Privacy Policy

1. Introduction

Weddingify Inc. ("Company", "we", "us") is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our AI-powered wedding photography platform.

This policy is designed to comply with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), Turkey's Personal Data Protection Law (KVKK), and other applicable data protection regulations worldwide.

2. Data Controller

Weddingify Inc. is the data controller responsible for your personal data. For data protection inquiries, contact our Data Protection Officer at:

• Email: privacy@weddingify.com
• Website: weddingify.com/contact

3. Information We Collect

3.1 Information You Provide

• Account Information: Name, email address, and password when you create an account.
• Uploaded Photos: Images you upload for AI processing. These may contain biometric data (facial features) which we process only for the purpose of generating your wedding photos.
• Payment Information: Processed securely through our payment provider (Stripe). We do not store your full credit card details.
• Communication Data: Messages, feedback, and support requests you send to us.

3.2 Automatically Collected Information

• Device Information: Browser type, operating system, device identifiers.
• Usage Data: Pages visited, features used, time spent on the platform.
• IP Address: For security, fraud prevention, and approximate geolocation.
• Cookies: As described in our Cookie Policy.

4. How We Use Your Data

We process your data for the following purposes:

• Service Delivery: To generate AI wedding photos based on your uploaded images (Legal basis: Contract performance).
• Account Management: To create and manage your user account (Legal basis: Contract performance).
• Payment Processing: To process transactions and prevent fraud (Legal basis: Contract performance, Legitimate interest).
• Service Improvement: To analyze usage patterns and improve our AI models (Legal basis: Legitimate interest). Note: Your photos are NOT used to train AI models without explicit consent.
• Communication: To send transactional emails, support responses, and with your consent, marketing communications (Legal basis: Consent, Legitimate interest).
• Legal Compliance: To comply with applicable laws and regulations (Legal basis: Legal obligation).

5. Photo Data Protection

We understand that your photos are deeply personal. Here's how we protect them:

• Encrypted Storage: All uploaded photos are encrypted at rest using AES-256 encryption and in transit using TLS 1.3.
• Limited Access: Only automated AI systems process your photos. Human access is restricted to authorized personnel for technical support only, and only with your explicit permission.
• Auto-Deletion: Source photos uploaded for processing are automatically deleted from our active servers within 30 days of generation completion. You may request earlier deletion at any time.
• No AI Training: Your uploaded photos are never used to train our AI models without your explicit, separate consent.
• Biometric Data: Facial features are processed exclusively for generating your wedding photos. This data is not stored separately and is deleted with the source photos.

6. Data Sharing & Third Parties

We may share your data with the following categories of recipients:

• AI Processing Partners: Google (Gemini AI) and Wiro AI for image generation. Photos are transmitted securely and processed according to their data processing agreements.
• Cloud Infrastructure: Our platform is hosted on secure cloud infrastructure with SOC 2 compliance.
• Payment Processors: Stripe for secure payment processing (PCI DSS compliant).
• Analytics: Google Analytics for anonymized usage statistics (with IP anonymization enabled).

We do not sell your personal data to third parties. We do not share your photos with advertisers.

7. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States. We ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data processing agreements with all third-party processors
• Compliance with the EU-US Data Privacy Framework where applicable

8. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of your personal data we hold.
• Rectification: Request correction of inaccurate data.
• Erasure ("Right to be Forgotten"): Request deletion of your data and all uploaded photos.
• Data Portability: Receive your data in a structured, machine-readable format.
• Restriction: Request limitation of processing of your data.
• Objection: Object to processing based on legitimate interest.
• Withdraw Consent: Withdraw consent at any time without affecting lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@weddingify.com. We will respond within 30 days (GDPR) or 45 days (CCPA).

9. KVKK Compliance (Turkey)

For users in Turkey, in accordance with the Personal Data Protection Law No. 6698 (KVKK):

• Your explicit consent is obtained before processing biometric data (facial features in photos).
• You have the right to learn whether your data is processed, request information about processing, and request deletion.
• You may file complaints with the Personal Data Protection Authority (KVKK Kurulu).
• Data retention periods comply with KVKK requirements.

10. Data Retention

• Account Data: Retained as long as your account is active, plus 2 years after deletion.
• Uploaded Source Photos: Deleted within 30 days of generation completion.
• Generated Images: Available for download for 1 year after creation. Stored securely in your account.
• Payment Records: Retained for 7 years as required by tax regulations.
• Analytics Data: Anonymized and aggregated data may be retained indefinitely.

11. Children's Privacy

Weddingify is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us immediately for deletion.

12. Security Measures

We implement industry-standard security measures including:

• AES-256 encryption at rest
• TLS 1.3 encryption in transit
• Regular security audits and penetration testing
• Multi-factor authentication for administrative access
• Automated intrusion detection systems
• Regular data backups with encrypted storage

13. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or a prominent notice on our website at least 30 days before they take effect.

14. Contact Us

For privacy-related questions or to exercise your data rights:

• Data Protection Officer: privacy@weddingify.com
• General Inquiries: weddingify.com/contact