Privacy at Vopesa

Who is responsible

Vopesa is operated from Türkiye and is the controller of the personal data described here. Write to admin@vopesa.com with any question, or to exercise any of the rights below. We answer within 30 days.

What Vopesa holds

Only what the product needs to be the assistant you asked for:

• Your account: the email address you sign in with, the name you choose to give, your language, your timezone and the city you pick for the forecast.
• Your own work: the tasks, notes, goals and people you write or accept, and the conversations you have with Vopesa, including the text of a voice call.
• Suggestions: what Vopesa noticed in a sentence you wrote, with that sentence kept beside it so you can see where a suggestion came from.
• Technical records: server logs of requests and errors. They record that something happened, not what you said.

What Vopesa does not hold

This list is as much a part of the product as the one above.

• No audio. A voice call is transcribed as it happens and the recording is never stored.
• No Gmail access or calendar writes. The Google connection cannot read your mailbox or create, change or delete Google events. Vopesa does not request guest identities, event descriptions or attachments in its calendar queries.
• No advertising profile, no tracking across other sites, no sale of anything to anyone.
• No special categories. Vopesa is built not to learn health, belief, politics or union membership, in any field, with or without your consent.

Why we are allowed to hold it

To provide the service you asked for — the legal basis is the performance of our agreement with you. Where the law requires consent, such as connecting a calendar or turning on a proactive message, we ask for it separately and you can withdraw it at any time without losing the rest of the product.

Who else sees it

Vopesa runs on a small number of processors, each with a narrow job:

• Supabase (Ireland) hosts the database and the sign-in. Your rows are isolated by row level security; they are the store, not a reader.
• OpenAI (United States) answers your messages and calls. Requests are sent with storage disabled and are not used to train models. Only the conversation and the bounded records of the space you are speaking in are sent — never another space, and never someone else’s data.
• MET Norway provides the forecast. The request contains a city from a fixed list and nothing about you; it is the same request for everybody in that city.
• Google, only if you connect a calendar: Vopesa reads availability and event names, dates, times and locations from your primary calendar. It removes private/confidential event titles and locations before using them in the planner or assistant.

Google user data

Vopesa’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The connection requests calendar.freebusy and calendar.events.readonly, plus account identity. Vopesa queries only the event fields described above to display your day and prepare your assistant context. When you use the assistant, relevant calendar details can be sent to OpenAI to answer you. Provider responses are not stored as a separate event database; summaries can remain in saved Vopesa briefings and conversations. We do not use Google data for advertising or model training, or sell it. Connection credentials are encrypted. Disconnecting in Settings deletes the connection and requests revocation at Google; it does not erase summaries already saved in your conversations or briefings.

How long it stays

Your work stays until you delete it or close your account. Deleting a task, note or conversation removes it from the database. Raw calendar responses are not persisted; calendar summaries included in saved briefings and conversations follow their retention. Vopesa does not store call audio. Closing your account removes your rows; backups roll off within 30 days.

Your rights

Under KVKK and the GDPR you may ask for a copy of your data, its correction, its deletion, a restriction on how it is used, or you may object to it being used at all, and you may ask for it in a portable form. Write to admin@vopesa.com. You may also complain to your data protection authority — in Türkiye, the KVKK Board.

How it is kept

Every row is reachable only by the account that owns it, enforced in the database rather than in the application. Credentials for a connected calendar are encrypted before they are written and can be read only by the server, not by any signed-in session — not even yours. Traffic is encrypted in transit. We log metadata rather than content, and never credentials.

Children

Vopesa is not for people under 18 and is not directed at children. If you believe a child has an account, write to us and we will remove it.

Changes

If any of this changes, this page changes with it and the date at the top moves. A change that affects what leaves your account will be told to you in the app before it takes effect.