Privacy Notice

1. Who is responsible for your data

Ephesus Photo is the service name used by the operator based in Selçuk, İzmir, Türkiye. For privacy requests, contact ephesusphotoservice@gmail.com.

2. Data we process

• Account data, such as name, email address, optional phone number and authentication records.
• Reservation data, such as session date, package, guest count, photographer preference and special requests.
• Gallery and order data, such as access records, selections, order references, entitlement and delivery status.
• Photographs and related files uploaded for private review and delivery.
• Technical and security data, such as IP address, device or browser information and audit records where needed to protect the service.
• Messages you choose to send by email or another contact channel.

3. Why we use it

We use personal data to respond to enquiries, assess availability, create and manage reservations, provide private galleries, fulfil paid or complimentary digital delivery, support accounts, prevent misuse and meet legal, accounting and security obligations.

Depending on the context, processing is based on steps requested before a contract, performance of a contract, legal obligations, legitimate interests in operating and securing the service, or consent where the law requires it.

4. Photographs and children

A photograph may identify a person and is treated with particular care. Galleries are access-controlled and intended only for the client and people authorised by that client. Account and reservation actions must be completed by an adult. If children appear in a session, the booking adult is responsible for having the authority needed for their participation and delivery of the photographs.

5. Service providers and international transfers

We use specialist providers to operate the service, currently including Supabase for authentication and database services, Cloudflare R2 for photo-object storage and Vercel for hosting and delivery. These providers may process data in countries other than yours. Where required, transfers are handled using the safeguards and contractual mechanisms available under applicable data-protection law.

We do not sell personal data. We disclose it only to service providers, professional advisers or public authorities when necessary and legally permitted or required.

6. Cookies and similar storage

The site currently uses only storage that is necessary for functions such as authentication, security and language or interface preferences. It does not currently use advertising cookies or non-essential analytics cookies. If this changes, this notice and any required consent controls will be updated before those technologies are used.

7. Retention and security

We keep records only as long as needed for delivery, account management, legal and accounting duties, dispute handling and security. A gallery may have its own visible access-expiry date. Archived photo objects become eligible for permanent storage cleanup after a safety period, while records required to preserve paid-order, audit or legal evidence may be retained longer.

We use access controls, private gallery credentials, restricted administrative functions and other reasonable technical and organisational measures. No online system can guarantee absolute security.

8. Your rights

Depending on the law that applies to you, you may ask for access, correction, deletion, restriction, objection, portability or information about processing, and may withdraw consent without affecting earlier lawful processing. Send a request to ephesusphotoservice@gmail.com. We may need to verify your identity before acting. You may also complain to the competent data-protection authority.

9. Changes and contact

We may update this notice when the service or legal requirements change. The date above shows the current version. Questions and requests can be sent to ephesusphotoservice@gmail.com.