Privacy Policy

1. Whose data, in which role

• Photographers (users of the service): Pickfolio Portal is the controller of this data.
• Photographers' clients: photos and client details are added by the photographer, who is the controller of that data. Pickfolio Portal processes it only on the photographer's behalf and instructions (processor).

2. Data we process

• Photographer account: name, studio name, email, phone, website, Instagram username, a one-way hash of the password, two-factor authentication data, session records (IP address and browser details).
• Galleries: photos uploaded by the photographer, gallery settings, prices and delivery details.
• Clients: name, email and phone entered by the photographer; the photos, notes and products the client picks, and when they last opened the gallery.
• Instagram connection (if the photographer connects one): app-scoped Facebook user ID, access token of the Facebook Page the Instagram account is linked to (stored encrypted), Instagram account ID and username, messages received by the account and sent from the panel, and the name, username and profile picture of people who send messages.

3. How we use it

• Creating the account, secure sign-in and providing the service.
• Showing galleries to clients and passing their selections to the photographer.
• Sending service emails (sign-up confirmation, password reset, gallery and selection notifications).
• Showing Instagram messages in the photographer's panel and letting the photographer reply to them from the panel.

Your data is not used for advertising, profiling or marketing, and is never sold. Data received from Instagram is used only for the messaging purpose above; it is not processed for any other purpose or shared with third parties.

Legal grounds: entering into and performing a contract (KVKK art. 5/2-c), the controller's legitimate interest (art. 5/2-f) and legal obligations (art. 5/2-ç).

4. Service providers

• Hostinger: server running the application and database (Europe).
• Cloudflare: photo storage (R2), domain and security services.
• Resend: sending notification emails.
• Meta Platforms (Facebook and Instagram): receiving and sending messages of the Instagram account the photographer connects.

The service runs on the infrastructure of the providers below. Some of them have servers outside Turkey; data is transferred only as far as needed to provide the service.

5. Retention and deletion

• Photographer accounts and galleries are kept while the account is open. When a photographer permanently deletes a gallery, its photos and selections are deleted too.
• When you ask for your account to be closed, your data is deleted; records that must be kept by law are kept for the required period.
• Database backups are kept for at most 30 days and then deleted automatically.
• Instagram data: when a photographer removes the Instagram connection in the panel, or removes Pickfolio Portal under "Apps and websites" in Facebook's settings, the account's conversations, messages and access token are deleted immediately. Data deletion requests sent through Meta are carried out immediately as well, and their status is shown at pickfolio.net/instagram-data-deletion.

6. Cookies

Only cookies needed for the service to work are used: a session cookie (to keep you signed in) and your language choice. No advertising or tracking cookies are used.

7. Security

Connections are encrypted (HTTPS). Passwords are stored as one-way hashes and two-factor authentication is required for photographer accounts. Original photos open only through signed, time-limited links, and Instagram access tokens are stored encrypted.

8. Your rights

Under article 11 of the KVKK you may ask whether your personal data is processed, request information about it, ask for it to be corrected or deleted, learn who it was transferred to, object, and claim compensation for damage. Send your request to info@pickfolio.net; it will be answered within 30 days.

If you are a photographer's client and your request concerns data in a gallery, we recommend contacting the photographer first; if you contact us, we will forward your request to them.

9. Changes

This policy may be updated. The current version is always on this page; photographers are notified of significant changes by email.