Privacy Policy (GDPR Compliant)
Your privacy rights regarding personal data processing.
1. DATA CONTROLLER
Userex Design Studio is the Controller of your personal data.
Address: Caferağa Mh. Şifa Sk. No:19, Kadıköy / Istanbul / Turkey
2. DATA WE COLLECT
We collect Identity Data (Name), Contact Data (Email), and Technical Data (IP, Browser Info) to provide the service and improve user experience.
3. COMPLIANCE WITH GDPR
If you are a resident of the EEU, you have the following rights under the General Data Protection Regulation (GDPR):
- Right to Access: Ask for a copy of your data.
- Right to Rectification: Ask us to fix wrong data.
- Right to Erasure ("Right to be Forgotten"): Ask us to delete your data.
- Right to Data Portability: Get your data in a readable format.
- Right to Object: Object to processing of your personal data.
4. DATA RETENTION
We retain your personal data only for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
5. SUB-PROCESSORS AND INTERNATIONAL TRANSFERS
We never sell or rent your data. To provide the service we rely on the following sub-processors:
| Provider | Purpose | Country |
|---|---|---|
| Google LLC (Firebase / Google Cloud) | Database, authentication, file storage | USA |
| Vercel Inc. | Application hosting | USA |
| OpenAI, L.L.C. | Generating assistant replies — conversation content is sent to this service | USA |
| Pinecone Systems, Inc. | Knowledge base vector search | USA |
| Amazon Web Services, Inc. (SES) | Email delivery | USA |
| ElevenLabs Inc. | Voice assistant (only when the module is enabled) | USA |
| Meta Platforms, Inc. | WhatsApp / Instagram / Messenger (only when a channel is connected) | USA |
These providers host data outside Türkiye. Because the Turkish Data Protection Board has not issued an adequacy decision for any country, such transfers are carried out under Article 9 of the Turkish DPA (KVKK) with appropriate safeguards, and under standard contractual clauses where GDPR applies.
Apart from these, your data is disclosed only to competent public authorities upon a lawful request. When payment processing goes live, the licensed payment institution will be added to this list and will process payment details directly.
This page is updated before any new provider is added.
6. GOOGLE USER DATA AND LIMITED USE
Businesses using the appointment module may optionally connect their own Google Calendar to Vion AI. The connection is created only with the consent the business gives on Google's consent screen, and it can be removed from the panel at any time.
- Scope requested:
https://www.googleapis.com/auth/calendar.events— view and edit calendar events. - What we read: only an event's id, status, busy/free flag and start and end time. Event titles, descriptions, locations and attendees are never requested from Google. The single purpose is to stop Vion offering an appointment slot when the business is already busy.
- What we write: appointments booked through Vion are added to the calendar as events, updated when the time changes and removed when they are cancelled. Vion never touches an event it did not create.
- Storage: access and refresh tokens are stored encrypted. Event content is not stored; the appointment record keeps only the id of the event Vion created.
- AI: data read from the calendar is not sent to the language model. The assistant only sees the list of free slots computed on our server.
- Sharing: data obtained from Google is never sold or transferred to third parties, never used for advertising, and never used to train AI models.
- Deletion: disconnecting in the panel revokes the token with Google and deletes it from our records. You can also revoke access at any time from Google Account permissions.
Vion AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
When a business connects a Microsoft Outlook calendar instead, the same rules on what we read, what we write, storage, AI and sharing apply. The one difference is deletion: disconnecting removes the token from our records, but the consent entry in your Microsoft account is not removed automatically; you can remove it from Microsoft account app permissions for personal accounts, or My Apps for work or school accounts.
7. CONTACT
For any privacy-related inquiries, please contact us at info@getvion.com.