Privacy Policy

Last updated: 24 July 2026 · Effective: 27 July 2026

This Privacy Policy applies to the vestoralabs.com website operated by Vestora Labs Teknoloji Limited Şirketi ("Vestora Labs", "we") and to our products (SimuVest, V-Randevu, V-Order, SimuLearn). Your personal data is processed in accordance with Law No. 6698 (KVKK) and the GDPR.

1. Identity of the Data Controller

2. Personal Data Processed

• Identity & contact: name-surname, e-mail, phone (to the extent you provide them when contacting us or registering).
• Technical data: IP, browser/device information, cookie data.
• V-Randevu/V-Order (WhatsApp): phone number, WhatsApp profile name, message content and metadata (timestamp, message ID); appointment/order data (service/product, staff member, date-time, status, no-show/cancellation); business data (name, address, working hours, service/menu catalogue, staff).
• Payment data: subscription and deposit payments are collected through iyzico/PayTR; your card details are not stored by Vestora Labs.
• SimuVest/SimuLearn: behavioural/learning data (decision and interaction data).

3. Purposes of Processing Personal Data

• To provide the service, run the appointment/order flow, send reminders and notifications.
• To respond to your request and to promote our services (if you have given permission).
• To keep the site and services secure and functional; to prevent fraud/abuse; to improve them.
• To fulfil invoicing/accounting and legal obligations.

4. Legal Basis for Processing (KVKK art. 5 / GDPR art. 6)

• Providing the service, sending reminders/notifications → performance of the contract.
• Security, fraud/abuse prevention, improvement → legitimate interest.
• Marketing/campaign messages → only with explicit consent / İYS approval (an appointment confirmation or reminder message is not marketing).
• Invoicing/accounting → legal obligation.

5. Method of Collection

Your data is collected through site visits and the contact form (/contact), e-mail/phone enquiries, WhatsApp Business (Cloud API) messages, business panel logins and the flow started by the QR code, by automated and non-automated means.

6. Transfer of Personal Data

Apart from the service providers listed per product above and legal authorities (only where legally required), we do not share your data; we do not sell it to third parties for advertising purposes.

• Meta Platforms (WhatsApp): messaging channel — WhatsApp's own terms apply.
• iyzico / PayTR: payment processing.
• One business's customer data is never shared with another business.

Transfer abroad: Data is hosted securely in Frankfurt / Germany.

7. Retention Period

Data is kept for as long as the processing purpose continues and throughout the statutory retention periods (financial records 10 years (VUK)); afterwards it is deleted or anonymised. When a subscription ends, the related data enters the deletion process by the end of the year.

8. Data Deletion Instructions

If you want your data deleted:

1. Send an e-mail to kvkk@vestoralabs.com with the subject "Data Deletion Request".
2. Provide information sufficient for us to verify your identity (registered phone/e-mail).
3. Your request is concluded within 30 days at the latest; your data is deleted or anonymised and confirmed to you.
4. If you are a V-Randevu/V-Order customer (of the business you booked or ordered from), your request is forwarded to that business; Vestora Labs performs the technical deletion on the business's behalf.

9. Rights of the Data Subject (KVKK art. 11 / GDPR art. 15-22)

You have the right to access, rectify and erase your data, to object to processing, to data portability and to withdraw consent. Applications: kvkk@vestoralabs.com.

10. Cookies

vestoralabs.com uses strictly necessary cookies and, if you permit, analytics cookies. Non-essential cookies are loaded with your explicit consent. Details, categories and preference management: Cookie Policy

11. Product-Specific Annex

11.1 V-Randevu and V-Order

Multi-tenant structure — separation of roles:

• For the data of the business's customer, the data controller is the business receiving the service; Vestora Labs is a data processor acting on the business's behalf for that data.
• For the data of the business representative, the data controller is Vestora Labs.

Sections §2, §5 and §6 govern the data processed, the collection method and transfers; §8 applies to data deletion.

11.2 SimuVest and SimuLearn

These products process behavioural/learning data (the user's decision and interaction data) — there is a different data model from V-Randevu. For these products Vestora Labs is the data controller. The data types processed, purposes and retention periods will be detailed here once the products begin processing publicly available user data. Until then, sections §2-§10 apply.

12. Changes

This policy may be updated; significant changes are announced on the site and the current version is published on this page.

13. Contact

Vestora Labs Teknoloji Limited Şirketi · Pınarbaşı Mah. Hürriyet Cad. Antalya Teknokent Uluğbey Ar-Ge 2 Binası No: 3/A, İç Kapı No: B187, Konyaaltı/Antalya · info@vestoralabs.com · +90 532 260 42 07