Privacy Policy

This English version is provided for convenience. If it differs from the Turkish version, the Turkish version prevails.

1. About this policy

This policy explains in plain language how IRON LABS TEKNOLOJİ ANONİM ŞİRKETİ (“Eventora”, “we”) uses your personal data in the Eventora service. It covers:

our website https://eventora.com.tr,
our web app https://app.eventora.com.tr,
the Eventora mobile apps for iOS and Android.

The formal details, such as the legal ground for each kind of data, transfers and retention, are in the KVKK Privacy Notice. What is stored in your browser and on your device is in the Cookie Policy. If this policy and the notice differ, the notice prevails.

2. In short

Our website uses no cookies, analytics or advertising trackers.
We collect what we need to run your account and events; we don’t use it for advertising and we don’t sell it.
Data about the people on guest lists belongs to the planner; we process it only on the planner’s behalf.
Your data is kept in the European Union, in Google Cloud’s Belgium region.
Your card details are entered only on iyzico’s payment page and never reach us.
Features that use artificial intelligence receive only the least data needed for the job.
You can delete your account yourself in the app.

3. Who we are and our role

Eventora helps people, venues and agencies who plan weddings, engagements, henna nights, birthdays and corporate events to manage guest lists, reach guests by WhatsApp, SMS or AI voice call, collect RSVPs and prepare seating plans.

We are the data controller for account holders, team members and website visitors.
For guest data, the controller is the planner (person or organisation) who uploads the list. We process that data as a processor, only on the planner’s instructions and under the Data Processing Agreement.

4. What data we collect

4.1 When you visit the website

Our website sets no cookies and uses no analytics tool. Cloudflare, which serves the site and protects it from attacks, technically processes your IP address, browser information and the page requested with each request. The theme and language you pick are stored only in your own browser. If you email us, we use your name, email address and message to answer you. If you request a demo, what you enter in the booking form (name, company name, phone, email, how you heard about us and your notes) goes to our booking provider Cal.com; we use it only to arrange the call and get back to you.

4.2 When you open and use an account

Account details: your name, your email address, and your phone number if you sign in with it. If you sign in with Google or Apple, they send us your name and email address.
Sign-in and security details: your sign-in method, time of last sign-in, session cookie, app verification tokens, and server logs containing IP address and browser information. For phone sign-in we keep the code we sent and your IP address only as keyed hashes, and delete these records after 2 days.
Usage details: the events you create, your team and their roles, your message templates, communication campaigns, credit transactions; your language, date and time format and time zone preferences.
Billing details: name or company name, Turkish ID number or tax number, tax office, address, email and mobile phone. We use them to issue invoices and to pass the buyer’s details to the payment institution.
Payment details: the credits you buy, the amount, the payment status and iyzico’s payment references. Your card number, expiry date and security code are entered on iyzico’s payment page and verified with 3-D Secure; they never reach us.
Support correspondence: emails you send us and their attachments.

4.3 People invited to a team

If an account holder invites you to their team, they enter your name (optional) and your email address or phone number. We send the invitation by email or WhatsApp. The invitation link is valid for 14 days, and we keep only a hash of it, not the link itself.

4.4 Guests

The planner enters guests’ first and last names, phone numbers, party sizes, tags and message language, and may also name the people coming with them. They can build the list by hand, from an Excel file, or by picking from the phone’s contacts in the mobile app. The messages sent to guests, their delivery status, the guests’ answers, and the outcomes, transcripts and summaries of voice calls are also kept. We process this on the planner’s behalf; details are in section 5 of the KVKK Privacy Notice.

As a planner, you are responsible for having a valid legal ground to give your guests’ data to Eventora and to contact them, and for informing your guests.

5. Why we use data

To create your account, recognise you and provide the service.
To deliver invitations, reminders and calls to your guests on your instructions and show you their answers.
To keep your credits, spending and payments accurate, and to issue invoices.
To protect your account and the service from unauthorised access, fraud and misuse.
To answer your questions, requests and complaints.
To meet our obligations under tax, commercial and consumer law.

We don’t use your data for advertising, we don’t sell it and we don’t share it with advertising networks. We don’t send you commercial messages with promotions or campaigns; if we ever do, we will first ask for your consent under Law No. 6563 and the Message Management System (İYS).

6. Features that use artificial intelligence

Some features use Anthropic’s Claude AI model or an AI voice assistant. We want to be clear about this:

Excel list import: Claude proposes which column in your list holds the first name, last name, phone, party size or tag. We send Claude only the column headers and at most 5 sample rows, with phone numbers masked and email addresses hidden. The whole list is never sent to Claude. No row is imported until you confirm the proposal; our own rules then apply the mapping to every row. The file you upload is deleted when the import is done, and in any case automatically within 30 days.
Reading floor plans: We send the floor plan you upload (PDF) to Claude, which finds the tables, chairs and table capacities. You review, correct and accept the result.
AI voice calls: The assistant that calls your guests is an AI. At the start of the call it says that it is an AI assistant calling on the planner’s behalf via Eventora. It calls only during allowed hours, with a limited number of retries. It records the RSVP, party size, notes and callback requests; you see the transcript and summary of the call and can change the answers it recorded. If the call is recorded, the assistant also says so at the start.

These features never make a decision about a person solely by automated means that has legal effects; you always see the results and can change them.

7. Messages and calls to guests

We reach guests on the channel the planner chooses for each campaign:

WhatsApp: from Eventora‘s WhatsApp Business number, on the planner’s behalf, saying that it is sent via Eventora. Guests answer with buttons, and can write “STOP” to stop WhatsApp messages sent through Eventora.
SMS: with the sender name “EVENTORA”. SMS only informs; replies are not read.
Voice call: by the AI assistant described above.

We don’t email guests, and guests never sign in to Eventora. If you are a guest and want to stop the messages or learn about your data, apply first to the planner who invited you or, if you cannot reach them, to us; we will pass your request to the planner.

To provide the service we work with trusted service providers, giving each only the data it needs for its job:

Infrastructure and security: Google Cloud (hosting), Google Firebase (sign-in and app verification), Cloudflare (domain names, content delivery, security, email routing).
Artificial intelligence: Anthropic (Claude); for voice calls, LiveKit and the voice agent’s speech and language model providers.
Messages and calls: Meta (WhatsApp), Verimor (SMS and the voice call network in Turkey), Twilio (SMS abroad).
Email: Amazon Web Services (Amazon SES, EU region) and Google (incoming email).
Demo bookings: Cal.com (the booking form, confirmation emails and the video call).
Payments and invoices: iyzico, our e-invoice integrator, the Revenue Administration (GİB), our accountant.
Legal requirements: authorities and courts empowered by law; our lawyers where needed.

The full list, with each recipient’s purpose and the data transferred, is in section 7 of the KVKK Privacy Notice.

9. Transfers abroad

Our servers are in Google Cloud’s Belgium region (europe-west1), and some of our service providers are in the United States or other countries. We make these transfers under Article 9 of the KVKK, with the standard contracts announced by the Personal Data Protection Board, notified to the Authority. Details are in section 8 of the notice.

10. How we protect your data

Encrypted connections: All traffic between the website, the web app, the mobile apps and our servers is encrypted with HTTPS (TLS 1.2 or later).
Hosting in the EU: Our database and files are in Google Cloud’s Belgium region and are stored encrypted by Google by default.
Access control: Within an account, everyone can do only what their role allows, and every change is checked on the server. Our server services can reach only the resources they need. The storage holding uploaded files is closed to the public; files are reached only through short-lived signed links.
Sign-in security: Accounts opened with an email and password cannot be used until the email address is verified. The web session is kept in a cookie that JavaScript cannot read (httpOnly). Sensitive actions such as deleting the account ask you to sign in again. Phone sign-in codes have sending and attempt limits, and we keep codes and IP addresses only as keyed hashes. App verification (App Check) reduces automated attacks.
No personal data in logs: We never write guests’ names, phone numbers, message contents or call transcripts to system logs.
Least data: We send service providers, especially AI services, only the least data needed for the job.
Card details: Card details are handled only by iyzico, a licensed payment institution.

No system is entirely without risk. If a data breach occurs, we make the notifications the KVKK requires to the Personal Data Protection Board and to the people affected, and we notify the planner without delay of a breach affecting guest data.

11. How long we keep data and how we delete it

Deleting your account: You can delete your account in Settings. For your security, we first ask you to sign in again. Deleting it removes your sign-in account (your Firebase user), removes your name, email address and phone number from your user record at once, and takes you out of your teams.
Account closure: When the last member of an account deletes themselves, the account closes: its events are archived and running campaigns are stopped. Guests’ personal data (guests, message texts and numbers, the calls’ numbers, outcomes, transcripts and recordings) is deleted 30 days after the account closes. Invoices, payments and credit transactions are kept as long as tax and commercial law require (5 years under the Tax Procedure Law, 10 years under the Turkish Commercial Code).
Unspent credits: When an account closes, unspent credits can be refunded only within the 14-day period described in Cancellation and Refunds.
Deleting an event: When you delete an event that has not contacted anyone, the event, its guests and its files are deleted. An event that has sent messages to guests or called them is not deleted but archived, so its delivery and RSVP history is not lost. Deleting an event does not refund the credits spent on it.
Uploaded files: Excel guest lists are deleted when the import is done, and in any case within 30 days. Floor plan files are deleted when you upload a new plan or delete the plan.
Phone sign-in records: Deleted after 2 days.

An account that never verified its email address cannot get into the app, so it cannot reach the delete screen either. Eventora holds no data for such an account other than the sign-in record; you can ask for that record to be deleted by writing to kvkk@eventora.com.tr.

All retention periods are in section 9 of the KVKK Privacy Notice.

12. Your rights

Under Article 11 of the KVKK you have rights such as accessing your data, asking for it to be corrected or deleted, learning who it was transferred to, and objecting. You can change your name, password and preferences yourself in the app’s Settings, and delete your account yourself. For other requests, you can apply to kvkk@eventora.com.tr or to our KEP address (ironlabsteknoloji@hs06.kep.tr) using the Data Subject Request Form. We answer free of charge within 30 days at the latest.

13. Children

Eventora accounts are only for people aged 18 or over; people under 18 cannot open an account or be team members. Guest lists may include guests under 18 entered by the planner. In that case, the planner, as controller, is responsible for having the legal ground to process the child’s data and contact them (including a parent’s consent where needed). We recommend reaching the parents instead of messaging or calling children.

14. Mobile app permissions

Contacts: The mobile app asks for access to your contacts only when you tap “From contacts”. Your contacts are read on your phone, and only the names and numbers of the people you pick as guests are sent to us. Nothing is written to your contacts.
Files: When you choose an Excel list or a floor plan, only the file you choose is uploaded.
The mobile app uses no advertising identifier, location, analytics or push notification permission.

15. Changes to this policy

We update this policy when our service or the law changes. The current version is always on this page, with the date of the last update at the top. We also announce material changes to account holders in the app or by email.

16. Contact

Personal data requests: kvkk@eventora.com.tr
KEP: ironlabsteknoloji@hs06.kep.tr
Support: destek@eventora.com.tr
Legal matters: hukuk@eventora.com.tr
General: iletisim@eventora.com.tr
Address: IRON LABS TEKNOLOJİ ANONİM ŞİRKETİ, GÖRELE MAH. USTA SK. NO: 28 İÇ KAPI NO: 1 BEYKOZ/İSTANBUL