Last updated: September 1, 2026

Privacy Policy & KVKK Disclosure Notice

Prepared under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (KVKK).

1. Data Controller

Your personal data is processed by the data controller detailed below:

Agonist Ltd. Şti.

Cumhuriyet Tax Office — Tax ID: 0091506055

Trade Registry No: 455963

Kazım Özalp Mah. Kumkapı Sk. No:34 İç Kapı No:1, Çankaya/Ankara, Türkiye

Email: info@agonistdigital.com

2. Personal Data Processed and Categories

Identity and Contact

First and last name, email address, phone number

Account Information

Username, encrypted session data, registration date

Subscription and In-App Purchase

Selected plan/package and subscription status; payment is processed via the Apple App Store or Google Play — card details never reach or are stored by our platform

Property and Reservation Data

Property information added by the User, reservation dates, accommodation fees

Guest Personal Data

Guest name, passport/ID number, nationality, and date of birth entered into the system by the User — this data is processed to facilitate the legal guest-notification obligation in the User's country (e.g. KBS in Türkiye) and for the guest portal feature. Important: the platform never collects or stores a guest's payment/card information — a guest payment-collection feature is not offered.

Technical and Log Data

IP address, browser type, session durations, error logs

Property Photos

Photos uploaded by the User to showcase their properties — these are retained permanently; this is not a limitation.

Passport/ID Images — NOT STORED

The User may scan a guest's passport or ID document with the camera. This image is processed only momentarily, to automatically read the information on it (name, surname, passport/ID number, nationality, date of birth) via OCR; the image itself is never permanently stored on any server or database and is deleted as soon as processing is complete. The only thing saved to the system is the text fields read from the image.

3. Purposes and Legal Bases for Processing Personal Data

Purpose	Legal Basis under KVKK
Account creation and authentication	Performance of a contract (Art. 5/2-c)
In-app purchase and subscription entitlement management	Performance of a contract (Art. 5/2-c)
Facilitating the guest-notification obligation	Legal obligation (Art. 5/2-ç)
Guest portal service	Performance of a contract (Art. 5/2-c)
Customer support and communication	Legitimate interest (Art. 5/2-f)
Service security and fraud prevention	Legitimate interest (Art. 5/2-f)
Legal obligations (tax, commercial law)	Legal obligation (Art. 5/2-ç)
Product development and analytics (anonymized)	Legitimate interest (Art. 5/2-f)

4. Parties Your Personal Data Is Transferred To

Your data is shared with the following parties only to the minimum extent necessary to provide the service:

Supabase Inc. (USA)

Database and authentication infrastructure. Data is stored with AES-256 encryption. Transfers take place under a Data Processing Agreement (DPA) and Standard Contractual Clauses (SCCs) with Supabase.

Apple Inc.

Subscription purchases in the iOS app are processed via the App Store; payment information is managed directly by Apple and never reaches our platform.

Google LLC — Google Play

Subscription purchases in the Android app are processed via Google Play; payment information is managed directly by Google and never reaches our platform.

Resend Inc. (USA)

Transactional email delivery (registration, password reset, notifications).

Google LLC — Vision API

Passport/ID OCR processing is performed server-side. The image is not retained in Google's systems after processing completes.

Vercel Inc. (USA)

Web application hosting and CDN infrastructure.

Other than the parties listed above, your personal data is never shared, sold, or rented to any third party, except pursuant to lawful requests from authorized public authorities.

5. Special Nature of Guest Data

Users enter their guests' personal data (identity, passport information, etc.) into the system through the platform. In this context:

The User is personally responsible for fulfilling the KVKK notice and explicit-consent obligations when entering guest data into the system.
The Company acts as a "data processor" with respect to guest data; the User is the "data controller".
Guest data is used only for the legal guest-notification obligation and guest portal features; it is not processed for any other purpose.

6. Retention Periods

Account and subscription dataFor as long as the account is active; deleted instantly and permanently upon an account deletion request (see Section 8)

Guest data3 years from the end of the reservation (legal guest-notification retention requirements), or upon account deletion — whichever comes first

Payment recordsFor as long as the account is active; deleted along with all other data upon account deletion. The 10-year retention obligation under Article 253 of the Turkish Tax Procedure Law belongs to the User (the property owner) as the party collecting payments — we recommend exporting any records you may need before deleting your account

Log and technical data1 year

Data covered by marketing consentUntil consent is withdrawn

7. Your Rights under KVKK

Under Article 11 of KVKK, you have the following rights:

To learn whether your personal data is being processed
To request information if it has been processed
To learn the purpose of processing and whether it is used consistently with that purpose
To know the third parties, domestic or foreign, to whom your data is transferred
To request correction of incomplete or inaccurate data
To request deletion or destruction of data under Article 7 of KVKK
To object to a result arising against you from analysis of your processed data exclusively through automated systems
To request compensation for damage suffered due to unlawful processing

You may exercise your rights by submitting a written request with identity-verifying information to info@agonistdigital.com. Requests are answered within the statutory period of 30 days.

8. Deleting Your Account and Data

Two methods are available to permanently delete your account and all data linked to it:

From within the app (recommended): Following Settings → Delete Account in the VillaOperator mobile app and confirming deletes your account and all linked property, reservation, guest, cleaning, finance, and subscription data instantly and irreversibly. There is no additional waiting period or confirmation step.
By email request: If you don't have access to the app, you may also request deletion by sending an email from your registered email address to info@agonistdigital.com with the subject "Account Deletion Request". Once your identity is verified, your account is deleted within 30 days at the latest.

Important: Account deletion irreversibly deletes all of your data, including property, guest, reservation, and payment records — there is no partial or delayed deletion. The 10-year retention obligation for payment/invoice records under Article 253 of the Turkish Tax Procedure Law belongs to you (the property owner) as the party collecting payments from guests; we therefore recommend exporting any records you may need before deleting your account.

9. Data Security

The Company takes appropriate technical and administrative measures to prevent unlawful processing of personal data and to ensure its security: an AES-256 encrypted database, HTTPS/TLS-encrypted communication, role-based access control, and regular security updates. That said, no data transmission over the internet can be guaranteed to be 100% secure.

10. Changes

This notice may be updated from time to time. Material changes will be notified by email and published on this page. The current version is always available here.