Privacy Policy
Last updated: October 12, 2026
1. Controller and scope
This policy explains what personal data is processed when you use Vitreno, why it is processed and what rights you have. Vitreno is the data controller. It is written to meet both the EU General Data Protection Regulation (GDPR) and Turkish data protection law (KVKK No. 6698). Questions and requests: support@vitreno.com
2. Data we process
Account data: your email address, your name and a hash of your password. Store data: store name, the WhatsApp number or Telegram account orders are sent to, products, prices, images and any social accounts you connect. Usage data: storefront visits, WhatsApp and Telegram order clicks and summary statistics. AI data: the requests (prompts) you write in the studio and the images, videos and text generated from them. Subscription data: your plan, billing period and the subscription status returned by our payment provider. We never see or store your card number or payment details; those are handled only by the payment provider. Find Customers (business discovery) data: based on the business type and area you enter, a prospect list is built from Google's public business listings and the corporate contact details businesses publish on their own websites (business name, address, rating, business phone, email, website, Instagram) and stored in your account (legal basis: legitimate interests); private information about individuals is not searched for. When you contact a prospect you are responsible for that communication: Vitreno sends no messages; you must follow the GDPR/KVKK and commercial messaging rules (in Turkey, İYS) and must not contact a business again after it says no. A business can ask for its record to be deleted at support@vitreno.com.
3. Purposes and legal bases
Performance of a contract (GDPR Art. 6(1)(b)): creating your account, publishing your storefront, delivering orders, running the AI tools and managing your subscription. Legitimate interests (GDPR Art. 6(1)(f)): keeping the service secure, preventing abuse and fraud, and using summary statistics to improve the product. Legal obligation (GDPR Art. 6(1)(c)): retention and reporting required by law. Consent (GDPR Art. 6(1)(a)): optional things such as connecting a social account or receiving marketing email; you can withdraw consent at any time. We do not sell your data and we do not share it with third parties for advertising.
4. Service providers and international transfers
To run the service we use these processors: Supabase (authentication and database), Cloudflare (hosting and delivery, image and video storage, scheduled tasks), Anthropic and fal.ai (AI text, image and video generation), Creem (subscription billing as Merchant of Record), Resend (service emails), Upload-Post (posting to social accounts you connect), Shotstack (video editing), Telegram (messaging, if you connect the bot), Google (public business listings in Find Customers) and Firecrawl (reading public web pages). Each processes only the data the service requires, on our instructions. Their servers may be located outside the European Union, for example in the United States; such transfers rely on appropriate safeguards such as standard contractual clauses.
5. Retention
Your account and store data are kept while your account is open. When you ask us to delete your account, your storefront goes offline and your data is erased or irreversibly anonymised within 30 days at the latest. Invoicing and accounting records are retained by the payment provider for the period required by law. Aggregated, non-identifying statistics may be kept beyond these periods.
6. Cookies
Essential cookies run the site: your session (so you stay signed in), your language preference and your cookie choice. Optional measurement is turned on only if you choose «Accept» in the cookie banner: which ad or link brought you here (30 days) and which feature card was clicked (an anonymous count). If you choose «Essential only», none of these are written. To change your choice, delete the vt_riza cookie in your browser and the banner appears again. We use no advertising cookies, third-party tracking pixels or ad networks. Visit statistics on seller sites are stored on our own servers as summary events that do not identify individuals. The full list is in the table at the end of this page.
7. Your rights and how to use them
Under GDPR Art. 15-21 and KVKK Art. 11 you have the right to access your data, correct it, request its deletion, restrict processing, receive your data in a portable format, object to processing and withdraw any consent you gave. Send your request to support@vitreno.com; after we verify your identity we respond within 30 days at the latest. A deletion request also takes your storefront offline. You also have the right to lodge a complaint with the data protection authority in your country, or in Turkey with the Personal Data Protection Authority (KVKK).
8. Security, children and changes
Data is encrypted in transit and at rest; the database is protected by row-level access rules and you can add two-factor authentication (2FA) to your account. The service is not directed at people under 18 and we do not knowingly collect children's data. If we update this policy we publish the new text on this page and notify you by email about significant changes. Questions: support@vitreno.com
Cookies and browser storage
Everything the site writes today. Optional items are written only if you choose «Accept» in the cookie banner.
| Name | Purpose | Duration | Type | Essential |
|---|---|---|---|---|
| sb-…-auth-token | Keeping you signed in | Until sign-out, at most 400 days | Cookie | Yes |
| locale | Your chosen language | 1 year | Cookie | Yes |
| vt_riza | Remembering your cookie choice | 180 days | Cookie | Yes |
| vt_edinim | Which ad or link brought you here; added to your account if you sign up | 30 days | Cookie | No, needs your consent |
| /api/olay | Which feature card was clicked (anonymous count) | Not stored in the browser | Counter (no cookie) | No, needs your consent |
| vitreno.rehber.okundu.* | Which dashboard guides you have seen | Until you delete it | Local storage | Yes |
| vitreno-sid | Preventing duplicate review submissions | Until you delete it | Local storage | Yes |
| utm-* · visited-* | On seller sites: which link a visit came from and visit counts (the seller's summary statistics) | Deleted when the tab closes | Session storage | No, anonymous measurement |