Privacy Policy

1. Data Controller & Core Principles

Vangu AI ("Platform", "vangu.dev") acts in the capacity of Data Controller under Turkish Personal Data Protection Law No. 6698 ("KVKK") and the EU General Data Protection Regulation ("GDPR").

Our infrastructure adheres strictly to data minimization, purpose limitation, transparency, and privacy-by-design principles, processing strictly the minimum telemetry required to deliver services.

2. Categories of Personal Data Collected

Data collected across our services falls into distinct, well-defined operational categories:

• Identity & Contact Data: Verified email address, name, and corporate legal entity name provided during registration.
• Billing & Tax Data: Corporate billing address, tax identification number (or national ID), and tax office required for legal electronic invoice issuance.
• Technical & Telemetry Data: Ingress client IP, User-Agent strings, request timestamps, response latency, and HTTP status codes utilized solely for rate-limiting, auditability, and defense.
• Payment Card Data: Transactions are tokenized directly via PCI-DSS Level 1 certified Stripe infrastructure. Raw 16-digit card numbers, expirations, and CVC codes are NEVER stored on Vangu servers.

3. API Prompts & Zero-Training Guarantee

Requests are sent to the selected AI provider over secure connections. Data processing and retention terms required to deliver the service apply. Prompt payloads are not shared with data brokers or advertising networks.

4. Purposes & Legal Grounds for Processing

Personal telemetry and registration records are processed under strictly legitimate legal grounds:

• Contract Execution (KVKK Art. 5/2-c, GDPR Art. 6/1-b): Provisioning API keys, tracking balance allowances, enforcing 00:00 midnight resets, and concurrency policing.
• Statutory Compliance (KVKK Art. 5/2-ç, GDPR Art. 6/1-c): Maintaining obligatory network traffic access logs and tax invoices per commercial and internet telecommunications laws.
• Legitimate Interests (KVKK Art. 5/2-f, GDPR Art. 6/1-f): Ensuring cybersecurity integrity, preventing malicious brute-force intrusions, and mitigating payment fraud.

5. Cookies & Local Storage Policy

Vangu adheres to an austere, privacy-preserving frontend architecture. We operate zero third-party advertising, remarketing, or behavioral tracking scripts.

• Essential Security Cookies: Strict session tokens (`session`) and cross-site request forgery prevention (`csrf_token`) essential for authentication.
• Local Storage: Your language preference is remembered in your browser. When you follow a referral link, its code (`vangu-referral`) is retained for up to 30 days and removed after successful registration. Your recorded inviter and commission transactions are kept with your account; the inviter sees a partially masked email address.

6. Data Security, Cryptography & Storage Standards

Enterprise-grade safeguards are enforced to defend data assets against unauthorized inspection, loss, or alteration:

• In-Transit Encryption: All ingress web and API traffic is secured with TLS 1.3, enforced HSTS, strict CSP policies, and anti-sniffing HTTP headers.
• At-Rest Protection: Sensitive credentials, vault secrets, and API access tokens are encrypted using robust AES-256-GCM cryptography.
• Access Isolation & 2FA: Administrative interfaces and user sessions are defended with TOTP multi-factor credentials and automated rate-limiting perimeters.

7. Data Subject Rights & Formal Contact

Under KVKK Article 11 and GDPR Articles 15–22, data subjects possess full legal rights to request access to their telemetry, obtain copies, rectify inaccuracies, demand permanent erasure, or object to processing.

Inquiries and statutory erasure requests should be dispatched from your registered account email to our compliance desk. Requests are resolved free of charge within 30 calendar days.