Personal Data Protection Notice (KVKK)

Data controller

Space Laika LLC, 30 N Gould St, STE R, Sheridan, WY 82801, USA. Contact: support@visaphoto.io.

Personal data processed

Depending on how you use the service:

• Identity and contact: e-mail address, and the name and profile image provided by Google sign-in.
• Customer transaction: credit balance, purchases, membership status, payment references (card details are processed by the payment provider, not by us).
• Visual records: the photo you upload, face position points used only to frame and check it, the generated outputs saved to your account; for every photo request, the uploaded photo and the generated photo kept for up to 6 months; for failed requests, the submitted photo and rejected candidates kept for up to 6 months (30 days for photos submitted before policy version 2026-10-02.2); for previews not bought, a small copy of the uploaded photo kept for at most 7 days. These are not used to identify you.
• Transaction security: account identifiers, sign-in and verification status, IP address, browser and device information, security and error logs.
• Consent and legal records: accepted document versions, language and time of acceptance.
• Previews without an account: an anonymous account identifier, your consent record and the preview with its files (deleted after 7 days unless you create an account or sign in), and a one-way, daily-changing code of your network address kept for 2 days to limit misuse of free previews; if you buy without an account, the e-mail address you enter on the payment page (deleted once the photo is sent, at the latest after 7 days); if you use “E-mail it to me”, the address you type, used once for that e-mail and not stored.
• Use through ChatGPT: the photo you attach and the format you choose, sent to us by ChatGPT, and a one-way digest of the anonymous user code sent by ChatGPT, kept for up to 6 days to apply the free preview limits.
• Use through Grok and other AI assistants: the photo and format the assistant sends us after you agree to our consent sentence in the chat, and a one-way digest of a random session code, kept for up to 6 days to connect the photo to its preview.
• Free previews (with or without an account): a one-way code derived from the uploaded photo, which cannot be turned back into the photo, and the number of tries, kept for 2 days to limit repeated tries of the same photo.
• Usage: cookieless site analytics (no cookie or identifier stored in your browser): page visits, product steps, browser, operating system and device type, browser language and time zone, and referring website (the IP address is used only for a daily-changing visitor code and is not stored); purchase events under a one-way code of your account ID; the steps within a visit, linked by a random visit code kept only in the page’s memory and, when you are signed in or previewing as a guest, by a one-way code of your account ID (kept for at most 2 years). Analytics never contains your photo, e-mail address or name.

Purposes

To create an account and provide the photo service; to generate, check, store and deliver photos; to take payments and manage memberships and credits; to send service e-mails; to answer support requests; to keep the service secure and prevent abuse; to find and fix errors and improve the service; and to meet legal obligations.

Photos from failed requests

If a photo request fails, the photo you submitted and the rejected generated candidates are kept for up to 6 months (180 days). Purpose: to analyse why requests fail and improve photo quality; some causes only show up as a pattern across many requests over several months. Storage: private Google Cloud Storage in the United States (us-central1); only authorized VisaPhoto personnel can access them, including through internal error-notification e-mails. Legal basis: our legitimate interest in finding and fixing errors (5/2-f), within the explicit consent you give for photo processing (5/1). They are deleted automatically after 6 months, or earlier together with your account. Internal error reports prepared for error analysis and to improve the service (including e-mails to authorized VisaPhoto personnel) may contain images of the photos that failed. These reports and the images in them may remain in VisaPhoto’s own mailbox, only authorized personnel can see them, and the 6-month automatic deletion does not cover them. You can ask us to delete them at any time (see Your rights). Photos submitted under the earlier 30-day limit (before policy version 2026-10-02.2) keep that limit.

Photos from photo requests

For every photo request, the photo you upload and the generated photo are kept privately for up to 6 months (180 days). Purpose: error analysis and quality improvement, by comparing what was uploaded with what was produced. Storage: private Google Cloud Storage in the United States (us-central1); only authorized VisaPhoto personnel can see them. Legal basis: our legitimate interest in finding and fixing errors and improving the service (5/2-f), within the explicit consent you give for photo processing (5/1). They are deleted automatically after 6 months, or earlier together with your account. They are kept only for requests made after you accepted this policy version; for failed requests, see “Photos from failed requests”.

Photo request measurements

For every photo request, successful or not, a measurement record without any photo is kept: per processing step the check results, short automatically generated notes describing the image, numeric measurements (for example face-detection confidence, head and eye position), durations, the outcome and whether the photo was later bought, under a one-way code of your account ID. Purpose: to analyse errors and improve the product and photo quality. Storage: Cloud Firestore; only authorized VisaPhoto personnel can access it. Legal basis: our legitimate interest in finding and fixing errors and improving the service (5/2-f). It is kept for at most 6 months, or deleted earlier together with your account.

Previews not bought

If you create a watermarked preview and do not buy it within about 15 minutes of your last preview, a small copy of the photo you uploaded (without metadata) is kept and shown next to that preview in an internal e-mail to authorized VisaPhoto personnel. Purpose: to understand why previews are not bought and to improve the service. Storage: private Google Cloud Storage in the United States (us-central1). Legal basis: our legitimate interest in improving the service (5/2-f), within the explicit consent you give for photo processing (5/1). The copy is deleted once the e-mail is sent, at the latest after 7 days, or earlier together with your account. The internal e-mail itself, with the photo shown as an image, stays in VisaPhoto’s own mailbox, which only authorized VisaPhoto personnel can open; the 7-day deletion does not cover it. You can ask us to delete it at any time (see Your rights).

Legal bases

Under KVKK Article 5: the establishment and performance of the contract with you (5/2-c); compliance with legal obligations (5/2-ç); the establishment, exercise or defence of rights (5/2-e); our legitimate interests in security, error monitoring and service improvement, without harming your fundamental rights (5/2-f); your explicit consent for sending your photo to AI processing services (5/1); and, only if you accept the ad-measurement banner, your explicit consent for Google Ads measurement cookies and the related transfer to Google (5/1, 9).

Transfers and transfers abroad

We use service providers located mainly in the United States. Data is transferred to them only to the extent needed for their function:

• Google LLC (USA): Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Storage, Firebase Hosting, App Check/reCAPTCHA, Google Fonts.
• Third-party AI service providers (mainly USA): photo generation and checks; only the photo needed for processing is sent.
• Stripe (USA/EU): payments, invoices and the membership billing portal.
• Resend (USA): account and service e-mails, including sending a bought photo to buyers without an account and the “E-mail it to me” preview e-mail.
• PostHog (USA): cookieless site and product analytics (browser and device information, time zone, product events under a visit code and a one-way account code).
• Google LLC (USA), Google Ads, only if you accept ad measurement: the ad-click code and Google Ads cookies, your IP address and browser information, the page address without personal values, and for a purchase its price, currency and a one-way order code.
• Sentry (USA): error monitoring.
• Competent authorities, when legally required.

Transfer safeguards

Transfers abroad are made under KVKK Article 9, relying on appropriate safeguards such as standard contracts with the service providers, or, where these are not available, the conditions for incidental transfers such as your explicit consent or necessity for the performance of the contract.

How data is collected

Electronically, through the website and application forms, Google sign-in, browser storage, the payment provider and service logs.

Your rights (KVKK Article 11)

You may ask whether your personal data is processed; request information about it; learn the purpose and whether it is used accordingly; learn the third parties it is transferred to in Türkiye or abroad; request correction of incomplete or inaccurate data; request deletion or destruction under Article 7; request that correction or deletion is notified to third parties; object to a result against you arising solely from automated analysis; and claim compensation for damage caused by unlawful processing.

How to apply

Send your request to support@visaphoto.io from the e-mail address registered to your account, or in writing to Space Laika LLC, 30 N Gould St, STE R, Sheridan, WY 82801, USA, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller. We answer free of charge within 30 days at the latest; if the request requires additional cost, the fee set by the Board may be charged.