Privacy Policy

How IAMX collects, uses, and protects personal data across our digital human platform, plugin, and web embed.

Last updated: 20 July 2026

This Privacy Policy explains how personal data is handled when you use the IAMX platform at iamx.live, our free Unreal Engine plugin, and our one-line web embed (together, the "Service"). IAMX is currently a v1.0 alpha; this document may evolve as the Service matures. If you have questions, reach us via https://iamxlive.com/contact.

1. Who we are (data controller)

The data controller responsible for your personal data is:

Legal entity: IAMX LIVE DIGITAL HUMAN BİLGİ TEKNOLOJİLERİ VE YÖNETİM DANIŞMANLIĞI A.Ş. ("IAMX", "we", "us", "our"), operating the IAMX platform.
Registered address: Maslak Mah. Eski Büyükdere Cad. Güz 2000 Plaza No:7 İç Kapı No:34, Sarıyer / İstanbul, Türkiye
Trade registry no: [trade registry no]
Data protection contact: ukarabey@iamx.live — or reach us through https://iamxlive.com/contact

Where you use IAMX as an operator to build and deploy your own characters that interact with your end users, you may act as the data controller for the conversation data generated by your end users, and IAMX acts as your data processor for that content. In those cases, this policy describes how we process data on your behalf and as controller for our own account, billing, and platform-operation purposes.

2. What data we collect

We collect the following categories of personal data, depending on how you use the Service.

Category	Examples	Source
Account data	E-mail address, name, company/team name	Provided by you at sign-up
Authentication data	Login credentials, session tokens, password reset data	Provided by you / generated by the Service
Character configuration	Character settings, prompts, personas, and any knowledge files you upload	Provided by you in the web panel
Conversation content	Text messages and microphone audio processed to generate live responses, and the responses returned	Captured during your (or your end users') use of a character
Usage & interaction analytics	Feature usage, session activity, interaction counts, quotas	Collected automatically as you use the Service
Billing data	Plan, invoices, transaction records (full card numbers are handled by our payment processor and not stored by IAMX)	Provided by you / generated during checkout
Technical data	IP address, device and client/engine information, log data, timestamps, error reports	Collected automatically
Face data (enterprise only)	Facial features processed for identity-verification / face-recognition features	Processed only where an operator explicitly enables these features

Face data is a special category of personal data. It is processed only where an operator explicitly enables identity-verification or face-recognition features (an enterprise capability), and only for that purpose. If you are an operator enabling these features, you are responsible for obtaining any legally required explicit consent from the individuals whose face data is processed.

3. How and why we use it

We process personal data for the purposes below. For each purpose we identify the legal basis under the EU General Data Protection Regulation (GDPR) and Turkey's Personal Data Protection Law (KVKK).

Purpose	Legal basis
Provide, operate, and maintain the Service (including creating and running characters)	Performance of a contract
Generate real-time conversational responses, voice, and animation from your input	Performance of a contract; consent where required for microphone access
Process payments, manage subscriptions, and issue invoices	Performance of a contract; legal obligation (accounting/tax)
Provide customer support and respond to your requests	Performance of a contract; legitimate interests
Ensure security, prevent fraud and abuse, and protect the Service	Legitimate interests; legal obligation
Improve, troubleshoot, and develop the Service	Legitimate interests
Comply with legal and regulatory obligations	Legal obligation
Enable identity-verification / face-recognition features (enterprise)	Explicit consent (obtained by the operator); or another lawful basis established by the operator

Where we rely on consent, you may withdraw it at any time; this does not affect the lawfulness of processing carried out before withdrawal.

4. Microphone audio & conversation data

To power live, voice-based conversation, the Service processes the microphone audio and text you (or your end users) provide. In general terms:

When you speak to a character, your microphone audio is streamed to our platform and processed to understand your input and generate a spoken, animated response in real time.
Your text and audio input, together with relevant character configuration, may be sent to third-party AI model providers (see Section 5) to generate the language and voice of the response.
Audio is captured only while a character session is active and you have granted microphone permission in your browser or client. You can revoke that permission at any time through your device or browser settings.

Retention of conversation data. Conversation content (text and, where applicable, audio) may be retained to operate the Service — for example to maintain conversation context, provide the account holder with history and analytics, enforce quotas, and for security and troubleshooting — for the period described in Section 7. Operators can configure retention behavior for their characters where the Service provides such controls. We do not sell conversation data.

Please avoid speaking or uploading sensitive personal data (such as health, financial account, or government-ID information) into a character unless the operator has enabled a feature specifically designed for that purpose and has told you it is appropriate.

5. Sharing & subprocessors

We do not sell your personal data. We share it only with the categories of recipients below, and only as needed to operate the Service.

Recipient category	Examples	Purpose
AI model providers	OpenAI, Anthropic, Google	Generate the language and voice of real-time conversational responses from your input
Cloud hosting / infrastructure providers	Cloud hosting and infrastructure providers	Host, run, store, and secure the platform
Payment processor	PayTR	Process payments and manage subscriptions (handles card details; IAMX does not store full card numbers)

We may also disclose personal data (i) to comply with a legal obligation, court order, or lawful government request; (ii) to protect the rights, safety, and security of IAMX, our users, or the public; or (iii) in connection with a corporate transaction such as a merger, acquisition, or asset transfer, subject to appropriate confidentiality protections.

6. International transfers

IAMX operates a cloud service, and some of our providers (including the AI model providers and infrastructure providers listed above) are located in countries outside your own, such as within the European Union and the United States. As a result, your personal data may be transferred to and processed in those countries.

Where personal data is transferred internationally, we take steps to ensure an appropriate level of protection, for example through the use of recognized transfer mechanisms such as the European Commission's Standard Contractual Clauses and equivalent safeguards required under KVKK, together with additional technical and organizational measures where appropriate.

7. Data retention

We retain personal data only for as long as necessary for the purposes described in this policy, and then delete or anonymize it. Retention periods depend on the type of data:

Account and authentication data — for as long as your account is active, and for a reasonable period afterwards.
Character configuration and uploaded knowledge files — for as long as they remain in your account, until you delete them.
Conversation content (text and audio) — retained for the period needed to operate the Service and any period configured by the operator, then deleted or anonymized.
Billing records — retained for the period required by applicable accounting and tax law.
Technical logs — retained for a limited period for security, debugging, and abuse prevention.

We may retain certain data for longer where required to comply with legal obligations, resolve disputes, or enforce our agreements. Specific retention periods are set out in [retention schedule / to be defined by the operator].

8. Security

We use technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration. These include, in general terms:

Encryption of data in transit;
Access controls and authentication for administrative access to systems;
Segregation of duties and least-privilege principles for staff access;
Logging and monitoring for security events;
Use of reputable cloud infrastructure providers.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We do not make any certification claims in this policy; where we adopt formal certifications in the future, we will update this section accordingly.

9. Your rights

Subject to applicable law (GDPR for users in the EU and KVKK for users in Turkey), you have the following rights over your personal data:

Access — obtain confirmation of, and a copy of, the personal data we hold about you;
Rectification — correct inaccurate or incomplete data;
Erasure — request deletion of your data where applicable;
Restriction — request that we limit processing in certain circumstances;
Objection — object to processing based on legitimate interests;
Portability — receive certain data in a structured, machine-readable format;
Withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us via https://iamxlive.com/contact or at ukarabey@iamx.live. We will respond within the timeframe required by applicable law. You also have the right to lodge a complaint with your local data protection authority — in Turkey, the Personal Data Protection Authority (KVKK / KVKK Kurumu); in the EU, your national supervisory authority.

If your data was provided to a character operated by another party (an operator using IAMX), you may need to direct certain requests to that operator; we will assist as required.

10. Children

The Service is not directed at children and is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us via https://iamxlive.com/contact and we will take appropriate steps to delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in the Service, our practices, or legal requirements. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you through the Service or by e-mail. We encourage you to review this page periodically.

12. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data:

Contact form: https://iamxlive.com/contact
Data protection contact: ukarabey@iamx.live
Legal entity: IAMX LIVE DIGITAL HUMAN BİLGİ TEKNOLOJİLERİ VE YÖNETİM DANIŞMANLIĞI A.Ş., Maslak Mah. Eski Büyükdere Cad. Güz 2000 Plaza No:7 İç Kapı No:34, Sarıyer / İstanbul, Türkiye

Related documents: Terms of Service · KVKK Notice · Cookie Policy · Documentation · Community Forum.

Governing law: This policy is governed by the laws of Turkey, including KVKK, and the GDPR applies to users in the European Union.

Template notice: This document is a template provided for the operator's convenience and does not constitute legal advice. Placeholders in [square brackets] must be completed, and the entire policy must be reviewed and adapted by qualified legal counsel before publication to ensure it accurately reflects your actual data practices and complies with all applicable laws.