Legal

Privacy Notice

Last updated: October 2026 · Data Controller: FindPhoto LLC (operating Roll)

Purposes for Which Your Personal Data Is Processed

FindPhoto LLC (operating Roll) acts as Data Controller in respect of the processing of your personal data; your personal data is processed within the framework set out below and in compliance with Turkish Law No. 6698 on the Protection of Personal Data.

Identity and Contact Data: display name, email, phone number
User and Transaction Data: user ID, the films you join, the number of shots used, the dates and times you use the service, error logs, purchase data
Transaction Security Data: session data, device identifier, IP address
Face Recognition Data: mathematical identifiers derived from facial features and the positions of faces within photos. This data is processed solely to match photos and give you access to images of yourself; it is used for no other purpose.
User-Generated Data: the films created, film details (name, date, cover), the photos taken

Your data may be processed for the purposes of creating your account, enabling your participation in a film, sharing photos at the reveal moment, improving the service and ensuring legal security.

Making photos visible to other participants and matching them through face recognition are additionally subject to your explicit consent pursuant to article 6/1 of the Law.

Legal Basis

Being expressly provided for by law
Being directly related to the conclusion or performance of a contract
Enabling the Company to fulfil its legal obligations
The establishment, exercise or protection of a right
Legitimate interest, provided it does not harm fundamental rights and freedoms
For special-category data (face recognition): explicit consent

Processing and Storage of Your Personal Data

Your personal data is obtained and processed through the Roll application by wholly or partly automated means.

Records of processing carried out under your explicit consent are logged automatically in order to evidence that consent. These records are limited to the date and time consent was given, the text version, the user ID and the transaction record; they are kept for at least 1 year.

Face identifiers have no fixed retention period: they are kept only while your face match is enabled and are irreversibly deleted the moment you remove your face data or delete your account.

Parties to Whom Your Personal Data May Be Transferred

In accordance with KVKK art. 8 and art. 9, your data may be shared, under confidentiality obligations, with cloud infrastructure providers (Amazon Web Services, Frankfurt, Supabase), app stores, and notification and messaging services. It may also be shared with competent public institutions and organisations where legally required.

Rights of the Data Subject (Article 11)

To learn whether your personal data is being processed
To request information if it has been processed
To learn the purpose of processing and whether the data is used in line with that purpose
To know the third parties to whom it is transferred, domestically or abroad
To request rectification if it has been processed incompletely or incorrectly
To request its erasure or destruction
To object to a result against you arising from analysis carried out exclusively by automated systems
To claim compensation if you suffer loss due to unlawful processing

---

Data Controller: FindPhoto LLC (operating Roll) Address: Barbaros Mah. Şebboy Sk. No: 4/1, Apt. 2, Ataşehir, İstanbul, Türkiye Phone: +90 (850) 346 54 38 Email: hello@uroll.app