1. In short
Vicis is a web app that lets small workplaces plan a weekly shift roster and share it with their staff. We process the minimum data the product needs to work.
- We do not sell or transfer data to advertising networks.
- We set no analytics, advertising, or tracking cookies anywhere on the site.
- Staff data belongs to the workplace; we hold it on the workplace's behalf.
- Published roster links are unguessable, blocked from search engines, and can be revoked by the manager at any time.
2. Who we are and in what capacity we process data
This policy covers the Vicis service at vicis.app. The service is run not by a company but by Selman Gürbüzer ("Vicis", "we") as an individual, based in Şanlıurfa, Türkiye. Contact: hello@vicis.app · +90 505 020 43 23.
Vicis acts in two different capacities, and the distinction determines who you address your requests to:
| Data | Our capacity | What it means |
|---|---|---|
| Manager account (name, email, session, subscription) | Data controller | Send requests about this data directly to us. |
| Staff data entered into the roster (name, group, title, shift hours) | Data processor | The workplace that built the roster is the controller. Send requests to the workplace first; it instructs us. |
3. What we process
Account and authentication data: name, email address, the user id held by our authentication provider, and session information. This is processed through Clerk. We never store your password.
Workplace and roster data: workplace name, groups, titles, shift templates, planning rules, and week sheet display preferences.
Staff data: the name the manager types into the roster, optional group and title, active/inactive status, per-day shift assignments, and weekly hour totals. These fields are not intended for national id numbers, addresses, phone numbers, or health information, and we recommend not entering them.
Subscription and payment data: plan status, subscription id, and billing region. Card details never reach Vicis servers; the payment flow is run by Dodo Payments.
Technical data: the IP address seen by the receiving server, country, browser and language preference, plus access and error logs. We use the country signal only to select the correct currency and default language.
4. Why we process it
- Delivering the service: creating, saving, publishing rosters and generating share links.
- Keeping accounts safe: sign-in, session management, and blocking unauthorised access.
- Billing: measuring the free plan limit, verifying subscription status, running invoicing.
- Legal obligations: meeting statutory retention and disclosure duties.
- Improving the service: reviewing error logs to fix faults.
We do not use personal data for anything beyond these purposes. There is no profiling, no automated decision-making, and no behavioural advertising.
5. Published rosters and share links
When you publish a week, a snapshot of that week is stored on the server and two kinds of link are produced: a week sheet link (/p/...) and personal links (/w/...).
- Link addresses are generated with cryptographic randomness and are not short enough to guess.
- These pages are blocked from search engines (noindex, nofollow) and excluded from the sitemap.
- The link itself is the credential. Anyone holding it can see that week's roster, and a published week contains every team member's name and shifts.
- When the manager unpublishes, the link stops working and the snapshot is deleted.
Share links only with the team they concern. Do not post them on public web pages or social media.
6. Cookies and similar technologies
We use only cookies that are strictly necessary for the service to work. We set no advertising, measurement, or third-party analytics cookies.
| Cookie / storage | Purpose | Type |
|---|---|---|
| Clerk session cookies | Keeping the manager signed in | Strictly necessary |
| Language preference | Remembering the Turkish or English interface | Strictly necessary |
| Browser local storage | Holding the draft roster on the device | Strictly necessary |
Interface fonts are served from the application itself; opening a page sends no request from your browser to a third-party font host.
7. Who we share it with
We do not sell data. We use the following processors to deliver the service and transfer only the minimum data required:
| Provider | Function | Data transferred |
|---|---|---|
| Clerk | Authentication and session management | Name, email, session data |
| Dodo Payments | Payments and subscriptions (merchant of record) | Email, subscription and invoice data |
| Turso / libSQL | Storage of roster and publication data | Workplace, staff and roster data |
| Vercel | Hosting and delivery of the application | Request logs, IP, country |
These providers may run infrastructure outside Türkiye, which makes the processing a cross-border transfer. Transfers are made under Article 9 of Law No. 6698 on the basis of contractual safeguards and, where required, your explicit consent. We may also disclose data to satisfy lawful requests from competent judicial and administrative authorities.
8. How long we keep it
- Account data: while the account is open; deleted within a reasonable period after closure.
- Roster and staff data: until the workplace deletes it or closes the account.
- Published snapshots: until unpublished, at which point they are deleted.
- Invoice and subscription records: for the period required by tax and commercial law (as a rule, 10 years).
- Technical logs: short-term, for security and fault investigation.
9. Security
- All traffic is encrypted over HTTPS and enforced with HSTS.
- Manager pages are session-protected; share data is produced server-side only.
- Share links are generated with cryptographic randomness.
- Browser security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) are enabled.
- Card data is never held in our systems at any stage.
No system is absolutely secure. If you notice a vulnerability, please report it to us.
10. Children's data
Vicis is a workplace tool and is not directed at people under 18. Where a person entered into a roster is a young worker, applying the protective provisions of the relevant employment law is the workplace's responsibility.
11. Your rights
Your rights under Article 11 of Law No. 6698 on the Protection of Personal Data, and how to exercise them, are set out in detail on the KVKK Notice page. For any request, write to hello@vicis.app.
12. Changes
We update this policy as the service changes. The current version is always published on this page and the date at the top is updated. For material changes we notify the email address on your account.
13. Contact
For anything privacy-related, reach us at hello@vicis.app or on +90 505 020 43 23.