1. Identity of the Data Controller
The data controller is Async Yazılım Bilişim Programlama San. ve Tic. Ltd. Şti.. Contact details are listed below.
- Address
- Alacamescit Mah. Çancılar Cad. Çakar Erdoğan İş Hanı Kapı No:62/306, Osmangazi/Bursa 16120
- Phone
- +90 539 634 46 01
- [email protected]
- KVKK request email
- [email protected]
- Tax Office
- Yıldırım Vergi Dairesi Müdürlüğü
- Tax ID
- 0911099493
- MERSIS No
- 0091109949300001
2. Categories of Personal Data Processed
When you use LiveAlbum we process the following categories of data:
| Category | Examples |
|---|---|
| Identity | First name, last name, date of birth, gender |
| Contact | Email address, phone number (optional) |
| Account & Authentication | Password hash, session identifier, last sign-in time, IP address, browser/device information |
| Customer Transaction | Order reference, plan choice, payment amount (card number is never stored), subscription status, invoice details |
| Customer Content | Event name, event date, venue, guest list, wish messages and audio recordings |
| Guest Uploads | Photos and videos uploaded via QR code, wish messages, guest alias/name, browser device info |
| AI Generation Metadata | Style, palette and text selections used in AI QR card and invitation generation, daily generation allowance usage logs, generation timestamps |
| Digital Trace / Marketing | Cookie identifier, pageviews, UTM parameters, opt-in marketing preferences |
| Payment Metadata | Stripe order reference, payment time, payment status, card type used (credit/debit). Card number, CVV and expiry are never stored by us. |
| Operational Security / Logs | System and security log entries, error logs, session and API access logs |
| Children's Data | Images and audio of minors (under 18) uploaded by guests in events like baby showers, birthdays and graduations (with parental/guardian consent) |
3. Purposes of Processing and Legal Bases
Your personal data is processed for the following purposes on the legal grounds set out in KVKK Article 5/2:
| Purpose | Legal Basis |
|---|---|
| Creating an account, providing the service, managing events and albums | Conclusion and performance of a contract — KVKK Art. 5/2-c |
| Processing payments, activating subscriptions, issuing invoices | Performance of contract — Art. 5/2-c; tax and commercial law compliance — Art. 5/2-a and 5/2-ç |
| Retention of tax and commercial records, book and invoice obligations | Compliance with legal obligations — Art. 5/2-ç (VUK Art. 253, TTK Art. 82) |
| Account security, fraud prevention, system and network security, log retention | Legitimate interest — Art. 5/2-f; legal obligation — Art. 5/2-ç (Law No. 5651 Art. 6) |
| Responding to support requests and resolving complaints and disputes | Performance of contract — Art. 5/2-c; establishment/defence of rights — Art. 5/2-e |
| Account, event and payment confirmation / notification emails (transactional) | Performance of contract — Art. 5/2-c |
| Marketing emails, SMS and phone outreach | Explicit consent — KVKK Art. 5/1 and Law No. 6563 Art. 6 |
| Analytics cookies, user behaviour analysis, ad measurement | Explicit consent — KVKK Art. 5/1 |
| Service improvement, debugging, aggregated product analytics | Legitimate interest — Art. 5/2-f |
4. Recipients of Transfers and Purpose
Your data may be shared with the following authorised service providers and authorities under KVKK Art. 8 for the purposes of providing the service and meeting legal obligations:
- Payment infrastructure provider (Stripe, a PCI-DSS Level 1 certified global payment institution) — to process payments.
- SMS delivery provider (NetGSM Telekomünikasyon A.Ş., based in Turkey) — to send event reminders and verification messages.
- Email delivery provider (authorised transactional mail service) — to send system and account emails.
- Cloud hosting and storage provider (authorised service provider) — to host and store data.
- AI image generation provider (authorised service provider) — to generate QR cards and invitations upon your explicit request.
- Competent public authorities (courts, prosecutors, the KVKK Board, tax administration, BTK) — only as required by applicable legislation and legal obligations.
- Advisors under a confidentiality duty (lawyers, financial advisors, auditors) — to the extent required to meet legal obligations and establish rights.
Your data is processed and stored in Turkey. Where a cross-border transfer is exceptionally required, the provisions of KVKK Article 9 are observed; for further information write to [email protected].
5. How Personal Data Is Collected
Your personal data is collected through the following channels:
- Registration, sign-in, profile and event forms on the website
- Social sign-in via Google OAuth (only name, email and profile picture are shared)
- Guest upload flows via QR code (photos, videos, wish text)
- Cookies and similar tracking technologies (non-essential cookies only with explicit consent)
- Customer support email and contact form
- Stripe secure payment flow at the payment step (no card data reaches us)
6. Retention Period
Your personal data is retained for the periods below; at the end of the period it is deleted, destroyed or anonymised at our initiative or upon your request.
- Account data — for as long as your account is active, plus a 30-day recovery window after a deletion request.
- Event content (photos, videos, wishes) — for the archive period of your plan (between 30 days and 1 year, depending on your plan; for the life of your subscription on the Organizer plan).
- Payment and invoice records — 10 years under VUK and TTK.
- System and traffic logs — 2 years under Law No. 5651.
- Marketing consents and change history — until consent is withdrawn, plus 3 years for evidentiary purposes.
7. Rights of the Data Subject (KVKK Article 11)
By contacting the data controller you may exercise the following rights:
- (a) Learn whether your personal data is processed
- (b) Request information if your personal data has been processed
- (c) Learn the purpose of processing and whether it is used for that purpose
- (ç) Know the third parties to whom personal data has been transferred, domestically or abroad
- (d) Request correction of incomplete or inaccurate personal data
- (e) Request deletion or destruction of personal data within the conditions set in KVKK Art. 7
- (f) Request that any corrections or deletions be notified to third parties to whom the data was transferred
- (g) Object to a result that disadvantages you arising from automated processing alone
- (ğ) Claim compensation for damage suffered due to unlawful processing of your personal data
8. Application Channels and Response Time
Under KVKK Article 13 and the Communiqué on the Procedure for Applications to the Data Controller you may submit your application via:
- Email to [email protected], from the email address registered on your account
- With secure electronic signature, mobile signature or registered electronic post (KEP)
- Registered postal mail to the data controller's address
- In person at the data controller's address, with valid ID
Applications are answered within at most 30 days, free of charge as a rule. A fee under the tariff set by the KVKK Board may apply for written responses exceeding 10 pages. For a full request form visit the Data Subject Request page.
9. Right to File a Complaint
If you do not receive a response within 30 days, find the response insufficient or have your application rejected, you may file a complaint with the Personal Data Protection Authority (kvkk.gov.tr) under KVKK Article 14.
10. Cases Requiring Explicit Consent
Marketing emails, SMS, phone outreach and analytics/advertising cookies are processed only with your separate explicit consent. You may withdraw any of these consents free of charge at any time. See the Explicit Consent page for details and manage your preferences from the Permissions section in your dashboard.
11. Children's Data
Events such as baby showers, birthdays and graduations may involve uploads featuring people under the age of 18. LiveAlbum always balances the legitimate-interest assessment in favour of the child, in line with the KVKK Board's principle decisions. The event host undertakes to obtain explicit consent from the parents or guardians of any minors featured. Parents and guardians can request removal by emailing [email protected]; such requests are actioned within 72 hours.
12. VERBIS Registration
Under KVKK Board principle decisions 2018/87 and 2023/1154, the data controller Async Yazılım Bilişim Programlama San. ve Tic. Ltd. Şti. is exempt from registration with the Data Controllers' Registry (VERBIS) because its annual headcount is below 50, its annual balance sheet total is below TRY 100 million, and its main activity does not involve processing special category personal data. This exemption does not remove other KVKK obligations (transparency, data security, responding to data subject requests, etc.). Should the criteria be exceeded, registration with VERBIS will be completed within 3 months.