Privacy Policy

1. Who is responsible

The data controller (in Turkish law, the “veri sorumlusu”) is Vanel, which makes and offers the Vanel app and this website; in this policy, “Vanel”, “we” and “us” mean the data controller. This policy covers the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, for people in the European Union and the European Economic Area, the General Data Protection Regulation (“GDPR”). It is also our information notice under Article 10 of the KVKK.

For anything about your personal data, write to privacy@getvanel.com.

2. What stays on your computer

Your projects and files, your chats with your team, your team’s memory and your vault of keys and passwords are stored on your computer. We do not receive them.

When your team works, the app sends your requests from your computer directly to the AI provider you connected. The provider handles them under its own terms and privacy policy; it does not process them on our behalf, and your relationship with it is your own. The same goes for other services you connect, such as your email or a hosting service. The free trial works differently: its requests go through our OpenRouter account (see section 6).

3. Your account

What we keep. Your name, your email address, a securely hashed form of your password (never the password itself), whether you have confirmed your email address, and when your account was created and last changed.

Your login sessions. When you log in, we store your session together with the IP address and browser details (the “user agent”) it was opened from, to keep you logged in and to protect your account. A session stops working 30 days after you last used it.

Why. To create and run your account, to let you log in, to keep your account secure, and to contact you about your account and your purchases.

4. Purchases and licenses

Purchases are handled by Polar, our merchant of record. You enter your payment details on Polar’s checkout, not on our website, and Polar processes payments through Stripe. We never receive your card number.

What we send to Polar. When you start a purchase, we pass Polar the plan you chose, your account ID, name, email address and the language of the page, so that the checkout is filled in for you and the purchase is tied to your account.

What Polar sends us. Your Polar customer ID and billing email address, and the details of your orders (product, amount, currency and status), your subscription (plan, billing period, renewal and cancellation dates) and your license keys (the key, its status and its computer limit).

If a purchase arrives that we cannot tie to an account, for example because it was made before signing up or with another email address, we keep its billing email address so that the owner of that address can claim it after confirming the address.

If we cannot process a message from Polar right away, we keep a copy of it, which can include your name, billing address and other details of the purchase, so that we can fix the problem and process it again. The copy is removed once the message has been processed.

Why. To deliver what you bought, show it on your account page and check your license.

What you give Polar at checkout is handled by Polar as a separate, independent company, under its own privacy policy.

5. License checks from the app

When you enter your license key in the app, the app sends it to this website together with a name for your computer (its computer name and operating system, for example “Lena’s MacBook · macOS”), a fingerprint of the computer, its operating system and processor type, and the app version. The fingerprint is a one-way code made from your computer’s system ID; the ID itself never leaves your computer.

We pass these details to Polar, which keeps the list of computers your key is used on. That list appears on your account page, where you can remove a computer. The app also checks with this website from time to time that your key is still valid.

Why. To unlock your plan and to apply the limit of 3 computers per key.

6. The free trial

If you choose “Start free” in the app, you approve the app on this website while logged in to your account. We then create a personal key for you at OpenRouter, Inc. (USA), with a small fixed credit, and send it to the app, which keeps it in the vault on your computer. The key’s name at OpenRouter contains your internal account ID (a random code), not your name or email address. We keep a record of your trial (your account, when it started, its status and how much of the credit has been used) and a one-way code of the key, never the key itself.

Where your requests go. While your team works on the free trial, the app sends its requests from your computer to OpenRouter, which passes them on to the provider of the AI model, DeepSeek. These requests contain what you ask your team and the content the team sends to the AI, including parts of your project files. OpenRouter and DeepSeek process them to answer them, under their own terms and privacy policies, and they may be processed outside the EU and Türkiye, including in the United States and in China. We do not see the content of these requests; we only ask OpenRouter how much of your credit is left, to show it in the app and on your account page.

Your choice. If you do not want your requests processed this way, do not use the free trial: connect your own ChatGPT or Claude subscription instead, and the app sends your requests directly to that provider (see section 2). You can switch at any time. Deleting your account also deletes your trial key at OpenRouter.

Why. To let you try Vanel on a limited free credit, to stop each key at its limit, and to prevent abuse: one trial per account, only for a confirmed email address that is not a disposable one, and a monthly limit on the number of trials.

7. Emails

We send you emails about your account, such as the link to confirm your email address or to confirm deleting your account, each of which works for one hour, and a last email once your account has been deleted. They are sent from our own mail server, which runs on our server in Austria. We do not send newsletters or advertising. Polar sends your receipts and the emails about your payments, under its own policies.

When you write to support@getvanel.com or privacy@getvanel.com, your message is received by Cloudflare’s email routing and forwarded to our mailbox at Proton (Proton AG, Switzerland).

Why. To send you the emails your account needs, and to answer your messages.

8. Usage statistics from the app

The app can send usage statistics to this website. They are not linked to your account, contain no name or email address, and never include your chats, files, keys or other content; that is why the app calls them anonymous.

What is sent. Which features are used (for example, that a team was created from a template, a schedule ran or an update was downloaded), which plan a license is for, the kinds of errors that happened and the time of each event, together with the app version, operating system and version, processor type, the app’s language and a random installation ID. The installation ID is created on your computer when the app first starts and is not tied to you or to your license. We do not store your IP address with the statistics.

Your choice. If your computer’s time zone is in Europe (this includes Türkiye), or its region is set to a country in the EU or EEA, the United Kingdom or Switzerland, the app asks you first and sends nothing unless you allow it. Elsewhere the statistics are on by default. You can turn them off at any time in the app’s Settings.

Why. To see which parts of Vanel are used, and to find and fix errors.

9. Problem reports

When you choose “Report a problem” in the app, you see everything that will be sent before you send it. A report contains your description, the app version, operating system and version, processor type, the app’s language and the versions of the AI tools installed and of the app’s own components, and, if you leave them ticked, recent app logs and a screenshot of the Vanel window. You can add your email address if you would like an answer.

Before sending, the app removes keys, tokens, passwords and email addresses from your description and the logs, and replaces the path of your home folder, which usually contains your user name, with “~”. A screenshot shows whatever was on the Vanel window at that moment, so check it before you send it, or untick it.

Reports are stored on our server and used only to look into and fix the problem, and to answer you if you gave your email address. To have a report deleted, write to privacy@getvanel.com with the reference number the app showed you.

10. Visiting the website and keeping it safe

Every visit to this website, and every request from the app, passes through Cloudflare’s network, which protects the site and delivers it quickly, and then reaches our server. Both see your IP address and technical details of the request, such as your browser type.

We use your IP address to keep the service safe, for example to limit repeated login attempts or problem reports. These counters cover a short period of at most an hour, are kept only in our server’s memory and are never written to our database. Apart from your login sessions, our application does not save the IP addresses it sees.

Our server keeps technical logs of errors and important events, such as a message from Polar that could not be processed. They can contain identifiers such as your account ID or an order number. We use them only to run the service, fix problems and keep it secure.

Website statistics. To see how the website is used, we run Umami, an open-source analytics tool, ourselves, on our own server in Austria (EU), the same netcup server the website runs on (see section 12); no analytics company receives your data. Umami sets no cookies and stores nothing on your device. It counts visits and actions on the site: which pages are opened, where visitors came from (the referring website and campaign tags in the link, such as utm_source), clicks on buttons and links (for example Download, the plans and the contact links), which sections and plans come into view, how far a page is scrolled and roughly how long it stays open, errors and missing pages, and steps such as creating an account, logging in, starting a checkout and completing a purchase (the plan and the amount).

Umami sees your IP address and browser details. It uses them to recognise a visit without cookies, through a code that changes every month and cannot be traced back to you, and to work out your country, region and city, your browser, operating system and type of device, screen size and language. It does not store the IP address itself. The statistics are never linked to your account and never contain your name, email address, license key or anything you type into a form. We only look at them in aggregate.

When you download the app, the download comes from our server. The app’s files are stored on GitHub (GitHub, Inc., USA); our server fetches them from GitHub and passes them on to you, so GitHub does not receive your IP address or any other details about you. Our website statistics count downloads by platform and file type, but we do not record who downloads what.

11. Cookies

We use only the one cookie below, and no analytics, advertising or tracking cookies. Our website statistics (section 10) work without cookies, and no scripts are loaded from other companies’ servers. The website shows itself in Turkish or English according to your browser’s language setting, which it reads on each visit and does not store.

Login cookie (better-auth.session_token): keeps you logged in. It is set when you log in, lasts up to 30 days and is removed when you log out. Your browser may show it with a “__Secure-” prefix.

This cookie is needed for what you ask the website to do, so we do not ask for consent for it. You can delete cookies in your browser at any time; you will then be logged out.

Polar’s checkout and billing pages are on Polar’s own website, where Polar’s cookie and privacy policies apply.

12. Who we share data with

We do not sell your personal data, and we do not use it for advertising or profiling.

Service providers that process data for us: netcup GmbH (Germany) rents us the server that our website, database, website statistics, stored problem reports and mail server run on; the server is in a data centre in Austria. Cloudflare, Inc. (USA) runs our domain’s DNS, passes all traffic to the website through its network to protect it and speed it up, and forwards emails sent to our addresses. Proton AG (Switzerland) hosts the mailbox where emails to our support and privacy addresses arrive.

For the free trial: OpenRouter, Inc. (USA) creates and limits the trial keys we hand out and passes the requests made with them to the provider of the AI model, DeepSeek; see section 6.

Companies responsible for your data themselves: Polar Software, Inc. (USA), our merchant of record, for purchases, payments, taxes, invoices and license keys, together with Stripe, which processes payments for Polar.

You use your AI provider and the other services you connect directly, under your own agreement with them. They do not process data on our behalf, and we do not send them your data. GitHub stores the app’s files but receives no personal data from us.

We may also disclose data where the law requires it, for example to a court or a public authority, or where it is needed to protect our legal rights.

13. Data transferred abroad

We are based in Türkiye and run the service from there, while our server is in Austria, in the EU. Because of the providers above, your data is transferred abroad (in Turkish law, “yurt dışına aktarım”): to Austria (netcup), to the United States and the other countries where Cloudflare’s network runs (Cloudflare), to Switzerland (Proton) and, when you buy, to the United States (Polar).

When you use the free trial, your requests are sent to the United States (OpenRouter) and to China and other countries where the AI model’s provider processes them (DeepSeek). There is no adequacy decision for these countries; if you do not want this, use your own ChatGPT or Claude subscription instead (see section 6).

For people in the EU and EEA: Cloudflare states that it complies with the EU–U.S. Data Privacy Framework, and its data processing terms include the EU standard contractual clauses. Switzerland, where Proton is based, is recognised by the European Commission as providing adequate protection. Türkiye, where we are based, has no such adequacy decision.

What you give at Polar’s checkout goes directly to Polar, the seller, under Polar’s own terms and privacy policy.

14. How we collect data, and on what grounds

We collect your data electronically: through the forms on this website, the requests the app sends to it, cookies, the messages Polar sends us and the emails you send us. We rely on these legal grounds:

Performing our agreement with you (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)): your account and login sessions, your purchases and licenses, license checks, the free trial, account emails, and answering your questions about them.

Meeting our legal obligations (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)): keeping purchase records where tax, accounting or other law requires it.

Establishing, exercising or defending legal claims (KVKK Art. 5(2)(e); GDPR Art. 6(1)(f)): for example, the records of a disputed payment.

Our legitimate interests (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)), which we weigh against your rights and freedoms: keeping the service and your account secure (IP addresses, browser details, rate-limit counters and technical logs), finding and fixing problems (problem reports), answering the messages you send us, remembering your language, understanding how the website is used through aggregate website statistics, and usage statistics where the app does not ask for permission first.

Your consent (in the KVKK, explicit consent, “açık rıza”, Art. 5(1); GDPR Art. 6(1)(a)): usage statistics where the app asks you first. You can withdraw your consent at any time in the app’s Settings; this does not affect what was sent before.

You do not have to give us your data, but without an account and an email address we cannot sell you a plan or give you a license key.

15. How long we keep data

Account: until you delete it. You can do that yourself at any time on your account page, as described below, or ask us to do it.

Login sessions: until you log out or your account is deleted. A session stops working 30 days after you last used it.

Purchases and licenses: as long as we need them to provide your license, to meet legal obligations such as tax and accounting rules, and to handle any dispute about a payment. If your account is deleted, we keep the order and subscription records (product, amount, currency, dates, status and Polar’s reference numbers) without the link to your account; your license keys are revoked and deleted.

Deleting your account. On your account page you enter your password and type your email address; we then email you a link, valid for one hour, and your account is deleted as soon as you open it and confirm. At that moment we end any Pro subscription at Polar and stop its payments, remove your computers from your license keys and revoke the keys (the app goes back to Free, and a Lifetime license is lost), delete your free trial key at OpenRouter, and ask Polar to delete your customer record and anonymise your details there. We erase your name, email address, password, login sessions, computers, any purchase waiting for your address, the email address on problem reports you sent and any stored copy of a Polar message about you. We then send you one last email to confirm it. If a step at Polar cannot be completed right away, we retry it until it succeeds, and in any case within 30 days; until then our website refuses your license keys. Polar, as merchant of record, keeps your invoices and payment records under its own legal obligations.

Free trial: the record of your trial as long as your account exists. If your account is deleted, your trial key is deleted at OpenRouter and the record is kept without the link to your account, so that a key cannot be handed out twice.

After a deletion we keep a short record of it: your former account ID, your Polar customer number and a one-way code of each license key, but no name, email address or key. We use it only to finish the steps at Polar, to keep refusing those keys and to make sure a late message from Polar does not create a new record about you.

Problem reports: as long as we need them to look into the problem. Screenshots are also deleted automatically, oldest first, whenever all stored screenshots together exceed 500 MB.

Website statistics: as long as they help us improve the website. They contain no IP addresses and are not linked to your account.

Usage statistics and technical logs: as long as they help us improve Vanel, fix problems and keep the service secure.

Emails with us: as long as we need them to answer you and to follow up.

When we no longer need data for these purposes, we delete it.

16. Security

Connections to this website are encrypted (HTTPS). Passwords are stored only in hashed form. Access to our server and database is restricted. No system is perfectly secure, so please choose a strong password that you do not use anywhere else.

17. Your rights

Under Article 11 of the KVKK, you have the right to learn whether your personal data is processed and, if so, to request information about it; to learn the purpose of the processing and whether the data is used for that purpose; to know the third parties in Türkiye or abroad to whom it is transferred; to ask for it to be corrected if it is incomplete or wrong; to ask for it to be deleted or destroyed under the conditions of Article 7; to ask for those corrections and deletions to be passed on to the third parties who received it; to object to a result against you that comes solely from automated analysis; and to claim compensation if you suffer damage because of unlawful processing.

If the GDPR applies to you, you also have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, to object to processing based on our legitimate interests, and to withdraw your consent at any time.

You can delete your account yourself on your account page (see section 15). To use your other rights, or if you cannot log in, write to privacy@getvanel.com from the email address registered with your Vanel account, so that we can confirm the request is yours. We answer within 30 days, free of charge.

Under the KVKK, a formal application must be made in Turkish and include your name, your Turkish identity number (for foreign nationals, your nationality and passport number), your home or business address for notices and what you are asking for.

Complaints. Under the KVKK, you first apply to us. If we reject your application, you find our answer insufficient or we do not answer in time, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of learning our answer, and in any case within 60 days of your application. If you are in the EU or EEA, you can complain at any time to the data protection authority where you live or work, or where you think the problem happened (list of authorities). In the United Kingdom you can contact the ICO, and in Switzerland the FDPIC.

18. Children

Vanel is not meant for children under 16, and we do not knowingly collect their data. If you think a child has given us personal data, write to us and we will delete it.

19. Changes to this policy

We update this policy when our practices change. The date at the top shows the current version. If a change is significant, we will tell you by email or in the app before it takes effect.