Privacy Policy

For event owners who sign in to Guestoria with their Google account, the following information is processed:

• the email address of your Google account and the account information needed for authentication;
• your dashboard language preference;
• the event date, welcome message, the initials you choose to show on the QR, and technical identifiers for the event;
• an optional custom cover photo or video you upload, and the poster image generated for a video;
• the email address, storage usage, and capacity of your connected Google Drive account;
• the encrypted access and refresh information required for Drive access;
• technical records related to uploads, the Drive connection, and service notifications.

You don't need to create a Guestoria account or share an email address to upload photos or videos through a Guestoria QR link.

The following information may be processed during an upload and to track its progress:

• file name, file type, and file size;
• upload status and timestamps;
• technical identifiers for the event and the upload, and the Google Drive file ID of the uploaded file;
• limited diagnostic information: browser and device platform, user agent, upload progress and error information, and connection and page-visibility events;
• a random technical session identifier created in your browser.

This technical identifier does not contain your name or email address; it is used to investigate upload reliability issues.

Photos and videos uploaded by guests are not permanently stored by Guestoria. The file content passes through our upload relay infrastructure running on Cloudflare to Google, and is stored in the Google Drive account the event owner has connected.

The information that reaches Guestoria and is kept in its database consists of technical details about the file (such as file name, type, size, upload status, and Drive file ID). The photo and video content itself is not kept in Guestoria's database or permanent media storage.

The event owner controls how files in Drive are kept and deleted. When an event ends, Guestoria does not delete these files from the event owner's Drive account.

If an event owner chooses a custom cover photo or video, that content and the poster image generated from a video are stored in the Supabase storage used by Guestoria.

The cover is served through a URL so that people who scan the QR code can view the event page. It is therefore handled differently from private guest uploads and can be viewed by anyone who has that address.

When an event owner restores the default cover, the unused custom cover and poster image are removed. The cover and poster are also deleted when the event's retention period ends (see Retention periods).

Event owners sign in with their Google accounts and can connect one or two Google Drive accounts for photo and video transfer.

Guestoria's Google Drive access is limited to the drive.file permission scope. This scope does not give general access to other files in your Drive account; in its current operation, Guestoria does not list, scan, or download your unrelated Drive files. Google's permission screen may describe this scope in broad terms; that wording does not mean Guestoria performs all of those actions.

For the connected Google account, Guestoria reads or processes:

• the email address of the connected account;
• storage usage and capacity;
• whether a file uploaded through Guestoria exists, its size, and whether it is in the trash.

The access and refresh information required for Google Drive access is stored encrypted on the server and is not given to guests. During an upload, a guest's browser receives only a time-limited, encrypted transfer credential.

When a Drive connection is no longer needed (for example, when an account is switched or a connection is removed), Guestoria, where appropriate, deletes this access information and revokes the Google authorization.

Information is processed for the following purposes:

• creating accounts, signing in, and managing sessions;
• creating and managing events and QR links;
• receiving guest uploads and transferring them to Google Drive;
• managing the Drive connection and storage status;
• displaying the cover and the guest page;
• monitoring upload reliability, investigating errors, and keeping the service secure;
• sending service emails needed for the operation of the service;
• applying your language preference;
• responding to support requests;
• meeting obligations arising from applicable law and protecting the service.

Event owners

• Authentication (session) cookies needed to keep you signed in.
• A functional language cookie that remembers your dashboard language preference.
• A short-lived (about 10 minutes) language cookie that carries the language you chose on the site through Google sign-in.

Guests

Guestoria does not set a session cookie or a language cookie for guests. Your browser's local storage (localStorage) is used to keep uploads continuous; the photo or video itself is never stored there.

• Records of unfinished uploads (file name, size, and upload session details) are kept for up to 7 days.
• Records of completed uploads (to help avoid uploading the same file again by mistake) are kept for about 24 hours.
• The random technical identifier used for diagnostics is renewed at least once every 30 days.

Guestoria sends operational emails about account setup, your Google Drive connection, storage status, and the operation of the service. These emails are not marketing; at present, Guestoria does not send marketing emails.

Emails are sent in Turkish or English according to your stored language preference.

The following periods are the retention periods set by Guestoria:

• Guest photos and videos: not permanently stored by Guestoria.
• Diagnostic records: up to 30 days.
• Event information, upload records (file name, type, size, status, and Drive file ID), event notification records, and a custom cover photo or video (and poster image): 90 days after the event expires or is closed manually by the event owner.
• Event owner account information: while the account is in use and the relevant purpose continues, subject to applicable obligations.
• Google Drive access information: for as long as it is needed for the connection.
• Unfinished upload records in the browser: up to 7 days; completed upload records: about 24 hours.

At the end of the 90-day period, content linked to the event and account is deleted. So that someone who scans an old Guestoria QR code can be shown an "uploads have ended" screen, a minimal record may remain that contains only the QR link's identifier, the page language, and the time it was retired. This record contains no event content, cover, Drive information, or link to the event owner.

Media files in the event owner's Google Drive account are not affected by these periods.

Guestoria uses the infrastructure of the following service providers:

• Supabase — database, authentication, and storage of cover files;
• Google — sign-in with Google and Google Drive integration;
• Cloudflare — the upload relay infrastructure that transfers guest uploads;
• Resend — sending service-related emails;
• Vercel — hosting the application and running server-side processing.

The information needed for the relevant service to work is shared with, or processed through, these providers.

At Guestoria, security is part of how the service is designed. This includes storing Google Drive access information encrypted, limiting access to data with authorization and row-level access rules, and checking guest actions on the server.

That said, no method of data transmission over the internet or electronic storage can guarantee absolute security.

Under Article 11 of the Turkish Personal Data Protection Law No. 6698 (KVKK), you have the following rights regarding your personal data:

• to learn whether your personal data is processed;
• to request information if it has been processed;
• to learn the purpose of processing and whether it is used in line with that purpose;
• to know the third parties to whom your data is transferred, in Türkiye or abroad;
• to request correction if your data is incomplete or inaccurately processed;
• to request deletion or destruction within the conditions set out in Article 7 of the KVKK;
• to request that corrections and deletion or destruction be notified to third parties to whom your data has been transferred;
• to object to a result against you that arises from analysis of your data exclusively through automated systems;
• to request compensation for damage if you suffer harm because your data was processed unlawfully.

You can send requests about these rights to: helloguestoria@gmail.com

Depending on the nature of your request, we may need to verify your identity or your connection to the relevant Guestoria account before fulfilling it.

Guestoria's features, its service providers, or its legal obligations may change over time, so this policy may be updated. The current policy is always published on this page, and the date of the last update is shown at the top.