Privacy policy
This policy explains in plain language what data IDPhotoly collects, why, and what your rights are. It is written to be compatible with the GDPR and the Turkish KVKK.
Who we are
The data controller is IDPhotoly (idphotoly.com). You can reach us at [email protected] for any question about your data.
Your photos
Your photo is processed locally in your browser using on-device face detection. The original photo is never sent to our servers.
Optional encrypted backup
Only if you tick the backup box, the finished photo files are encrypted in your browser (AES-GCM) with a key that is part of your private order link. We store only the encrypted file and delete it automatically after 7 days. We do not have the key, so we cannot see the image.
Order data
When you place an order we process:
- your email address and order number;
- the chosen document and package, the amount paid and your language;
- your IP address and browser user agent, used for fraud prevention.
We keep this data for accounting purposes, for up to 10 years where tax law requires it. Our legal bases are performing the contract, our legal obligations, and our legitimate interest in preventing fraud.
Payments
Payments are handled by Lemon Squeezy, which acts as merchant of record. Card data never reaches us. Lemon Squeezy processes your payment details and applicable VAT under its own privacy policy: https://www.lemonsqueezy.com/privacy.
Contact form
If you write to us through the contact form, we receive your name, email address and message and use them only to answer you.
Analytics
We count anonymous funnel events, such as a visit to the tool, a photo being processed or checkout being opened. This is done without cookies and without personal identifiers.
Cookies and local storage
- A session cookie, used only for forms and payment testing.
- A local storage entry on your device that remembers your order links, so you can return to them. You can clear it in your browser settings at any time.
Hosting
Our servers are located in Germany (EU).
Your rights
You have the right to access your data, have it corrected or deleted, and object to its processing, as far as the law allows. You also have the right to lodge a complaint with your data protection supervisory authority. To use any of these rights, email [email protected] with your order number or the email address used for the order. Data we must keep for legal or accounting reasons cannot be deleted before the legal period ends.
Changes to this policy
We may update this policy when our service or the law changes. The current version is always published on this page, and significant changes will be highlighted here.
Last updated October 5, 2026.