Privacy Policy

vMarketing is a software-as-a-service product developed and operated by Vamos Dijital Teknoloji Hizmetleri Limited Şirketi ("Vamos Dijital Ofis", "we", "us"). This policy covers our website (https://vmarketing.com.tr), the vMarketing panel (https://panel.vmarketing.com.tr) and related services. Contact: hello@vamos.ist.

For data about your own account, subscription and website visits we are the data controller. For data that a business brings into vMarketing from its connected channels (for example its customers' messages or orders), that business is the controller and we process the data only on its behalf and to provide the service.

• Account data: name, email address, password hash (never the password itself), phone number, language and theme preferences, two-step verification settings.
• Workspace data: business name, stores, markets, team members and their roles, plan details.
• Data from connected platforms: when you connect Google, Meta (Facebook, Instagram, WhatsApp, Messenger), marketplaces or e-commerce platforms, we receive the data covered by the permissions you grant, such as ad, campaign, order, product, stock, analytics and message data, plus the access tokens needed to keep the connection working.
• Inbox data: WhatsApp, Instagram and Messenger messages sent to your connected business accounts, sender profile names and pictures, and attachments.
• Billing data: invoice name and address, tax details and payment records. Card numbers are handled by our payment provider; we never store them.
• Technical data: IP address, browser and device information, sign-in and activity logs, error logs, and cookies as described on our cookie page.
• Support data: support requests, emails and form submissions.

• To provide the service: connecting your channels, syncing data, building reports and dashboards, and showing and answering messages in the unified inbox.
• To run AI features you request, such as suggestions, draft replies and analyses. Actions that change data (prices, budgets, campaigns, stock) are proposed to you and run only after you approve them.
• To manage subscriptions, billing and payments.
• To keep accounts and systems secure and prevent abuse.
• To provide support and send service notices (security alerts, invoices, plan changes).
• To improve the service, using aggregated or anonymised data wherever possible.

We do not sell personal data. We do not use data from connected platforms or the inbox for advertising, for our own marketing, or to train general-purpose AI models.

When you connect a Google account, vMarketing requests only the permissions needed for the feature you turn on. The table below lists each permission, the data we access and why.

How we store and protect Google user data: OAuth access and refresh tokens are encrypted at rest with AES-256-GCM and stored only on our own servers in Turkey; report data read from Google APIs is stored in your workspace, isolated from other customers, and is shown only to members of your workspace.

Sharing: we do not share, transfer or sell Google user data to third parties, except (a) with service providers that host or operate our infrastructure under confidentiality obligations, (b) when you explicitly ask us to, for example by connecting your own AI assistant to your workspace, or (c) when required by law. Google user data is never used for advertising, never sold, and never used to train AI models. No human at vMarketing reads your Google data unless you ask us to for support, it is needed for security purposes, or it is required by law.

Retention and deletion: Google data is kept while the connection is active. You can disconnect Google at any time in the panel (Settings › Integrations) or revoke access at https://myaccount.google.com/permissions. When you disconnect, we delete the stored tokens immediately and the data received from Google within 30 days. You can also ask us to delete it sooner by emailing hello@vamos.ist.

vMarketing's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Data received from Meta (Facebook, Instagram, WhatsApp, Messenger) is used only to provide the service and in line with the Meta Platform Terms. You can remove a connection in the panel at any time. Data deletion instructions: https://vmarketing.com.tr/veri-silme.

We share data only as needed with: our hosting, email, payment, backup and support providers; AI model providers that process your requests on our behalf without using them for training; the platforms you connect; and authorities when required by law.

Our main infrastructure runs on servers in Turkey. If a provider or a platform you connect is located abroad, transfers rely on the safeguards required by Turkish law (KVKK) and, where it applies, the EU GDPR (for example standard contractual clauses).

• Account and workspace data: for as long as you have an account, and deleted or anonymised within 30 days after the account is closed.
• Connected platform and inbox data: while the connection and subscription are active, and deleted within 30 days after you disconnect or close your account.
• Invoices and accounting records: as long as tax and commercial law requires.
• Security logs: as long as the law requires, and no longer than 2 years.
• Backups: deleted data rotates out of backups within 90 days.

Under KVKK (Turkish Personal Data Protection Law) and, where it applies, the GDPR, you can ask to access, correct, delete, restrict or object to the processing of your data, ask for a copy of it, and withdraw consent. You can edit your account details, remove connections and request account deletion in the panel, or email hello@vamos.ist. You may also complain to the Turkish Personal Data Protection Authority or your local data protection authority.

• TLS encryption in transit; encryption at rest for access tokens and sensitive fields.
• Logical isolation between workspaces and role-based access control.
• Optional two-step verification, session management and protection against suspicious sign-ins.
• Confidentiality obligations and least-privilege access for staff and providers.

vMarketing is a business tool and is not intended for anyone under 18. We do not knowingly collect children's data.

We may update this policy and will announce significant changes in the panel or by email before they take effect. Questions: hello@vamos.ist. A Turkish version of this policy is available at https://vmarketing.com.tr/gizlilik.