Privacy Notice

1. Controller information

The service is operated under the name Vorlaxen Labs as an unincorporated independent software project. Privacy requests may be sent to hello@vorlaxen.com. Because no registered legal entity or disclosed natural-person controller currently exists, this identification does not satisfy every formal controller-identification requirement. That limitation is disclosed rather than concealed.

2. Data we process

• Account data: email address, username, password hash, first and last name, optional birth date and phone number, preferences and account status.
• Authentication data: verification records, session identifiers, refresh tokens, device fingerprint, IP address, user-agent details, device type and locale.
• Legal records: document code, version, language, acceptance or notice-delivery event and timestamp; optional marketing choice.
• Security and audit data: request identifier, action, affected resource, before-and-after records, IP address, device and user-agent context.
• Communication data: recipient address and transactional email delivery information.

3. Purposes and legal grounds

• Create and administer accounts, authenticate users and perform the Terms of Service.
• Protect accounts, detect abuse, investigate incidents and establish or defend legal claims based on legitimate interests and legal duties.
• Provide mandatory privacy information and preserve evidence of contractual or consent events.
• Send transactional messages necessary for registration, security and account changes.
• Send marketing only where separate, freely given consent exists; withdrawal does not affect prior lawful processing.

4. Collection and recipients

Data is collected directly from forms, requests, browsers and devices, and is generated when the service is used. PostgreSQL stores persistent account records; Redis temporarily supports verification, caching, rate limiting and queues; a configured SMTP provider delivers email. Operational alerts may use Telegram only when that optional integration is enabled.

Data is disclosed only to infrastructure and communication providers acting for service operation, authorised administrators, competent authorities where legally required, and professional advisers where necessary. Vorlaxen does not sell personal data.

5. International transfers

The location and identity of hosting and mail providers depend on the production configuration. Where data is transferred outside Türkiye, the EEA or another protected jurisdiction, an applicable adequacy decision, contractual safeguard or legally permitted exception must be used. Provider details must be updated before a materially different production deployment.

6. Retention

• Active-account data is kept while the account exists and is erased after the 30-day deletion period, unless a legal hold applies.
• Access tokens expire after approximately 15 minutes and refresh sessions after approximately 7 days unless revoked earlier.
• Verification and intermediate registration records in Redis ordinarily expire within 5 to 10 minutes.
• Audit and security records are retained for up to 180 days, then deleted; records needed after account deletion are anonymised.
• Queue result records are ordinarily removed after approximately 1 hour when successful and 24 hours when failed.

7. Your rights

Subject to applicable law, you may request access, correction, export, erasure, restriction, objection, information about recipients and withdrawal of consent. Account export and deletion controls are available in account settings; requests may also be sent to hello@vorlaxen.com.

KVKK data subjects may exercise the rights in Article 11 and complain to the Turkish Personal Data Protection Authority. GDPR data subjects may complain to the competent supervisory authority. Identity may be verified before a request is fulfilled.

8. Automated decisions and children

Vorlaxen does not use account data for solely automated decisions producing legal or similarly significant effects. The service is not intentionally directed at children who cannot validly agree to these Terms under applicable law.