Privacy Policy

Last updated: 21 October 2026

Clinshot is cloud business software that stores and backs up the work photos businesses take, in an organized way. This policy explains how your personal data is processed when you use the Clinshot website (clinshot.com) and the Clinshot mobile app.

Provider

Z4M Bilişim Teknolojileri A.Ş., Seyrantepe Mah. Yayıncılar Sok. No:2/19 Kağıthane İstanbul TR, Mersis: 0996051021100001. Contact: [email protected].

Roles

• For your account information (name, email, password, sign-in records), Clinshot is the data controller.
• For the content your business uploads to Clinshot (photos, client records, notes), the data controller is the business that opened the account. Clinshot stores and processes this content only on behalf of and as instructed by the business (data processor).

Data we collect

• Account: name, email, password (stored irreversibly hashed), language preference, role.
• Usage: sign-in times, device model and operating system version, app version, error logs.
• Content: the photos your business uploads and the records linked to them.

The app shows no ads, does not track you across other apps and websites, and does not sell your data.

Why we process it

To provide the service, protect your account (for example two-step verification, device management), give support and meet legal obligations.

Phone permissions

• Camera: only when you take a photo in the app.
• Photos: only when you choose to add a photo from your library, and only for the photos you select.
• Motion sensor: to show that the phone is held level while taking a photo; it is not recorded.

Photos taken in the app are not saved to the phone's photo library. Until they are uploaded they are kept only in the app's own storage, and they are deleted from the phone once the upload is confirmed.

Photos that show a face

Some photos taken with Clinshot (for example a face pose) may show the person's face. Clinshot stores these photos only as ordinary image files. The app and website do not perform face detection, face recognition, face mapping or any other processing of biometric data, and do not use Face ID, the TrueDepth camera, ARKit face tracking or similar technologies. The face outline shown on the camera is a fixed drawing that helps align the frame; it does not analyze the image.

Photos that show a face are handled like all other photos of the business:

• Use: used only by the business that took them, to follow the client's before-and-after progress. They are not used for advertising, profiling, analytics or AI training.
• Consent: a photo is taken only after the person's recorded photo consent.
• On the phone: kept only in the app's own storage, never saved to the photo library, and deleted from the phone once the upload is confirmed.
• Where they are stored: transferred over an encrypted connection and stored in the cloud storage service named below, accessible only to the authorized team members of that business.
• Sharing: not shared with or sold to third parties; only the storage provider stores the photos on our behalf.
• Retention and deletion: photos are kept until the business deletes them, and are deleted within 48 hours after the business account is closed. The person photographed can ask the business, or write to [email protected], to have their photos deleted.

Storage and security

Data is transferred over an encrypted connection (HTTPS) and stored with access limited by permission. Account and record data is stored on our servers in Turkey; photos are stored in a private, non-public bucket in the Cloudflare R2 cloud storage service. When an account is deleted, its account information is deleted; business content is deleted within 48 hours after the business account is closed.

Sharing

Data is shared only with the infrastructure providers needed to provide the service (hosting: Z4M Bilişim Teknolojileri A.Ş., [email protected]; photo storage: Cloudflare, Inc.) and, where legally required, with the competent authorities.

Your rights

To use your rights under Article 11 of the Turkish Personal Data Protection Law (KVKK), write to [email protected]. See the KVKK Information Notice for details. You can delete your account in the app or on the web; see Account Deletion.