Privacy Policy
Last updated: July 29, 2026
1. Controller and scope
This policy explains what personal data is processed when you use Vitreno, why it is processed and what rights you have. Vitreno is the data controller. It is written to meet both the EU General Data Protection Regulation (GDPR) and Turkish data protection law (KVKK No. 6698). Questions and requests: support@vitreno.com
2. Data we process
Account data: your email address, your name and a hash of your password. Store data: store name, the WhatsApp number orders are sent to, products, prices, images and any social accounts you connect. Usage data: storefront visits, WhatsApp order clicks and summary statistics. AI data: the requests (prompts) you write in the studio and the images, videos and text generated from them. Subscription data: your plan, billing period and the subscription status returned by our payment provider. We never see or store your card number or payment details; those are handled only by the payment provider.
3. Purposes and legal bases
Performance of a contract (GDPR Art. 6(1)(b)): creating your account, publishing your storefront, delivering orders, running the AI tools and managing your subscription. Legitimate interests (GDPR Art. 6(1)(f)): keeping the service secure, preventing abuse and fraud, and using summary statistics to improve the product. Legal obligation (GDPR Art. 6(1)(c)): retention and reporting required by law. Consent (GDPR Art. 6(1)(a)): optional things such as connecting a social account or receiving marketing email; you can withdraw consent at any time. We do not sell your data and we do not share it with third parties for advertising.
4. Service providers and international transfers
To run the service we use these processors: Supabase (authentication and database), Vercel (hosting and delivery), Cloudinary (image and video storage), Anthropic and fal.ai (AI text, image and video generation), and Creem (subscription billing as Merchant of Record). Each processes only the data the service requires, on our instructions. Their servers may be located outside the European Union, for example in the United States; such transfers rely on appropriate safeguards such as standard contractual clauses.
5. Retention
Your account and store data are kept while your account is open. When you ask us to delete your account, your storefront goes offline and your data is erased or irreversibly anonymised within 30 days at the latest. Invoicing and accounting records are retained by the payment provider for the period required by law. Aggregated, non-identifying statistics may be kept beyond these periods.
6. Cookies
We use only cookies that are necessary for the service to work: a session cookie so you stay signed in, and a language preference cookie. We use no advertising cookies, third-party tracking pixels or ad networks. Visit statistics are stored on our own servers as summary events that do not identify individuals. You can manage cookies in your browser; blocking necessary cookies may prevent you from signing in.
7. Your rights and how to use them
Under GDPR Art. 15-21 and KVKK Art. 11 you have the right to access your data, correct it, request its deletion, restrict processing, receive your data in a portable format, object to processing and withdraw any consent you gave. Send your request to support@vitreno.com; after we verify your identity we respond within 30 days at the latest. A deletion request also takes your storefront offline. You also have the right to lodge a complaint with the data protection authority in your country, or in Turkey with the Personal Data Protection Authority (KVKK).
8. Security, children and changes
Data is encrypted in transit and at rest; the database is protected by row-level access rules and you can add two-factor authentication (2FA) to your account. The service is not directed at people under 18 and we do not knowingly collect children's data. If we update this policy we publish the new text on this page and notify you by email about significant changes. Questions: support@vitreno.com