Privacy Policy(demo)

1. What this policy covers

This Privacy Policy explains how personal data is processed on the vioai.com website and the VioAI mobile application (the "Platform"), operated by [ŞİRKET UNVANI] ("VioAI", "we").

VioAI is a multi-tenant service that lets businesses turn their products into 3D and augmented reality (AR) content and present it to end customers in the browser, without requiring an app download.

Data controller:

• Legal name: [ŞİRKET UNVANI]
• Address: [ADRES]
• Tax number: [VERGİ NO]
• Contact: [VERİ SORUMLUSU İLETİŞİM]
• Registered electronic mail: [KEP ADRESİ]

Businesses using the Platform are separate controllers for their own customer and staff data; for that data VioAI acts as a processor.

2. Personal data we process

a) Business users (managers and staff)

• Identity and contact: full name, e-mail address, phone number
• Account data: role, branch assignment, permission list, account status
• Security: sign-in records, two-step verification status, IP address
• Business activity: uploaded product information, captured product photos, audit records

b) End customers (visitors who scan a QR code or use Discover)

• For registered users: e-mail address, display name
• Scan history, favourites and lists
• Approximate location — only when you explicitly use the "near me" feature and grant permission through your device's own prompt
• Measurement/placement inputs: numeric values entered so that an object can be displayed at the correct scale in AR
• Product satisfaction answers and issues you report

c) Technical data for everyone

• IP address, browser and device information, language preference
• Page and product view events (aggregated analytics)
• Cookies and similar technologies (see section 5)

We do not request special categories of data (health, biometrics, beliefs and similar). Ensuring that product photos do not accidentally contain identifiable people is the responsibility of the business.

3. Purposes and legal bases

Performance of a contract

• Account creation, authentication, session management
• Publication of the business's product, brand and branch content
• Routing QR codes and venue codes to the correct business page

Legitimate interests

• Platform security, abuse prevention, debugging
• Aggregated usage statistics and service improvement
• Proof of consent records: when you accept a legal document we store the moment of acceptance, the version accepted, your IP address and browser information. Without this record the question "which text was accepted, and when" cannot be answered later.

Consent

• Use of location for the "near me" feature
• Camera access for capturing product photos
• Marketing e-mail, where applicable; consent can be withdrawn at any time

Legal obligation

• Records required by financial legislation and responses to lawful requests

4. Who we share data with

We do not sell personal data. We use the following service providers:

• Supabase — database, authentication and file storage
• Vercel — website hosting and delivery
• [E-POSTA SAĞLAYICISI] — transactional e-mail delivery

These providers may operate servers outside Türkiye. Such transfers rely on the cross-border transfer provisions of the Turkish Data Protection Law (KVKK) and, where the GDPR applies, on standard contractual clauses.

In addition: when you visit a business's page, aggregated measurement data about that visit is shown to that business. The business cannot see your identity on that screen.

5. Cookies

We use only cookies that are strictly necessary for the service to work: the session cookie, the language preference and security cookies. We do not use third-party advertising or profiling trackers. If you block necessary cookies in your browser, signing in will not work.

6. Retention periods

At the end of the period, data is deleted, destroyed or irreversibly anonymised.

7. Your rights

Under KVKK Article 11 and the GDPR you have the right to:

• Learn whether your personal data is processed and request information about it
• Learn the purpose of processing and whether the data is used accordingly
• Know the third parties to whom data is transferred, in the country or abroad
• Request correction of incomplete or inaccurate data
• Request erasure or destruction
• Request that corrections and erasures be notified to third parties
• Object to a result reached against you solely through automated analysis
• Claim compensation for damage
• (GDPR) Receive your data in a portable format and object to processing

Send requests to [VERİ SORUMLUSU İLETİŞİM]. We respond within 30 days at the latest.

Deleting your account: the "Delete account" option on the account screen permanently deletes your scan history, favourites and lists. If you also want your sign-in record removed entirely, write to the address above and we will delete it.

8. Security

Row-level security (RLS) is enforced at the database level: each business can only reach its own data. Passwords are stored irreversibly. Two-step verification is available for managers. Platform-level access to staff photos is written to an audit log.

Even so, no method of transmission or storage is 100% secure and we cannot promise absolute security.

9. Children

The Platform is not directed at people under 18 and we do not knowingly collect their personal data. If we become aware of such data, we delete it.

10. Changes

This policy may be updated. On an update, the version and effective date shown at the top of this page change. For material changes you will be asked to accept the new text when you sign in; your earlier acceptance remains stored against the earlier version.

11. Contact

Questions: [VERİ SORUMLUSU İLETİŞİM] · Registered e-mail: [KEP ADRESİ] · Address: [ADRES]