VOZEKADraft: pending legal review

Privacy Policy

Last updated: 6/1/2026

This Privacy Policy explains how VOZEKA ("we", "us") collects, uses, and protects personal data when you use our hotel OTA performance review service. We process data in accordance with the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law (KVKK).

⚠️ DRAFT: this document is provided as a starting point and must be reviewed and approved by qualified legal counsel before launch. Entity details, jurisdiction, and contact addresses are placeholders.

1. Data Controller

VOZEKA is the data controller responsible for your personal data. For any privacy question or to exercise your rights, contact us at privacy@vozeka.com.

2. Data We Collect

Account data: your email address (and, if you sign in with Google, your Google profile email and name).
Hotel information you submit: hotel name, address, city, country, room count, expected occupancy, and any notes.
Uploaded files: screenshots or PDFs of OTA promotion/commission screens (Booking.com, Expedia, high-commission agencies) that you choose to upload.
Payment data: processed directly by Stripe. We do not store your card number; we retain order metadata (amount, currency, status).
Consent records: the consent text version, timestamp, IP address, and browser user-agent captured at the moment you give consent, retained as proof of consent.
Technical data: minimal logs and error diagnostics needed to operate the service securely.

3. Purposes & Legal Basis

To deliver the expert review report you ordered: performance of a contract (GDPR Art. 6(1)(b)).
To process the OTA screenshots you upload: your explicit consent (GDPR Art. 6(1)(a)); you may withdraw consent at any time.
To take payment and issue records: performance of a contract and legal obligation (GDPR Art. 6(1)(b),(c)).
To secure the service and prevent fraud or abuse: our legitimate interests (GDPR Art. 6(1)(f)).

4. Processors & Sub-processors

We use the following processors, selected for EU data residency where available:

Supabase: database, authentication, and file storage (EU, Frankfurt region).
Vercel: application hosting and content delivery (EU, Frankfurt region).
Stripe: payment processing.
Resend: transactional email delivery (EU region).
Sentry: error monitoring (EU region), with personal data scrubbed before transmission.
Google: only if you choose to sign in with Google (authentication).

5. International Transfers

We store and process personal data within the EU wherever possible. Where a processor transfers data outside the EU/Turkey, that transfer is governed by appropriate safeguards such as Standard Contractual Clauses.

6. Retention

Uploaded files (OTA screenshots) are retained for a limited period (target: 30 days) after the review is delivered, then deleted.
Account, order, and report data are retained while your account is active and as required for tax and accounting obligations.
Consent records are retained for the period necessary to evidence lawful processing.

7. Your Rights

Subject to applicable law, you have the right to access, rectify, erase, restrict, or port your personal data, to object to processing, and to withdraw consent at any time without affecting prior processing.

To exercise any right, contact privacy@vozeka.com. You also have the right to lodge a complaint with your supervisory authority (in Turkey, the Personal Data Protection Authority "KVKK Kurumu"; in the EU, your national data protection authority).

8. Cookies

We use only strictly necessary cookies to keep you signed in. If analytics are enabled, we use a privacy-friendly, cookieless analytics tool that does not track you across sites.

9. Security

We apply technical and organizational measures including encryption in transit, row-level access controls so each customer can only access their own data, and least-privilege administrative access.

10. Changes & Contact

We may update this policy; material changes will be posted here with a new date. Questions: privacy@vozeka.com.