Who We Are
Elsewonder: AI Photo Editor (“Elsewonder”, “the app”) is developed and provided by Samet Buldanlıoğlu (“we”, “us”, “our”) under the developer name BuldAI Labs, in Türkiye. BuldAI Labs is a developer name, not a company or registered legal entity. The Android app is published under the package name com.buldailabs.elsewonder.
Samet Buldanlıoğlu is the data controller for the personal data described in this policy.
This policy covers the Elsewonder app, the servers it uses to process photos and run your account, and this website. For any privacy question or request, write to support@elsewonder.com.
At a Glance
- Some features run on your phone. AI tools and several other tools send your photo to our servers, where it is processed by models running on those servers. We do not send your photos to third-party AI services.
- We use your photos to provide the features you choose. We do not sell them and we do not use them to train AI models.
- Free users may see Google AdMob ads when saving or sharing; where required, you are asked for consent first. Pro users see no ads.
- Pro subscriptions are handled by Google Play. We never see your card details.
- You can delete your account in the app. Some records, such as purchase records, are kept afterwards — the Data Deletion page explains exactly what.
Information We Collect
| Category | What it includes | Why |
|---|---|---|
| Guest account | A random installation identifier created on your phone (our server stores a keyed hash of it) and an internal account ID | To create your account without sign-up and to prevent abuse of free features |
| Registered account | Email address, display name, password (stored only as a one-way hash), sign-in method, verification status | To create and secure your account |
| Google sign-in | The email address and name Google shares with us when you sign in with Google | To sign you in |
| Photos and results | Photos you send to a server-side feature, a second image where a tool needs one (for example a new background), and the results | To run the tool you chose and return the result |
| Purchases | Google Play purchase token, order ID, product, plan and offer, subscription status, renewal and expiry, a pseudonymous account reference and Google’s verification response | To verify and activate Pro and handle renewals, refunds and disputes |
| Advertising (Free) | Collected by Google AdMob: for example advertising ID, device information, IP address, ad interactions and your consent choices | To show ads to Free users |
| Technical data | IP address, app version and platform, request and error records; server logs may also contain your email address | To run the service, keep it secure and limit abuse |
| Messages to us | Your email address and what you write | To answer you |
We do not ask for your location, contacts or phone number. The app asks for camera access only if you take a photo with it, and uses the Android photo picker or storage access to open and save photos.
Your Photos: On Your Phone or On Our Servers
On your phone. Most creative looks, cut-outs that the app makes on the phone, crop and rotate, collage, drawing, text, stickers and watermark run on your device. Projects and drafts are stored only on your phone.
On our servers. These features upload the photo to our servers: AI Enhance, Face Enhance, Colorize, Old Photo Restore, Sharpen, Background Remove, Background Replace, Makeup, Face Makeover, Image Blender, GIF Effects, Sketch, Glitch, Layers, Funny Mode and Skin Retouch. Saving from the editor also uses our servers when filters, adjustments, color, blur or perspective changes are applied. The photo is processed by AI and image models that run on our own servers; we do not send it to third-party AI services.
Mask service (Pro looks). Some light and atmosphere looks send smaller copies of the photo, and of the face areas found in it, to a separate mask service that works out, for example, where the subject is. These copies are processed in memory and are not written to disk; the computed masks may stay in the service’s memory for up to 24 hours, and detected face positions until they are replaced or the service restarts.
What we keep. Depending on the tool, the uploaded photo is deleted when processing finishes or is kept together with the result. Results are stored on our servers so the app can download them. Some results are linked to your account; others are stored without an account link at long, randomly generated web addresses rather than behind your sign-in. There is currently no fixed period after which stored photos and results are deleted automatically: results linked to your account are deleted when you delete your account, and other files remain until we remove them.
Photo metadata. For several tools the app uploads the photo file as it is stored on your phone, which can include metadata such as the date, camera model and, if your camera saved it, location. If you prefer not to share location data, remove it from the photo or turn off location tagging in your camera app.
What we never do. We do not sell your photos, we do not use them to train AI models and we do not publish them.
Face Features
Face Enhance, Makeup, Face Makeover, Funny Mode and some looks detect faces and facial landmarks in your photo so the edit lands in the right place. This happens on our servers, only to apply the edit you chose. We do not create face templates, we do not identify people and we do not store facial geometry in our database.
Face Makeover stores SHA-256 fingerprints (hashes) of the photos it processes so the same photo can be recognised within an editing session. A fingerprint cannot be turned back into the photo. There is currently no fixed period after which these fingerprints are deleted.
How We Use Information and Our Legal Bases
- To provide Elsewonder — your account, the features you use, saving and sharing, and Pro (performance of our contract with you).
- To verify purchases and keep records — handling subscriptions, renewals and refunds and meeting legal, tax and accounting obligations (contract and legal obligation).
- To keep the service secure — preventing abuse and fraud, limiting requests, investigating errors (our legitimate interest in a working, secure service).
- To show ads to Free users — through Google AdMob, with your consent where the law requires it.
- To send account emails — verification codes, password reset codes and the confirmation that your account was deleted (contract). We do not send marketing emails.
- To answer you — when you contact us.
For users in Türkiye, the corresponding grounds under Law No. 6698 on the Protection of Personal Data (KVKK) are the establishment and performance of a contract, compliance with legal obligations, our legitimate interests and, where required, your explicit consent. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Advertising
Elsewonder Free shows ads from Google AdMob: an interstitial ad may appear when you save or share. Elsewonder Pro shows no ads.
Where the law requires it — for example in the European Economic Area and the United Kingdom — the app uses Google’s consent tool to ask for your choices before ads are requested. You can change them later in the app under Settings → Privacy Options (shown when it applies to you).
AdMob may use your device’s advertising ID and other information to show and measure ads and, where you allow it, to personalise them. You can reset or delete your advertising ID in your Android settings. Google explains how it uses this data at policies.google.com/technologies/partner-sites.
Purchases and Subscriptions
Elsewonder Pro is sold as a Google Play subscription. Payment is handled entirely by Google Play; we never receive your card or payment details.
When you subscribe, our server receives the purchase information listed above from Google and checks it with Google before activating Pro. The app passes Google a pseudonymous reference derived from your account ID so a purchase can be matched to your account without sharing your email. Google also sends us notifications when a subscription renews, is cancelled or is refunded.
We keep purchase records after you delete your account, for as long as we need them to meet legal, tax and accounting obligations and to handle disputes.
International Transfers
We are based in Türkiye. Our servers and our service providers may process your information in other countries, including member states of the European Union and the United States, whose data protection laws may differ from those of your country. Where the law requires safeguards or your consent for such transfers, we rely on the mechanisms available for them.
How Long We Keep Information
| Information | How long |
|---|---|
| Account information | Until you delete your account. Afterwards a scrubbed account record without your email, name or password remains (see Data Deletion). |
| Guest accounts | Until you delete the account in the app. Inactive guest accounts are not currently deleted automatically. |
| Email verification codes | Valid for 5 minutes; removed when you delete your account. |
| Uploaded photos and results | Some uploaded photos are deleted when processing finishes. Results and other stored files have no fixed retention period yet; those linked to your account are deleted when you delete it. |
| Mask service | Processed in memory only; masks up to 24 hours, face positions until replaced or the service restarts. |
| Face Makeover fingerprints | No fixed retention period yet. |
| Purchase records | As long as needed for legal, tax and accounting obligations and disputes. |
| Server logs | No fixed retention period yet. |
| Messages to us | As long as needed to handle your request and any follow-up. |
| On your phone | Projects, drafts (up to 10, kept for up to 7 days) and settings stay until you delete them, clear the app’s data or uninstall the app. |
Security
The app talks to our servers over encrypted HTTPS connections. Passwords are stored only as one-way hashes, email verification codes are stored as keyed hashes and expire after 5 minutes, and sign-in tokens expire after 7 days. Payment details stay with Google Play.
As explained above, some processed images are stored at long, random web addresses rather than behind your sign-in. No system is completely secure, and we cannot guarantee the security of information sent over the internet. If you believe your account has been compromised, contact us at support@elsewonder.com.
Your Rights and Choices
Depending on where you live, including under the EU and UK GDPR and Türkiye’s KVKK, you have the right to:
- know whether we process your personal data and get a copy of it;
- have inaccurate data corrected;
- have your data deleted, or its processing restricted;
- object to processing based on our legitimate interests;
- receive data you gave us in a portable format;
- withdraw consent at any time (for ads, under Settings → Privacy Options), without affecting earlier processing;
- learn the purposes of processing and the recipients in Türkiye or abroad, object to a result reached solely through automated analysis, and claim compensation for damage caused by unlawful processing (KVKK Article 11).
You can delete your account yourself in the app (Profile → Settings → Delete My Data); the Data Deletion page explains what happens. For any other request, email support@elsewonder.com. We may ask for information to confirm that the account is yours, and we answer within the time limits set by applicable law.
You also have the right to complain to a data protection authority — for example the authority in your EU or EEA country, the UK Information Commissioner’s Office, or in Türkiye the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).
Children
Elsewonder is not directed to children under 13, and we do not knowingly collect personal data from them. If you are under the age at which you can consent to the processing of your personal data in your country, use Elsewonder only with the permission of a parent or guardian. If you believe a child has given us personal data, contact us and we will delete it.
This Website
This website is a static site hosted on Cloudflare Pages. It sets no cookies, uses no analytics and loads nothing from third parties. Cloudflare processes technical data such as IP addresses to deliver and protect the site.
Changes to This Policy
We update this policy when the app or the law changes. The “Last updated” date at the top shows the current version. For significant changes we will take reasonable steps to let you know, for example in the app.
Contact
Data controller: Samet Buldanlıoğlu (developer name: BuldAI Labs), Türkiye.
Email: support@elsewonder.com