Article 9 (2) GDPR or on a contract pursuant to Article 6 (1) (a) GDPR and the processing is carried out by automated means (Article 20 (1) GDPR). In exercising your right to data portability, you also generally have the right to have your personal data transmitted directly from us to another controller if technically feasible (Article 20 (2) GDPR).
Right to Rectification: As a data subject, you have the right to rectification under the conditions provided in Article 16 GDPR. This means in particular that you have the right to receive from us without undue delay the rectification of inaccuracies in your personal data and completion of incomplete personal data.
Right to complain: As a data subject, you have a right to lodge a complaint with a supervisory authority under the conditions provided in Article 77 GDPR.
10. Data Security
We implement appropriate technical and organizational measures to protect your data, including but not limited to:
* SSL encryption
* Access controls
* Data minimization
* Regular audits
11. Cookies
Our website uses cookies to enhance user experience. You can manage your cookie preferences or learn more by visiting our Cookie Policy.
12. Contact
If you have any questions regarding this Privacy Policy or wish to exercise your rights, please contact us at: https://onemorething.technology/contact/.
Company : MMSS