1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Dulian, owner: Çağlar Körükcü, Wegmannstr. 1, 44795 Bochum, Germany
Email: info@dulian.app
We have not appointed a data protection officer. For any data protection question, contact us at info@dulian.app.
2. Scope
This policy applies to the website dulian.app and to the Dulian Creator application (Android app and web version). Dulian Creator is in a beta / closed test phase. Features may change. If this changes how data is processed, we will update this policy.
The app is intended for people aged 18 and over. We do not knowingly collect data from minors.
3. Visiting dulian.app
When you open the website, the hosting provider Vercel (Vercel Inc., USA) processes technically necessary connection data (including IP address, date and time, requested address, amount of data transferred, browser and operating system information) to deliver the pages and keep them secure. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation).
The website uses no analytics, advertising or tracking services and loads no fonts or scripts from third-party servers. If you switch the language manually, your browser stores that choice locally (Local Storage, entry "dulian-lang") so the site appears in your language next time. The entry does not leave your device and is needed to display the site as you chose (Section 25(2) no. 2 TDDDG).
If you email us, we process your message and email address to handle your request (Art. 6(1)(b) or (f) GDPR). For the retention period see section 4.
4. Contact form
If you use the contact form on dulian.app, we process the details you enter: name, email address, subject and message. We also require, as a mandatory field, your confirmation that you have read this privacy policy. We use the details only to answer your request. The legal basis is Art. 6(1)(b) GDPR if your request concerns a contract or pre-contractual steps, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).
The form sends your details through a server function at our hosting provider Vercel to our email service IONOS (IONOS SE, Germany), which delivers them as an email to our mailbox. We do not store enquiries in a database of our own. Our reply goes to the email address you provided.
To protect against spam and abuse, the server function checks the origin and format of the request, a hidden field and the time taken to fill in the form. This check stores no content. Our server function writes neither form contents nor IP addresses to logs of its own, and error messages contain no details from the form. As with every request, the platform operator (Vercel) processes technical connection data such as the IP address in server logs in order to operate and secure the service (Art. 6(1)(f) GDPR).
Retention: The enquiry stays in our email mailbox. We delete it as soon as the enquiry has been dealt with and we no longer need it. If no contract is concluded, we delete it in any case within six months of finishing handling it at the latest. Statutory retention obligations remain unaffected.
Without the mandatory details we cannot accept the form. Alternatively you can write to us by email at info@dulian.app.
5. Account and sign-in
For an account we process your email address and a password. The password is not stored in plain text; the authentication service hashes it. We also store when the account was created and last used. Emails for confirmation, password reset or one-time codes are sent through our authentication service.
After sign-in we ask you to accept the Terms of Use and to acknowledge this privacy policy. We store a record of this (document type, version, interface language, time, sign-in method) so we can prove that the terms were accepted. The legal basis is Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(f) GDPR (interest in keeping proof).
On your device the app stores session data (access and refresh tokens of the authentication service) as well as local settings and local library entries. Android backup (cloud backup and device transfer) is disabled for the app so your session is not copied to other devices. The app contains no advertising or analytics SDKs. The app only needs the permission for internet access.
6. Creator profile and profile photo
You can create a creator profile. It can contain a display name, short bio, categories, languages, location, availability, price range, and a trust and verification status. The information is voluntary; without it some features are limited. In the current version your profile is visible only to you and is not shared with brands or other users. If we later introduce visibility for others, we will do so only after informing you and providing a setting in the app.
You can upload a profile photo through your device's photo picker (JPEG, PNG or WebP, up to 5 MB). The app receives only the image you select, not access to your media library. The image is kept in a private storage area and is shown to you only through short-lived signed addresses. The legal basis is Art. 6(1)(b) GDPR.
7. AI features and your inputs
With the AI features, Dulian Creator generates text suggestions (for example hooks, captions, hashtags and platform tips). To do this, we send your inputs (topic, platform, language, country and other details you enter) through our server to the AI provider OpenAI (OpenAI, L.L.C., USA) and receive the result. We do not send your email address or user identifier together with the inputs.
Please do not enter sensitive data (for example health data) or other people's personal data into AI inputs. OpenAI processes the inputs under its own terms. We instruct the interface not to store the response with OpenAI for later retrieval. We do not store your inputs in our own usage log.
To manage usage quotas and prevent abuse we store metadata without content: time, plan, provider and model, token counts, estimated cost and status. You can report faulty or inappropriate AI results. When you do, we store the reported result, platform, language, category and an optional note of at most 500 characters. The legal basis is Art. 6(1)(b) GDPR, and for abuse prevention and quality assurance Art. 6(1)(f) GDPR. No automated decision with legal effect within the meaning of Art. 22 GDPR takes place.
8. Library
Results you save are kept in your library. While you are signed in, the library is stored in your account and synchronised between your devices; the app may also keep entries locally on your device. When you delete an entry it is marked as deleted and synchronised; deleting your account deletes all library entries.
You can optionally connect Instagram, TikTok and YouTube accounts. A connection starts only when you explicitly trigger it; you sign in with the provider and grant the requested permissions there. We do not receive your social media login credentials, only an access token from the provider.
- Instagram (Meta Platforms Ireland Ltd.; Instagram API with Instagram Login): permissions to read profile and media list and insights (instagram_business_basic, instagram_business_manage_insights). Only professional accounts (Business or Creator) are supported.
- TikTok (TikTok Technology Limited, Ireland): permissions to read profile, statistics and video list (user.info.basic, user.info.stats, video.list).
- YouTube (Google Ireland Limited): read-only access to your channel (youtube.readonly).
We store the account identifier, username, display name, account type, where available the profile picture address, bio and website, and metrics such as follower, subscriber, post and video counts, reach, interactions and views, and for Instagram aggregated likes and comments of recent posts. We do not store raw provider responses. Access tokens are stored encrypted (AES-256-GCM) on our server only and are never handed to the app or to third parties. We do not request permissions to publish, comment or read messages.
The legal basis is your consent when connecting (Art. 6(1)(a) GDPR) and providing the feature you chose (Art. 6(1)(b)). You can disconnect at any time in the app; we then delete tokens, connection data and metrics immediately. Instagram offers no interface for revoking access, so you can additionally remove access in Instagram settings under "Apps and websites". For TikTok and YouTube we revoke access on disconnect where the provider supports it. Connected accounts and metrics are also removed when you delete your account. For connected accounts we keep the metrics history for at most 12 months.
10. Technical logs, security and abuse protection
Our server (Google Cloud Run) logs technical operating data such as time, request path, status code, response time and error categories. User identifiers appear there only as a keyed hash. Inputs, AI results, credentials, tokens, email addresses and plain-text IP addresses are not logged. To limit requests and protect against abuse we use keyed hashes of account and IP identifiers in short-lived counters. The legal basis is Art. 6(1)(f) GDPR (security and stable operation).
11. Error monitoring
Error monitoring is active only if a corresponding service has been set up for the respective app version. If active, we transmit technical error information only; form inputs, tokens, AI inputs and results and private profile data are not attached. At the time of this version, no error monitoring by an external provider is enabled. If we enable it, we will update this policy.
12. Recipients
We pass on data only where needed to provide the features or where you have initiated it. The following service providers and services may receive data:
| Recipient | Purpose | Data concerned |
|---|---|---|
| Supabase | Authentication, database, file storage, sending sign-in emails | Account data, profile, library, profile photo, records, metrics, metadata |
| Google Cloud (Cloud Run); the test environment runs in region europe-west3 (Frankfurt am Main) | Operating the backend | All app requests to our server, technical logs |
| OpenAI (OpenAI, L.L.C., USA) | Generating AI text | Your AI inputs and the generated results |
| Meta (Instagram), TikTok, Google (YouTube); only if you connect an account | Connecting social media accounts, retrieving metrics | Account and metrics data of the respective service |
| Vercel (Vercel Inc., USA) | Hosting dulian.app and running the contact form's server function | Technical connection data, contact form contents in transit |
| IONOS (IONOS SE, Germany) | Email delivery and mailbox for contact enquiries and email correspondence | Name, email address, subject and message; emails to and from info@dulian.app |
Processing by the social media providers with whom you hold your own account is governed by their privacy policies.
13. Transfers to third countries
Some recipients are based or process data outside the European Economic Area, in particular in the USA (OpenAI, Meta, Google, Vercel). Whether an adequacy decision of the EU Commission exists for a provider, for example under the EU-US Data Privacy Framework for certified providers, depends on the provider. Where no adequacy decision applies, the level of data protection may be lower than in the EU. The place of processing at Supabase depends on the region chosen for our project.
Your AI inputs are transferred only when you trigger an AI feature. You can avoid the transfer by not using AI features or by not entering personal data. We answer questions about the basis of individual transfers at info@dulian.app.
14. Retention periods
We keep data only as long as necessary for the respective purpose:
| Data | Retention |
|---|---|
| Account, profile, library, profile photo, settings | Until you delete them or delete your account |
| Connected social media accounts and access tokens | Until you disconnect or delete your account; then deleted immediately |
| Metrics of connected accounts | History for at most 12 months; deleted immediately on disconnect or account deletion |
| AI usage metadata (no content) | While the account is used; pseudonymised after account deletion; deleted 24 months after each entry was created |
| Event log of account actions | 24 months |
| Records of acceptance of the terms and acknowledgement of the privacy notice (version, time, language) | 3 years from account deletion |
| Records of deletion and access requests | 3 years |
| Reports about AI results | 365 days; on account deletion the note and the reported result are removed immediately |
| Counters for request limiting (hashes only) | Short-lived; expired counters are deleted at the latest 90 days after expiry |
| One-time status values when connecting social media accounts | A few minutes |
| Contact enquiries (form and email) | Until no longer needed; without a contract at the latest six months after handling is finished; statutory retention obligations remain unaffected |
15. Account deletion and data export
You can delete your account in the app under Profile → Settings → Delete account and export your data as a file under Profile → Settings → Download my data. Details are on the page Account deletion.
16. Your rights
Under the GDPR you have the following rights, where the legal requirements are met:
- Access to the data we hold about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing based on legitimate interests (Art. 21 GDPR)
- Withdrawal of consent you have given, with effect for the future (Art. 7(3) GDPR)
To exercise your rights, write to info@dulian.app. We may ask you to identify yourself through the email address registered with us. We normally reply within one month.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Postfach 20 04 44, 40102 Düsseldorf, Germany, www.ldi.nrw.de. You can also contact the supervisory authority of your place of residence.
17. Whether you must provide data
An account requires an email address and a password. All other information, connecting social media accounts and using the AI features are voluntary. Without the required information we cannot provide an account.
18. Changes to this policy
We update this policy when features, service providers or the legal situation change. The current version is published on dulian.app. We will inform you in the app about material changes. This version is numbered 2026-10-08.