Privacy Policy

1. Who we are

Vidimu is a mobile app for field teams, together with the services that work with it: the website vidimu.com, the verification page at verify.vidimu.com, the api.vidimu.com server and the web panel at app.vidimu.com. It is provided by VISORYA YAZILIM VE TEKNOLOJİ A.Ş. (“Visorya”, “we”), Akademi Mah. Gürbulut Sk. Teknokent Sitesi No:67, 42130 Selçuklu / Konya, Türkiye. Visorya is the data controller for the processing described in this policy, except where a company uses Vidimu for its own team (see section 7).

This policy applies to the Vidimu app for iOS and Android, the verification pages, the web panel and this website. Turkish residents can also read our KVKK Aydınlatma Metni (information notice under Law No. 6698); an English summary is available as the Personal Data Notice (KVKK).

2. What data, and when

All of Vidimu works without an account. What leaves your device depends on how you use it:

3. Data on your device

Photos, videos, watermark settings, projects, folders, tasks, team entries and punch-clock records are stored in the app’s storage on your device. If you do not use cloud backup or a team workspace, none of this is uploaded to us, except the verification data described in section 4. If you do use them, a copy of your records is also uploaded to our servers (section 7). If you delete a record or uninstall the app, the data on your device is removed; if you delete a synced record in the app, the deletion is also applied on our servers (see section 12). Copies you have shared or exported yourself, and your device’s own backups (for example iCloud or Google backup, depending on your settings), are outside our control.

The app asks for the permissions it needs, and you can withdraw them at any time in your device settings:

• Camera, to take photos and videos;
• Microphone, to record sound with videos;
• Location while using the app, to stamp coordinates, the address and a map on photos and punch-clock records, to get the current weather while a watermark’s weather field is on, and to record the location for verification. You can also switch location off for Vidimu alone in Profile › Save location;
• Tracking (iOS, free plan only), so that the ad software may use your device’s advertising identifier; iOS asks only after you have accepted the privacy notice (section 9a);
• Photos, only if you choose to save photos and videos to your gallery or to pick an image such as a project cover, logo or task attachment.

4. Photo verification

When you take a photo with the Vidimu camera, or a punch-clock photo, with or without an account, the app registers it with our verification server so that the code printed on the photo can later be checked. Videos do not get a code yet. The server is operated by Visorya and located in Türkiye. The app sends:

• a random device ID and a device key, created by the app on first use and not linked to your name, phone number or other identity, together with the platform (iOS or Android) and the app version;
• the 14-character verification code;
• the capture time, which our server confirms and signs when the device is online; whether the time came from our server or from the phone’s clock; and the difference between the phone’s clock and our server’s time, used to detect a changed clock;
• the GPS location, if location is on: latitude, longitude, accuracy, altitude, and whether the device reported a simulated (“mock”) location;
• image fingerprints: a SHA-256 hash and a perceptual hash of the saved photo and, for camera photos, of the same frame without the watermark. These are short mathematical summaries; the photo cannot be rebuilt from them.

Our server adds the time it received the record and whether the record passed its checks. The photo itself is never sent to the verification server. If you take a photo without a connection, the data is sent later, when the device is back online. If you delete a photo before its data has been sent, the data is not sent at all. Deleting a photo after that does not delete its record on our verification server; see section 12.

Relationship to cloud backup. Even though no photo goes to the verification server, cloud backup and team sync are separate features that do upload the photo to our servers (section 7). If you use one of them, the photo’s code is stored on our servers together with the record in your account, and our servers ask the verification server for the status of that code. A verification record can then be linked to you. Deleting your account does not delete the records on the verification server; see Delete your account and data.

Location is optional. If you turn off Profile › Save location, or do not give the app location permission, the app does not read your location: the watermark shows “Location off” and the photo gets a code without a location. If the device reports a simulated location, the app does not issue a code for that photo.

Who can see it: the code is printed on the photo. Anyone who has the code, for example anyone you send the photo to, can open the verification page and see the capture time, the time our server received the record, the precise location (coordinates and their accuracy, which can be opened on a map), whether the record is valid and whether its time was confirmed online. The device ID, device key, app version and fingerprints are never shown. Do not share a photo if its time or location must stay private.

Checking a photo: on the verification page, or in the app’s Verify record screen, a person can select their copy of a photo to see whether it matches. The fingerprints are calculated on their own device or in their browser, and only the fingerprints and the code are sent to our server for the comparison; they are not stored. The photo is not uploaded.

Purpose and legal basis: to provide the watermark and verification features you use when you take a photo (performance of our contract with you, KVKK Article 5(2)(c)); to keep records usable as proof (establishing, exercising or protecting a right, Article 5(2)(e)); and to protect the service against forged or tampered records and abuse (our legitimate interest, Article 5(2)(f)). You decide whether location is used; Vidimu also works without it. Showing the location on the verification page to anyone who has the code is a core function of the service; because location is optional, you can keep it off.

Technical data: the verification server keeps no access logs. To limit the number of requests, it holds IP addresses only in its working memory; they are not written to disk, are cleared automatically within about an hour at the latest, and are also cleared when the server restarts. Its error log can contain an IP address and the requested address when a request fails. For the website and our other servers, see section 9.

5. Address, map tiles and weather

Address line. To print an address on the photo, the app uses your phone’s built-in geocoding service: Apple on iOS, Google on Android. Your coordinates are sent to that provider, which returns an address. Their own privacy terms apply.

Map tiles. Some watermark templates show a small map. Its tiles are loaded from OpenStreetMap servers, which see your IP address and the approximate area being displayed. See the OpenStreetMap Foundation privacy policy. Templates without a map do not load tiles.

Weather. Some watermark templates have a weather field that shows the current weather. The field is optional: it is on by default in the templates that have it, and you can turn it off or type your own text in the template editor. While it is on, the app sends your approximate location (latitude and longitude rounded to two decimal places, about 1 km) in real time to MET Norway (api.met.no), the weather service of the Norwegian Meteorological Institute, to get the temperature and conditions. The request also carries the app’s name and version. MET Norway sees your IP address and handles the request under its own terms of service. The request is made only while the camera is open with the field on, location access is granted and Profile › Save location is on, and never while the app is in the background. We do not store it: the result is kept only in the device’s memory while the app is running and is not sent to our servers or included in the verification record. The weather text is printed on the photo like any other watermark field. If the field is off, you have typed your own text in it, or location is off, no request is made. Weather data: MET Norway (CC BY 4.0).

Opening a map. When you tap “Show on map” in a record, the app passes the record’s coordinates and name to your device’s map app (Apple Maps on iOS, your map app on Android) or, if none is available, to Google Maps in your browser. On the verification page, a link opens the location on OpenStreetMap. These services handle the data under their own privacy terms.

6. Accounts and the web panel

A Vidimu account is optional; the whole app works without one. Team workspaces, the web panel and cloud backup need an account. When you create one, we process:

• Account details: your name, e-mail address, password and language. Your password is not stored in plain text on the server, only as a one-way hash (bcrypt). You can optionally add your job title, company, phone number and a profile photo; the profile photo is resized on the server and its location metadata is removed.
• Preferences: app preferences that move between your devices, such as watermark and display settings.
• Session and device information: your device’s installation ID, device model name (for example “Pixel 8”), platform, app version and last-seen time. We use them to show your list of sessions, to keep your account secure and for “sign out everywhere”. Your sign-in token is kept in your device’s secure storage (iOS Keychain, Android Keystore); a token not used for 180 days is deleted.
• Service e-mails: e-mail verification, password reset, invitations, ownership-transfer notices, export-ready notices and the deletion confirmation (see section 9). We do not send marketing e-mails.
• Notifications: your in-app notifications (for example task updates) are kept for 180 days.

Web panel (app.vidimu.com). You sign in with the same account. The panel uses only the cookies needed to keep you signed in and secure (a session cookie and a CSRF cookie, and a remember-me cookie if you choose it). It has no advertising or analytics cookies and loads no third-party scripts or fonts.

Our staff. Authorised staff can see information such as your account, plan and storage use in our internal admin panel for support and security; that panel does not show photos or videos. We can also carry out your KVKK requests through it.

Purpose and legal basis: to provide the account and services (performance of a contract, KVKK Article 5(2)(c)); to keep accounts secure and prevent abuse (legitimate interest, Article 5(2)(f)). For how to delete your account and data, see Delete your account and data.

7. Cloud backup and team workspaces

Cloud backup and sync work with a Vidimu account and only if you have the Pro entitlement or work in a team workspace. Without these, no photo, video or record is uploaded to our servers. When active, the following is uploaded and stored:

• Photos and videos: the watermarked final image, the unwatermarked original where there is one, a thumbnail; videos (with sound) and the video’s watermark track;
• Capture details: capture time and time zone, coordinates, accuracy, altitude and address (if location is on), the capture’s name, note and tags, its project and unit, the verification code and status;
• Projects: name, client, address and area, dates, work units, cover image and members;
• Tasks: title, description, priority, dates, checklist, attachments (photos, PDFs, office documents), assignees and task history;
• Punch-clock records: clock-in and clock-out time, location and address, the punch photo and managers’ correction entries;
• Workspace data: watermark templates (including logos), teams, members and their roles, invitations (the invited person’s e-mail address) and the activity log.

Where? Files and records are stored on our servers in Türkiye. Encrypted backup copies of the files are kept on Cloudflare R2 (EU region); see section 11. File download links are signed and short-lived (15 minutes).

Who can see it? No other Vidimu user can see the content of your personal space. In a team workspace, team members see the content according to the rules set by the workspace’s admins (for example by project membership). What anyone who has a verification code can see is described in section 4, and that applies even if you do not use cloud backup. You can export content from the web panel as a ZIP; the prepared ZIP file is deleted after 24 hours.

Team workspaces. When a company uses a team workspace, the company decides what is processed about its employees, for example punch-clock records, task approvals and who can see which project’s files. For that data the company is the data controller and Visorya acts as its data processor (“veri işleyen”). If you use Vidimu through your employer, contact your employer first about how your data is used; we will help them respond. The company is responsible for informing its employees and for having a lawful basis for processing their data, including their location and photos.

The content of photos and videos. Photos and videos can show people. We only store them and process them to show them to you; we do not analyse their content with artificial intelligence and do not perform face recognition. We do not intend to process special categories of personal data. You are responsible for whom you photograph and share (see the Terms of Use).

Purpose and legal basis: to provide cloud backup, teamwork and the web panel (performance of a contract, KVKK Article 5(2)(c)).

8. Subscriptions and payments

Vidimu’s Pro and Team plans are bought as subscriptions through the Apple App Store or Google Play. The store takes the payment; we do not receive your card details.

We manage subscriptions with RevenueCat, Inc. (USA). The app contacts RevenueCat when you open the Pro page, buy a plan or restore purchases; if you do none of these, no request goes to RevenueCat. If you have made a purchase or a restore on this device, the app also contacts RevenueCat every time it opens and when you sign in or out, to keep your subscription status up to date. RevenueCat receives:

• an anonymous ID if you have no account, or your Vidimu account ID if you do (a random ID, not your name or e-mail); for Team plans also the workspace ID;
• purchase information from the store: product, dates, status and the store transaction ID;
• technical data such as the IP address of the request and, on iOS, the app-vendor device identifier (IDFV).

RevenueCat reports subscription events (purchase, renewal, cancellation, expiry) to our servers, and we activate your plan. Our servers keep your subscription record (product, status, start and end date, store transaction ID, account ID); no name or e-mail is in these records. We use subscription data to manage your subscription and to see aggregate figures such as revenue and renewals. You do not have to buy a plan or open the Pro page.

Purpose and legal basis: to manage your subscription (performance of a contract, KVKK Article 5(2)(c)); to prevent fraudulent transactions (legitimate interest, Article 5(2)(f)); record-keeping obligations (legal obligation, Article 5(2)(ç)).

9. E-mail and website

• E-mail. When you write to us, and in service e-mails (section 6), we process your e-mail address and the content of your messages. Our e-mail is delivered by Mailgun Technologies, Inc. in the USA (US region).
• Website. vidimu.com, including the short verification addresses vidimu.com/v/CODE, uses Cloudflare for DNS and content delivery, so Cloudflare processes visitors’ IP addresses and request data to deliver the site and protect it from attacks. For api.vidimu.com, app.vidimu.com and verify.vidimu.com Cloudflare provides DNS only; requests to these addresses do not pass through Cloudflare’s proxy. The website itself sets no cookies and uses no analytics or trackers.
• Server logs. Our web and API servers (vidimu.com, api.vidimu.com, app.vidimu.com) keep standard access logs for security and troubleshooting: IP address, date and time, requested address, referring page and browser or app information. For a short verification address, the requested address includes the code. These logs and our application error logs are kept for about 14 days. verify.vidimu.com keeps no access log (see section 4).

9a. Advertising on the free plan

On the free plan the app shows ads served by Google AdMob (Google Ireland Limited and Google LLC). Pro and Team users, and members of a team workspace, see no ads, and the app does not start the ad software for them. Before you have accepted the privacy notice in the app, no ad is requested and the app does not start the ad software.

What the ad software collects and shares with Google (free plan only):

• your device’s advertising identifier: the Advertising Identifier (IDFA) on iOS, only if you allow tracking when asked; the Android advertising ID on Android; and, on both, a similar device or app-set identifier;
• your IP address, from which Google derives an approximate location (city level);
• how you interact with ads and the app: app launches, taps, ad impressions and clicks;
• diagnostic information about the ad software: launch time, hang rate, energy use and crashes of the ad software.

Your photos, videos, projects, tasks, name and e-mail address are never sent to the ad software. Google uses this data to serve and measure ads and to prevent fraud; Google acts as an independent controller under its own policy (policies.google.com/privacy; how Google uses data from apps that use its services). We do not receive your Google profile and do not sell personal data.

Your choices:

• iOS: after you accept the privacy notice, iOS asks whether Vidimu may track your activity across other companies’ apps and websites. If you decline (or later turn it off in Settings › Privacy & Security › Tracking), the advertising ID is not shared with Google and is not used to personalise your ads.
• Android: the ad software uses the Android advertising ID; outside the EEA, the UK and Switzerland no separate consent form is shown. You can delete or reset the advertising ID at any time in your device settings (for example Settings › Google › Ads).
• EEA, the UK and Switzerland: Google’s consent form asks for your choice before any ad is requested. If you do not consent, Google shows only non-personalised or limited ads. You can change your choice at any time in Profile › Support › Ad privacy choices.
• Everywhere: subscribing to Pro or Team removes the ads and stops this processing.

Legal basis (KVKK and, where it applies, GDPR): your explicit consent, given through the iOS tracking prompt or Google’s consent form; where no consent is required, our legitimate interest in funding the free plan. You may withdraw consent at any time as described above. Ad content is limited to Google’s PG (parental guidance) rating, and the app is not directed at children (section 15).

10. What we do not do

• No advertising to Pro and Team users, and none before you accept this notice. Free-plan ads come from Google AdMob (section 9a).
• No third-party tracking, crash-reporting or analytics software (SDKs) in the app other than the ad software used on the free plan (section 9a). RevenueCat, which we use to manage subscriptions, is separate and is described in section 8.
• We do not sell or rent personal data. On iOS the advertising ID is used for ads only if you allow tracking, and in the EEA, the UK and Switzerland personalised ads are shown only with your consent; on Android you can delete or reset the advertising ID at any time (section 9a).
• We do not analyse the content of your photos and videos and do not use them to train artificial intelligence.

11. Service providers and transfers abroad

We share data only with the providers below, only for the purposes stated, and never for their own marketing, except that Google AdMob, acting under its own privacy policy, uses ad data to serve and measure ads and to prevent fraud (section 9a).

Our hosting and e-mail hosting providers, Cloudflare, RevenueCat and Mailgun process data on our behalf: they may use it only to provide their service to us and must protect it. Apple, Google and the OpenStreetMap Foundation provide the address, map and store services under their own privacy policies; MET Norway provides the weather service under its own terms; and, for the free plan’s ads, Google AdMob acts under its own privacy policy (section 9a).

Transfers abroad (KVKK Article 9). Personal data may be transferred to recipients outside Türkiye such as Cloudflare (R2 backup and DNS/content delivery), RevenueCat, Mailgun, Apple, Google (including ad serving through AdMob), OpenStreetMap and MET Norway. We make these transfers in accordance with the conditions in Article 9 of the Turkish Personal Data Protection Law No. 6698, relying on the contracts we have with our service providers and on transfer mechanisms that comply with the legislation in force. The file backup is encrypted on our side before it is written to R2; the encryption key is kept on our server in Türkiye and in our company’s password manager, not by Cloudflare. We may also disclose data where the law requires it, for example to courts or authorities.

12. How long we keep data

See Delete your account and data for step-by-step instructions.

13. Your rights

Under Article 11 of the KVKK you can ask us whether we process your data and for information about it; learn the purpose of the processing and whether the data is used for that purpose; know who it was shared with in Türkiye or abroad; ask us to correct incomplete or inaccurate data; ask us to delete or destroy it under Article 7; ask us to tell those recipients about a correction or deletion; object to a result that affects you negatively and comes solely from automated processing; and claim compensation for damage caused by unlawful processing. You can also complain to the Turkish Personal Data Protection Board.

If the European Union, United Kingdom or a similar data protection law applies to you, you also have the right to access, correct and erase your data, to restrict its processing, to data portability and to object to processing, the right to withdraw consent you have given, and the right to complain to the data protection authority where you live.

You can do many things yourself: edit your account details in the app, download your captures from the web panel and delete your account. For other requests write to [email protected]. For verification records, include the code or codes concerned. To confirm that a request comes from you, we may ask you to write from the e-mail address of your account or to give us some information. You can also apply in writing to our address; the application rules are in the Personal Data Notice (KVKK). We answer within 30 days at the latest, free of charge; only if a request involves an additional cost may the fee set by the Personal Data Protection Board apply.

14. Security

Data is sent over encrypted connections (HTTPS). Passwords are stored as one-way hashes. Capture times are signed by our server, and the app signs its verification requests with its device key, so forged records can be detected. Your sign-in token is kept in your device’s secure storage. File download links are short-lived. Backups that leave our server are encrypted: verification and database backups with AES-256, file backups encrypted on our side before upload. Sign-in attempts and request rates are limited. Access to our servers and our internal admin panel is restricted to authorised staff. No system is perfectly secure; if we become aware of a breach affecting you, we will inform you and the authorities as the law requires.

15. Children

Vidimu is a work tool and is not intended for children under 16. We do not knowingly collect data from children under 16. If you believe a child has used the service, contact us and we will delete the data.

16. Changes to this policy

We will update this policy when we change what we collect or how we process it. The date at the top shows the latest version. For significant changes we will also let you know in the app or on this website before they take effect. Latest change (9 October 2026): ads on the free plan (section 9a) and weather data (sections 5 and 11) added.

17. Contact