Face-Recognition Self Check-in System (Portal Cappadocia)

Hotel check-in is tied to the reception queue: the guest hands over an ID, a clerk enters it into the system, a room is issued. At peak hours that is a bottleneck; at night it is a staffing cost.

The obvious way to automate it is face recognition. Two things about it are not obvious. First, security: a face matching an ID does not show that the person is physically at the hotel. Second, law: face data is a special category of personal data under article 6 of the Turkish data protection act.

The flow opens with an explicit consent gate, and a guest who declines can check in face to face at reception. That is not a courtesy but a legal requirement: consent with no alternative is not consent.

After consent there are three steps. An ID card or passport is uploaded and read with Tesseract OCR. The guest takes their own photograph. The two faces are compared with face_recognition.

Then comes a fourth step, and it is the point of the design: location is verified. A face match proves who someone is; it does not prove they are at the hotel. Without the location check the system would let a guest check in from home.

Two decisions govern storage. No photograph is kept: once the comparison is done, only the numeric representation of the face remains. And how long that representation is held is set by the hotel, because under the Turkish data protection act the hotel is the data controller; hard-coding a retention period would take the decision away from the party that has to make it.

The product reached a usable state but was never deployed: the property management system in use across the region was closed to outside integration, with no endpoint to write a check-in into.

That it was never delivered does not change the result, but it has to be said plainly: the system never ran with real guests, so there is no field measurement.

What remains is two decisions. The location check, about what face recognition on its own actually proves; and the consent gate, about where a flow that processes special-category data has to begin.

An open gap: there is no liveness check. The system can be fooled by a photograph held up to the camera, and the location check does not solve it; location shows the person is at the hotel, not that the camera is seeing a live face.