Personal Data Retention and Destruction Policy

This policy sets out in which storage media and for how long personal data processed in the operation of the Photonza platform is kept, by which method it is deleted, destroyed or anonymised when the retention period ends, and how often this is done. The data controller is Ali Mert Güleç, who operates the Photonza platform (Email: info@alimertgulec.com).

Scope: all personal data of guests, organizers (venues, event companies, schools, institutions), photographers, website visitors and people appearing in event photos that is processed by automated means. Photonza has no physical (paper) records containing personal data.

Terms in this policy have the meaning given in the Regulation:

• Deletion: making personal data inaccessible and unusable in any way for the relevant users (removing the database record and the storage object).
• Destruction: making personal data inaccessible, irretrievable and unusable by anyone (deleted data also expiring from the providers' backups).
• Anonymisation: making personal data impossible to associate with an identified or identifiable natural person, even when matched with other data (e.g. removing the link between a payment record and the user).
• Periodic destruction: deletion, destruction or anonymisation, on the controller's own initiative and at recurring intervals set in this policy, of personal data whose retention period has ended.
• Storage medium: any electronic medium in which personal data is held.

Personal data is stored only in the following electronic media:

• Database (Supabase; US company, servers in the European Union, Ireland): user and event records, participation records, post details, face signatures, face detection records (position and crop), rescan requests, consent records, application and administrator logs.
• Authentication (Supabase Auth, same region): organizers' and photographers' email addresses and password hashes; guests' anonymous sessions.
• Object storage (Cloudflare R2; US company): photo and video files and their thumbnails.
• Face scanning (Cloudflare infrastructure): during face detection and signature computation for event photos, the photo (or, in a rescan, the face crops) is processed temporarily in memory; nothing is stored there permanently. The signatures of faces that do not resemble a consenting guest are discarded without being written anywhere; only matching signatures and face positions and crops are written to the database.
• Application hosting (Vercel; US company, server-side processing in the European Union, Ireland): request logs (IP address, path, time) are kept briefly on the provider side; Photonza does not store them separately. Vercel Web Analytics keeps only aggregate page-view statistics; it uses no cookies and the visitor session is discarded after 24 hours.
• Email mailbox (GoDaddy email hosting; US company): data subject requests, content removal notices, sales correspondence.
• WhatsApp (Meta): sales correspondence, only if the person chooses to message us there.
• Accounting: invoices and payment records via our accountant and the e-invoice system (Türkiye).

Personal data is kept for as long as necessary for the purpose for which it is processed and for the period required by the relevant legislation. The legal grounds for retention are:

• Formation and performance of a contract (KVKK Art. 5/2(c)): providing content during the event and the download period; managing accounts.
• Legal obligation (Art. 5/2(ç)): keeping commercial and financial records for 10 years under the Tax Procedure Law and the Turkish Commercial Code; keeping traffic data under Law No. 5651.
• Legitimate interest (Art. 5/2(f)): detecting abuse and attacks, rate limiting, auditability of administrator actions.
• Explicit consent (Art. 5/1, Art. 6/2): face signatures for "Find Me" (the guest's selfie signature and the signatures stored because faces in event photos resemble that guest). Face signatures are kept for 30 days after the event so that guests can still find their photos during this download period; no obligation requires keeping them longer, and when consent is withdrawn the selfie signature and the signatures stored because they resemble that guest are deleted immediately (Board guideline on biometric data).
• Establishment, exercise or protection of a right (Art. 5/2(e)): keeping agreement acceptance and explicit consent records as evidence.

When the following periods end, data is deleted or anonymised by automated jobs or by administrator action:

• Event content (photos, videos, notes, likes): 30 days from the end of the event. When the period ends the event is marked for deletion; an hourly clean-up job removes the files from storage and the records from the database.
• Face detection records (for each face in event photos and videos: position, 5 landmarks, confidence score and a 112×112 lossless WebP face crop; no biometric template): with the photo, at the latest together with the event (30 days from the end); at the same time if the photo or video is deleted earlier (cascading deletion in the database); within 30 days at the latest upon an objection and deletion request.
• Face signatures stored from event photos (only those resembling a consenting guest's selfie signature above the threshold; the signatures of other faces are computed momentarily and discarded without being stored): immediately when the linked guest withdraws consent or leaves the event (unless also linked to another consenting guest); at the same time if the photo or video is deleted; at the latest together with the event (30 days from the end); within 30 days at the latest upon an objection and deletion request.
• The face signature generated from a guest's selfie and match results: together with the event (30 days from the end); at the moment the guest presses "Delete my face data" or leaves the event; whichever comes first.
• Rescan requests (technical queue record for rescanning the photos for a guest whose selfie arrives later; event and selfie profile ID, timestamps): after processing, together with the event (30 days from the end); immediately if the guest's selfie profile is deleted.
• Guest participation record and display name: together with the event.
• Anonymous guest account with no remaining events: deleted after 90 days.
• Organizer and photographer accounts (business name, email, password hash): until the account is deleted; deleted within 30 days at the latest after a deletion request.
• Payment and invoice records: 10 years; anonymised by removing the link to the user when the account is deleted.
• Application activity logs (including IP address): 12 months.
• Rate-limiting records (keyed to IP address): 24 hours.
• Administrator action logs: 24 months.
• Agreement acceptance and explicit consent records: 3 years; if the user was deleted earlier, the record is kept without a link to the user.
• Expired invitation and sign-in tokens: between 15 minutes and 72 hours, depending on type.
• Data subject requests, content removal notices and answers (email): 3 years from the date of the answer.
• Sales correspondence and, for consumer sales, pre-contract information/contract confirmations: 3 years (Distance Contracts Regulation); 10 years where they support an invoice.
• Strictly necessary records kept in your browser (session, language preference, event session, upload drafts, download progress): the periods stated for each in the Cookie Notice; you can delete them from your browser settings at any time.

Because Photonza holds data only in electronic media, the following methods are used:

• Deletion: deleting database records (including cascading deletion of related records) and removing files from storage.
• Destruction: deleted data also leaving the backups when the providers' backup windows expire; object versioning is not used in storage.
• Anonymisation: removing the link between a record and the user (payment records and consent records).

Under the Regulation, the periodic destruction interval is 6 months. Data whose retention period has ended is mostly deleted by automated jobs running every minute, hour or day; in addition, every 6 months:

• The run logs of the automated deletion jobs are checked and any errors are fixed.
• Expired request correspondence is deleted from the mailbox.
• The providers' backup periods are checked.
• This policy and the retention periods in the Privacy Policy are reviewed against the system.
• Destruction operations are recorded; these records are kept for at least 3 years.

• Row-level access rules in the database; a guest reaches only the data of the event they joined. Only the server-side service can access face signatures and face detection records (including crops); organizers and other users cannot.
• TLS encryption in transit, provider disk encryption at rest; passwords are stored as irreversible hashes.
• Administrator actions are logged; service keys are kept only in the server environment.
• Data minimisation: guests are not asked for an email address or phone number; the selfie image never leaves the device.
• Only the data controller has access to personal data; if staff are employed, a confidentiality undertaking is obtained.

The data controller, Ali Mert Güleç, is responsible for applying this policy, keeping the automated destruction jobs running and periodic destruction.

You may ask for your data to be deleted before the retention period ends, or send questions about this policy, to info@alimertgulec.com. The application procedure and your rights are described in the Privacy Policy and Privacy Notice (photonza.com/privacy).

This policy first entered into force on 22 September 2026 and was updated on 25 September 2026. It is updated when legislation, infrastructure or the business model changes; the current version is published on this page.