Privacy Policy

This Privacy Policy explains how Denali Digital collects, uses and shares personal data when you use Heritage: this website at heritage.denalidigital.co, the Heritage web app and the Heritage mobile apps for iOS and Android (together, the “Service”). It should be read together with our Terms of Service.

1. Who is responsible for your data

The data controller is Denali Digital Bilişim Limited Şirketi (“Denali Digital”, “we”, “us”), YENİ BAĞLICA MAH. ÇAMBAYIRI CAD. NO:126 İÇ KAPI NO:17 ETİMESGUT / ANKARA / TÜRKİYE. For any privacy question or request, write to support@denalidigital.co.

For purchases on this website, Paddle.com acts as our Merchant of Record and is responsible for the payment data it collects (see section 5).

2. What we collect

2.1 When you browse this website

Our pages are delivered by Google Firebase Hosting, which processes technical data such as your IP address, browser type and the pages you request in order to serve them and keep them secure. Some page components are loaded from other providers, which see your IP address when your browser fetches them: content delivery networks (Adjust, jsDelivr and cdnjs), Esri (the map images in the sample reports and in reports) and Google (fonts, and the files that run the Heritage web app).

The home page uses the Meta Pixel, a tool from Meta Platforms that measures our advertising on Facebook and Instagram. When you open the home page, it tells Meta that the page was viewed; in the checkout, it also tells Meta that you saw our plans, started the checkout, and started a free trial or bought a subscription, with the plan and its price. With these events Meta receives your IP address, browser and device details, the address of the page (including the click ID of a Meta ad that brought you here) and the identifiers in Meta’s cookies (see section 9). If you are logged in to Facebook or Instagram in the same browser, Meta can link them to your account. Meta uses them to tell us how our ads perform and to show our ads to people more likely to be interested.

Reading the sample reports does not set analytics or advertising cookies. Where this website offers a checkout, it gets the checkout ready as soon as you point at, focus on or tap a “Try it” button, or open a link that opens the checkout, so that it opens at once. From that moment the steps in section 2.2 apply, even if you do not go on to buy.

2.2 When the checkout gets ready, and when you buy on this website

• A guest account. We create an account in our backend, identified by a random ID stored in your browser (or the ID that Adjust gives your browser).
• Measurement. Adjust starts measuring which link or campaign brought you to Heritage. When you go to payment, we give RevenueCat a checkout ID with the Meta identifiers of your visit (section 2.1). Our servers use them to report your purchase, and later the end of a free trial or a renewal, to Meta’s Conversions API, which may include your email address in hashed form, and Meta counts the same purchase once.
• Your email address. Paddle uses it for your receipt and subscription emails, RevenueCat stores it with your subscription, and we use it to send you the link that opens Heritage on your phone.
• Purchase details. Your plan, price, currency, country, order and subscription IDs and subscription status, which we receive from Paddle and RevenueCat. Paddle collects your card or PayPal details and billing details directly; we never see your full card number.

2.3 When you use Heritage

• Photos you upload, which usually show faces, including old family photos you ask us to restore.
• Answers you give to create a report, such as your gender, date and time of birth, the preferences you choose and the surnames you search for.
• Your reports and images, kept in your history.
• Your family tree: the names, relationships, dates and photos of the family members you add. Please add other people’s details only where you are entitled to.
• Account details, if you save your account: your email address and, if you use Apple or Google sign-in, the name and account identifier they share with us.
• Device and usage data: device model, operating system, app version, language, time zone, IP address, how you use features, crash reports (mobile apps) and push notification tokens.
• Advertising identifiers in the mobile apps (Apple’s IDFA, only with your permission, and Google’s Advertising ID).
• Messages you send us, for example to support.

3. Why we use your data, and our legal bases

We process personal data under the EU and UK General Data Protection Regulation (GDPR) and Türkiye’s Law No. 6698 on the Protection of Personal Data (KVKK), on these bases:

• To provide the Service: create and keep your account, generate reports and images, keep your history and family tree, and sync them across devices. Basis: performance of our contract with you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• To process your photos: only when you upload them and ask for a result. Basis: your consent, which you can withdraw at any time by asking us to erase the photo and the reports made from it (see section 8), and our contract with you (GDPR Art. 6(1)(a) and (b); KVKK Art. 5(1) and 5(2)(c)).
• To sell and manage subscriptions, send receipts and the link to the app, and keep accounting records. Basis: contract and legal obligations (GDPR Art. 6(1)(b) and (c); KVKK Art. 5(2)(c) and (ç)).
• To measure and improve Heritage: analytics, crash reports and measuring our marketing. Basis: our legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)), or your consent where the law or your device requires it.
• To send notifications you have allowed on your device. Basis: consent.
• To show ads in the Android app (AppLovin banner ads), using the Advertising ID. Basis: your consent where the law requires it, otherwise our legitimate interests.
• To keep the Service safe: prevent fraud and abuse and enforce our Terms. Basis: legitimate interests and legal obligations.
• To answer you when you contact us. Basis: contract and legitimate interests.

4. Your photos and AI processing

• Reports and images are generated automatically by AI. They are for entertainment and are never used to make decisions that have legal or similarly significant effects on you.
• We do not use your photos to recognise or identify people, we do not create biometric identifiers from them, and we do not sell them or use them for advertising.
• Some reports, such as the Ancestral Profile, describe the features in your photo and, together with your answers, give an illustrative estimate of possible regional or national origins. This estimate is generated by AI for entertainment. It is not a finding about your ethnicity or nationality.
• Your photo is sent to our AI providers only to generate the result you asked for, and is kept with that report so you can see it again. Deleting a report removes it from your history. To have your photos and reports erased from our systems, ask us as described in section 8.

5. Who we share data with

We share personal data only as needed for the purposes above:

• Paddle (Paddle.com Market Limited and its affiliates), our Merchant of Record for purchases on this website: checkout, payment, tax, invoices and receipts, subscription billing, cancellations, refunds and fraud prevention. Paddle processes this data as an independent controller under its privacy notice.
• RevenueCat, Inc.: keeps track of your subscription across the website and the mobile apps.
• Google (Firebase): website hosting, sign-in (Firebase Authentication), analytics (Google Analytics for Firebase), push notifications (Firebase Cloud Messaging), crash reports (Crashlytics, mobile apps) and app configuration; Google also serves fonts and the files that run the Heritage web app.
• Adjust GmbH: measuring which links and campaigns bring people to Heritage, on the website and in the mobile apps.
• AI providers EachLabs and fal.ai: receive the photos and answers needed to generate your report or image. They may use the AI models of their own sub-processors to do so.
• Esri: the map images shown in reports and in the sample reports, which your device loads from Esri’s servers.
• Hosting, storage and email providers that run our backend, store your account, reports and family tree, and deliver our emails.
• OneSignal, Inc.: notifications about news and offers in the mobile apps (not used on the website).
• Meta Platforms: measuring our advertising on Facebook and Instagram, with app events in the mobile apps and, on this website, the Meta Pixel and the purchase events our servers report (see sections 2.1 and 2.2). Meta processes this data under its own Privacy Policy.
• AppLovin: banner advertising in the Android app.
• Apple and Google: purchases made in their app stores, and Sign in with Apple or Google.
• Advisers and authorities: our professional advisers, and public authorities or courts when the law requires it; and a buyer or successor if our business is reorganised or sold.

We do not sell your personal data.

6. International transfers

We are based in Türkiye, and several of our providers process data in the European Union, the United Kingdom, the United States or other countries. We transfer personal data abroad only as GDPR and KVKK allow, for example under standard contractual clauses or, where the law permits, with your explicit consent.

7. How long we keep data

• Account, reports, photos and family tree: for as long as your account exists, or until you ask us to erase them. Deleting a report in the app removes it from your history, and deleting your account in Settings signs you out of it. To have your account, photos and reports erased from our systems, email support@denalidigital.co; we erase or anonymise them without undue delay and within 30 days of your request, except where we must keep something by law.
• Purchase and invoice records: for as long as tax and commercial law requires (in Türkiye, generally up to 10 years). Paddle keeps its own records as Merchant of Record.
• Analytics and measurement data: for the periods set in those services, after which it is deleted or aggregated.
• Support messages: for as long as we need them to handle your request and keep a record of it.

8. Your rights

Depending on where you live, you have the right to:

• know whether we process your data and get a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to our processing, including for marketing;
• receive your data in a portable format;
• withdraw your consent at any time, without affecting earlier processing;
• under KVKK Article 11, also learn the purpose of processing, the third parties in Türkiye or abroad that receive your data, object to a result that is against you and arises solely from automated analysis, and claim compensation for damage caused by unlawful processing; and
• complain to a data protection authority: in the EU or UK, the authority where you live; in Türkiye, the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

To use these rights, email support@denalidigital.co from the address linked to your account, or tell us how to find your account. We may ask you to confirm your identity, and we reply within 30 days.

9. Cookies and similar technologies

• Needed to work. Once the checkout is ready (see section 2.1), this website stores your guest ID and the state of your checkout in your browser’s local storage, so the purchase can finish and the app can open. Paddle and RevenueCat may set cookies needed for the checkout and fraud prevention.
• Measurement. Adjust stores an identifier in your browser once the checkout is ready (see section 2.1), and the Heritage web app uses Google Analytics for Firebase, which sets analytics cookies.
• Advertising. On the home page, the Meta Pixel stores Meta’s identifiers in cookies on this website: _fbp, and _fbc when you arrive from a Meta ad (this website also keeps that click ID in local storage). They last up to 90 days. You can choose how Meta uses this information for ads in your Facebook or Instagram ad settings.

You can clear or block cookies and site data in your browser settings; blocking them may stop the checkout or the web app from working.

10. Children

Heritage is not meant for anyone under 16, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we will delete it.

11. Security

We protect personal data with encryption in transit (HTTPS/TLS), access controls and providers that commit to appropriate security measures. No system is completely secure, so we cannot guarantee absolute security.

12. Changes to this policy

We may update this Privacy Policy. We will publish the new version here with a new date and, for important changes, tell you in the Service or by email.

13. Contact