Personal Data Notice (KVKK)

1. Data controller

VISORYA YAZILIM VE TEKNOLOJİ A.Ş., Akademi Mah. Gürbulut Sk. Teknokent Sitesi No:67, 42130 Selçuklu / Konya, Türkiye · [email protected].

In team workspaces, the company that owns the workspace is the controller for the data it processes about its employees and members; Visorya acts as its data processor (“veri işleyen”). Requests about that data should go to the employer first, and informing employees is the company’s responsibility.

2. Data we process

Vidimu works without an account. If you do not create an account and do not use cloud backup or a team workspace, the photos, videos and records you create are stored only on your device and are not sent to us. If you do use them, they are also uploaded to our servers as described below. The photo itself is never sent to the verification server. We process:

• Identity and contact: your name, e-mail address and, optionally, phone number when you create an account; your e-mail address and the content of messages when you write to us.
• Professional details: optionally your job title and company; your role in a team workspace.
• Location: latitude, longitude, accuracy, altitude, address and a mock-location flag, if location is on: with each camera or punch-clock photo for verification and, if you use cloud backup or a team workspace, with the capture and punch-clock records.
• Visual and audio recordings: photos, videos (with sound), task attachments, project covers and a profile photo, only if you use cloud backup or a team workspace or add a profile photo.
• Verification data for each camera or punch-clock photo: the verification code; the server-signed capture time, its source (server or device clock) and the difference between the device clock and our server’s time; the time our server received the record and whether it is valid; and fingerprints (SHA-256 and perceptual hash) of the saved photo and, for camera photos, of the frame without the watermark. With cloud features the code is also stored with the record in your account.
• Work records: projects, tasks (title, description, checklist, assignees, history), notes, tags, punch-clock records (clock-in and clock-out times and managers’ corrections), watermark templates and invitations (the invited person’s e-mail address), only if you use cloud backup or a team workspace.
• Transaction security: the random device ID and device key used for verification, platform and app version; for accounts, the installation ID, device model name, sign-in token, last-seen time and a password hash; the team workspace activity log (including IP address); server access logs (IP address, date and time, requested address, referring page, browser or app information); Cloudflare request data.
• Customer transactions: subscription records (product, dates, status, store transaction ID, anonymous or account ID) and the purchase information, IP address and, on iOS, the app-vendor device identifier (IDFV) sent to RevenueCat. Your card details do not reach us.
• Advertising (free plan only): the advertising ID (on iOS only if you allow tracking), IP address, ad and app interaction data and diagnostic data of the ad software, processed by Google AdMob once you have accepted the privacy notice in the app and while the app is open; not processed on Pro or Team, nor before the notice is accepted. See section 9a of the Privacy Policy.
• Weather (optional): while the weather field of your watermark template is on (it is on by default in the templates that have one, and you can turn it off), your approximate location (latitude and longitude rounded to two decimal places) and IP address reach MET Norway (Norwegian Meteorological Institute, api.met.no) to get the current weather, only while the camera is open with location on; we do not store them. See section 5 of the Privacy Policy.
• Verification page and the app’s Verify record screen: fingerprints of a file being compared (calculated in the browser or on the device; the file is not uploaded and the fingerprints are not stored), and the IP address, held only in the server’s memory to limit requests (no access log is kept; error logs may contain an IP address).

Location is optional: if Profile › Save location is off or location permission is not given, the app does not read the location and the photo gets a code without one. If the device reports a simulated location, the photo gets no code. If a photo is deleted in the app before its verification data has been sent, that data is never sent. On the free plan the app shows ads from Google AdMob, which processes the advertising ID, IP address, ad and app interaction data and diagnostic data described in section 9a of the Privacy Policy; there is no other third-party advertising, tracking, crash-reporting or analytics software in the app; RevenueCat is used only to manage subscriptions. The website uses no cookies; the web panel uses only session and security cookies. We do not analyse the content of photos and videos and do not intend to process special categories of personal data.

3. Purposes and legal grounds

We process this data to provide watermarking and photo verification, to show the capture time and location to anyone who has a photo’s code, to let people check whether a file matches, to create and manage accounts and provide cloud backup, team workspaces and the web panel, to manage subscriptions, to show and measure ads on the free plan (Google AdMob), to show the current weather while a watermark’s weather field is on (MET Norway), to preserve the evidential value of records and prevent forgery and abuse, to keep our systems secure, to answer your requests and send service e-mails (verification, password reset, invitations, ownership transfer, export-ready notices, deletion confirmation), and to meet legal obligations. Legal grounds (KVKK Article 5(2)): performance of a contract (c), including recording the location when it is on, showing the current weather while the weather field is on, providing accounts, cloud backup, teams and subscriptions; establishing, exercising or protecting a right (e), for keeping records usable as proof; our legitimate interests (f), for preventing forgery and abuse, information security, server and web logs and subscription fraud and, where no consent is required, funding the free plan through ads; and our legal obligations (ç). Where your consent is asked for (the iOS tracking prompt, or Google’s consent form in the EEA, the UK and Switzerland), processing of the advertising ID and personalised ads on the free plan relies on your explicit consent (Article 5(1)), which you can withdraw at any time. On Android outside those regions no consent form is shown; you can delete or reset the advertising ID in your device settings. Showing the location on the verification page to anyone who has the code is a core function of the service; location is optional.

4. How we collect it

Automatically through the app when you take a photo (camera, location services and app-generated identifiers) and, on the free plan, through the ad software (Google AdMob); from information you enter when you create an account, edit your profile or use the web panel; automatically through the verification page, the app’s Verify record screen and the website (server logs, fingerprints calculated in the browser or on the device); through the store and RevenueCat when you buy; and in writing by e-mail.

5. Transfers

• Anyone who has the code printed on a photo can see that photo’s capture time, the time our server received the record, its precise location (coordinates and accuracy), whether the record is valid and whether its time was confirmed online. The device ID, device key, app version and fingerprints are not shown.
• In Türkiye: verification data, account and cloud data and their backups are stored on Visorya servers hosted in data centres in Türkiye (main server and backup server), whose hosting providers process the data only on Visorya’s behalf; messages sent to privacy@, support@ and [email protected] reach us through Mailgun and are forwarded to our company mailbox, which is hosted by Güzel Hosting in Türkiye; competent authorities and courts where the law requires; in team workspaces, the company that owns the workspace and the users it authorises.
• Abroad (KVKK Article 9): Cloudflare, Inc. (US-based; R2 storage in the EU region) for encrypted off-site file backups (encrypted on our side; the key is kept on our server in Türkiye and in our company’s password manager), and for DNS and for content delivery of vidimu.com and the short verification addresses; RevenueCat, Inc. (USA) for subscription management (anonymous or account ID, purchase information, IP address and, on iOS, the app-vendor device identifier (IDFV)); Mailgun Technologies, Inc. (USA) for e-mail; Apple and Google for the device’s address lookup, opening a map when the user taps “Show on map” and in-app payments; OpenStreetMap servers for map tiles in some templates; Google Ireland Limited and Google LLC (AdMob) for ads on the free plan (advertising ID, IP address, ad and app interaction data and diagnostic data of the ad software; Google acts as an independent controller under its own policy); the Norwegian Meteorological Institute (MET Norway, api.met.no) for the optional weather field of a watermark (approximate location rounded to two decimal places and IP address, under MET Norway’s own terms; not stored by us). These transfers are made in accordance with Article 9 of the KVKK, relying on the contracts we have with our service providers and on transfer mechanisms that comply with the legislation in force.

6. Retention

Verification records: 5 years from capture, unless you ask for earlier deletion (capture time, location, fingerprints and device link are then erased and the code shows as removed). Verification device ID and device key: deleted 5 years after that device’s last activity. Account data: until the account is deleted; deletion in the app or on the web panel takes effect immediately and the content of the personal space is erased within 24 hours. Deleted captures, projects and workspaces can be restored for 30 days; a deleted capture’s files are erased after 30 days and its record details after 90 days at the latest (those of a capture linked to a punch-clock record or a task attachment can remain until the linked record is deleted). A deleted task cannot be restored: the files uploaded to it as attachments are erased immediately and the rest of its content (title, description, checklist, assignees, history) after 30 days; a deleted team (a group of members inside a workspace) cannot be restored either and its name and member list are erased after 30 days. The content of a deleted project or workspace is currently not erased automatically after the 30 days; it is erased on request. Records in a team workspace are the company’s records and stay until the workspace is deleted and its content is erased. Team workspace activity log: 1 year. In-app notifications and unused sign-in tokens: 180 days. Export files: 24 hours. Subscription records: as long as accounting, tax and other legal record-keeping obligations and the handling of subscription disputes require. Support e-mails: 2 years. Web and API server access logs and application error logs: about 14 days. Deleted data leaves our server backups as they rotate, within 90 days. Account deletion requests sent by e-mail are completed within 30 days; see Delete your account and data.

7. Your rights (KVKK Article 11)

You can ask whether your data is processed and request information about it; learn the purpose of processing and whether data is used accordingly; know the third parties in Türkiye or abroad to whom it is transferred; request correction of incomplete or inaccurate data; request deletion or destruction under Article 7; request that corrections and deletions are notified to those third parties; object to a result against you arising solely from automated analysis; and claim compensation for damage caused by unlawful processing.

8. How to apply

Send your request in writing (signed letter) to the address above, or by e-mail to [email protected] in line with the Communiqué on the Procedures and Principles of Application to the Data Controller (with a secure electronic or mobile signature, or from an e-mail address you have previously given us, for example the address of your Vidimu account). Please include your name, surname, signature (for written requests), Turkish ID number or, for foreign nationals, nationality and passport or ID number, your address, e-mail and phone number, and your request. For verification records, include the codes concerned.

We respond free of charge within 30 days at the latest; if the request involves an additional cost, a fee set by the Personal Data Protection Board may apply. If your request is refused, the answer is insufficient or we do not answer in time, you can complain to the Personal Data Protection Board under Article 14.