Privacy Policy

The data controller for your personal data is Mehmet Maşa, who provides the Regu service.

• Address: Hacıilbey Mahallesi, Ali Hikmet Paşa Caddesi No: 27/C, Altıeylül, Balıkesir, Türkiye
• Tax office and number: Kurtdereli Tax Office, 6131161237
• Email: hi@regu.io

For any question or request about this policy, write to us by email.

Account

• Your email address.
• If you sign in with Apple or Google, the identifier and email the provider shares with us. If you choose “Hide My Email” with Apple, we only receive Apple's relay address.
• Your password is stored by Amazon Cognito; we can't see it.

What you tell us and your site

• Your chat messages — typed or dictated — and the business details in them.
• Photos and logos you upload.
• Your site's text, design, code and published versions.

Purchases

• Your subscription plan and status, your credit transactions and your order records.
• Your card details never reach us; payments are taken by Apple or Stripe.

If you buy a domain

• Your name, address, phone number and email, as required for registration.

Notifications

• If you allow notifications, the notification token needed to send them to your device.

Technical information

• To verify purchases, RevenueCat processes technical information about your device and the app (such as device type, operating system and app version, and App Store country).
• We don't keep your IP address in our own database.

What we don't collect

• Your location, contacts or advertising identifier. We don't track you across other apps or websites.

• Microphone and speech recognition: When you tap the microphone, what you say is turned into text by Apple's speech recognition service, which may do this on your device or on Apple's servers. Your audio never reaches us; we only receive the resulting text, as a chat message, when you send it.
• Camera and photos: Only the photo you take or choose is uploaded. We don't access the rest of your library.
• Notifications: Sent only if you allow them.

All permissions are optional and can be withdrawn at any time in your iPhone's Settings.

• To provide the service (entering into and performing our contract with you): creating your account, building your site with AI, previewing and publishing it, registering your domain.
• For payments and subscriptions (performing the contract): managing your subscription and credits correctly.
• For security and to prevent abuse (legitimate interest): stopping fake accounts and misuse of the service, and finding errors.
• For legal obligations: where the law requires us to keep data or hand it to authorities.
• With your permission: microphone, camera, photos and notifications.

We only send you emails about the service (verification codes, important changes); we don't send marketing emails. We don't use your content to train AI models.

To build your site, your chats and site content are sent to AI models on Amazon Bedrock, a service of Amazon Web Services. AWS does not use this content to train models and does not share it with model providers. Relace's code-editing model is used when your site's code is edited, and fal.ai when images are generated; these services receive only the content needed for that job.

Sites published with Regu also collect limited data from their visitors:

• Contact form: the name, phone number, email and message a visitor enters. These messages arrive in your inbox.
• Page views: only which page was viewed and when. No IP address, device identifier or cookie is stored; the IP address is used momentarily to limit abuse.

For this data, you — as the site owner — are the data controller; Regu processes it on your behalf, only to show it to you. Informing your visitors (for example with a privacy notice on your site) is your responsibility.

We don't sell your data. To provide the service, we share it with the following providers, only as far as they need it to do their job:

• Amazon Web Services (USA): servers, database, file storage, sign-in (Amazon Cognito), DNS, content delivery and AI models (Amazon Bedrock).
• E2B (USA): the temporary virtual environment your site's preview runs in.
• Relace (USA): the repository holding your site's code and the images you upload, and the code-editing model.
• fal.ai (USA): generating images for your site.
• Apple: Sign in with Apple, App Store payments, speech recognition and notifications.
• Google: Sign in with Google.
• RevenueCat (USA): verifying App Store purchases and tracking subscription status; to do so it also processes device and app information.
• Stripe: web payments.
• Resend (USA): sending email (verification codes, contact form).
• Expo (USA): delivering notifications to your device.
• Domainnameapi: our domain registrar; your registration details are also passed to the registry for the extension.

We may also share data with authorities where the law requires it.

Our servers and most of our providers are in the United States (AWS us-east-1 region), so your data is transferred outside Türkiye and the European Union. The transfer is necessary for us to provide the service and relies on our providers' data protection commitments.

• While your account is open, we keep your account details, sites, chats and purchase records.
• When you delete a site, its chat, code, uploaded images, published files, versions and visitor messages are deleted.
• When you delete your account, deletion is immediate and permanent: your published sites go offline right away, and your account details, all of your sites with everything listed above, your credits, and your subscription and order records are deleted.
• Backups: Automated backups of our database go back 7 days and are used only to recover data after a system failure — never to bring back a deleted account. Your deleted data drops out of the backups within 7 days at most.
• The preview environment is paused when not in use and deleted after 3 days; your site isn't lost, it's rebuilt the next time you open it.
• Server logs are kept for troubleshooting and deleted after 30 days at most.

Exceptions: Apple, Stripe and RevenueCat keep payment records under their own legal obligations and policies. Your domain registration details stay with the registrar for as long as the domain is registered.

Under Article 11 of Türkiye's Personal Data Protection Law (KVKK), and under the GDPR if you live in the European Union, you have the right to:

• find out whether your data is processed and get a copy of it
• have inaccurate or incomplete data corrected
• have your data deleted
• learn the purpose of processing and who your data is transferred to
• object to processing and ask for it to be restricted
• receive your data in a portable format
• object to an outcome against you that results solely from automated analysis
• claim compensation if you suffer damage from unlawful processing

You can delete your sites and your account yourself in the app. For any other request, write to hi@regu.io; we reply within 30 days at most. If you're not satisfied with our answer, you can complain to Türkiye's Personal Data Protection Authority or, if you live in the EU, to your country's data protection authority.

• All traffic between the app and our servers is encrypted (HTTPS).
• Your password is held by Amazon Cognito and never reaches our servers.
• Our database runs on a private network that can't be reached from the internet.
• Access to data is limited to the people who need it to run the service.

No system is completely secure. If a breach affects your data, we'll inform you and the relevant authority as the law requires.

regu.io and app.regu.io only use the cookies they need to work:

• Language: remembers the language you chose; kept for 1 year.
• Session: keeps you signed in on app.regu.io.

Your theme choice is kept in your browser's own storage. We don't use advertising or analytics cookies. Regu doesn't set cookies of its own on visitors to the sites it publishes.

Regu is not meant for anyone under 18, and we don't knowingly collect data from children. If we find such an account, we delete it.

We may update this policy; the current date is always shown at the top of this page. We'll email you before any update that significantly changes how we handle your data takes effect.