Privacy Notice on the Processing of Personal Data

Under Personal Data Protection Law No. 6698 ("KVKK"), we would like to inform you about the personal data processed when you use the Yeşilay Mirror of the Future (Geleceğin Aynası) application.

Data Controller: Turkish Green Crescent Society (Türkiye Yeşilay Cemiyeti) — Sepetçiler Kasrı, Sirkeci / Istanbul — yesilay.org.tr

Your personal data is processed by the Turkish Green Crescent Society.

Mirror of the Future is provided by the Turkish Green Crescent Society for use at events (kiosks) organized as part of Yeşilay's addiction-prevention awareness activities, and on its website. The application does not require registration; each use is processed as an anonymous session.

1. Personal Data Processed

• Visual data (may be special category data): The facial photo you take with the camera or upload, and the simulation images generated from it by artificial intelligence. A facial image may qualify as special category personal data under Article 6 of the KVKK. The application does not perform biometric identity verification or facial recognition; the image is used solely to generate a simulation for awareness purposes.

• Contact data (optional): The email address you enter if you ask for your results to be sent to your email. The address is used only for that delivery and is not stored in plain text in the system (the delivery record keeps only a masked version and an irreversible hash).

• Transaction security data: An irreversible hash of your IP address, browser/device information, anonymous session logs, consent timestamps and the versions of the texts you approved.

• Usage data: The selected addiction type (smoking, alcohol, etc.), frequency of use, year scenarios, date and duration of the session, and any feedback you choose to leave (rating, decision, comment).

2. Purposes of Processing

• To generate, from your photo and based on the addiction scenario you select, an awareness-oriented aging simulation for future years and, if you wish, a comparison with addiction-free aging ("Two Paths"),

• To show you the results and allow you to download and, if you wish, share them,

• To send your results to the email address you enter, only if you request it,

• To ensure system security, prevent misuse and fulfil legal obligations,

• To produce anonymous statistics that cannot be linked to your identity.

3. Legal Grounds

• Provision of the service and sending email at your request: KVKK Art. 5/2-c (performance of a contract) and Art. 5/2-f (legitimate interest),

• Processing of your facial photo: your explicit consent under KVKK Art. 6,

• Transfer abroad: under KVKK Art. 9; the transfer is made solely for generating the simulation, on an occasional basis and over an encrypted connection; the data controller is obliged to put in place the necessary safeguards with the provider, including the standard contract published by the Personal Data Protection Board. You approve this transfer knowingly and with your explicit consent, and you are deemed informed of the risks it may carry (the data being temporarily processed on servers subject to a foreign legal system),

• Transaction security records: KVKK Art. 5/2-ç (legal obligation) and Art. 5/2-f.

4. Transfer

To generate the simulation, your photo is sent over an encrypted connection (HTTPS) to an AI image-processing service provider (Google and/or OpenAI models via OpenRouter). These providers' servers may be located abroad. The transfer is made solely for the purpose of generating the simulation and is limited in duration; the providers operate under enterprise API terms under which they commit not to use the image to train their own models.

If you ask for your results to be sent by email, the address you enter and the images are transmitted only for that delivery, through the email server that performs it. Data may also be transferred to authorized public authorities where required by law. Your data is not sold or rented to third parties for marketing purposes.

5. Retention Period

Your photo and the simulation images are temporary files: they are deleted when you finish the experience or when the session ends, and in any case they are automatically deleted at the end of the retention period set in the admin panel (default 5 minutes, maximum 24 hours). The images are not kept in the developer's archive.

You can delete your images immediately and permanently using the "Delete my results now" button on the results screen; deletion cannot be undone. You can also write to info@yesilay.org.tr.

Consent records and anonymous session and statistics records that contain no images are kept for the period set in the admin panel (default 2 years) or for the statutory limitation period.

Results sent by email remain in your inbox; their retention is independent of the automatic deletion in the application.

6. How We Protect Your Data

• All traffic is encrypted with HTTPS.

• Photos and images cannot be accessed through a public address; they can only be viewed with a token specific to your session.

• Location and device metadata (EXIF) in photos is removed before processing.

• API keys and secret settings are stored on the server encrypted with AES-256-GCM.

• Images are deleted automatically at the end of the retention period; you can also delete them yourself at any time.

7. Who We Share Data With

• AI providers (Google/OpenAI via OpenRouter): solely for generating the simulation, per photo and temporarily.

• Email service provider: only if you choose to have your results sent to your email; the address you enter and the images are transmitted with the message. Retention of the email in your inbox is separate from the automatic deletion in the application.

• Authorized public authorities: where required by law.

8. Children's Privacy

The service is not intended for persons under 18; participants under 18 may take part only when accompanied by and with the consent of a parent/guardian (with the consent box ticked by the parent/guardian). If we learn that data belonging to a person under 18 has been processed without parental consent, we will delete it immediately.

9. Your Rights (KVKK Art. 11)

You have the right to learn whether your personal data is processed; to request information if it has been processed; to learn whether it is used in line with its purpose; to know the third parties to whom it has been transferred; to request correction if it has been processed incompletely or incorrectly; to request its erasure or destruction; to request that these actions be notified to the third parties to whom it was transferred; to object to a result against you arising from analysis by automated systems; and to claim compensation if you suffer damage.

You can submit your requests to the Turkish Green Crescent Society in writing at the postal address above or through the contact channels on yesilay.org.tr. Requests are concluded free of charge within 30 days at the latest.

10. Changes and Contact

When we update this notice, we will change its version date and, where necessary, ask for your consent again. For questions: info@yesilay.org.tr

11. Important Notice

The generated images are not a medical diagnosis, prediction or scientific forecast; they are AI outputs created for artistic and awareness purposes. For support with addiction, you can call the Yeşilay Counseling Center (YEDAM) helpline at 115.