Privacy Policy

Introduction

ScolerAI ("we", "our", "us") is an educational application operated under the laws of the Republic of Turkey. We are committed to protecting your privacy and processing your personal data lawfully, fairly and transparently.

This Privacy Policy explains what data we collect, why we collect it, how we use and protect it, with whom we share it, and what rights you have. It applies to all users of ScolerAI on web, Android and iOS.

We process your personal data in accordance with the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where applicable, the EU General Data Protection Regulation ("GDPR"). The data controller is ScolerAI.

Data We Collect

We collect only the data necessary to deliver and improve the educational service:

• Account information: email address, display name, authentication identifiers, and (optionally) date of birth used solely for age-gating and parental-consent flows.
• Learning preferences: subjects, goals, study habits, language, and other settings you choose to share.
• Study content you create: sessions, AI notes, flashcards, quizzes, courses, podcasts, plans, uploaded files and documents.
• Usage analytics: feature usage, session duration, error/diagnostic logs, device type, OS version, and app version.
• Voice & audio data (only when you actively use voice features): short audio streams used for speech-to-text and AI responses.

We do NOT collect special categories of personal data (health, religion, biometric, political opinions, etc.). We do NOT sell your data to anyone, ever. We do NOT use your study content to train third-party AI models.

How We Use Your Data

Your data is used exclusively to:

• Provide, secure and personalize the educational service.
• Generate AI-powered study content tailored to your preferences.
• Track your learning progress and provide insights.
• Detect, prevent and respond to abuse, fraud and security incidents.
• Comply with legal obligations under KVKK and other applicable laws.

Legal bases for processing (KVKK Art. 5 / GDPR Art. 6):

• Performance of a contract — providing the service you signed up for.
• Your explicit consent — for AI personalization, voice features, parental-consent flows for minors and any optional analytics.
• Legitimate interests — keeping the service safe, preventing abuse and improving quality.
• Legal obligation — when we are required to retain or disclose data by law.

Personalization, voice and other consent-based features can be turned off at any time in Settings > Privacy & Data, without affecting the core service.

Third-Party AI & Service Providers

To deliver the service we rely on a small number of vetted processors:

• Google Firebase (Authentication, Firestore, Storage, Cloud Functions, Hosting, Crashlytics, Cloud Messaging) — infrastructure and back-end.
• OpenAI, Google (Gemini), Anthropic (Claude) — AI content generation and voice features.
• Apple, Google — push notification delivery on iOS and Android.

When AI features are used, we send only the minimum data required to fulfil your request — your prompt, the selected study content and non-identifying learning preferences. We NEVER send your name, email, date of birth, school name, parent/guardian email or other directly identifying information to AI providers.

These providers act as data processors under KVKK and GDPR and are bound by contracts (including, where data leaves Turkey or the EEA, Standard Contractual Clauses) that prohibit them from using your data to train their models or for any purpose other than serving your request.

Your Rights Under KVKK and GDPR

Under KVKK Article 11 and, where applicable, GDPR Articles 15–22, you have the right to:

• Learn whether we process your personal data and obtain a copy of it (Settings > Privacy & Data > Download My Data).
• Rectify inaccurate or incomplete data (edit your profile at any time).
• Request deletion of your data (Settings > Privacy & Data > Delete My Account).
• Restrict or object to processing (e.g. by disabling AI personalization).
• Data portability — export your data as JSON.
• Withdraw any consent you previously gave, at any time, without affecting the lawfulness of past processing.
• Not be subject to fully automated decisions producing legal or similarly significant effects on you.

We respond to verified rights requests within 30 days. If you believe your rights have been violated, you may lodge a complaint with the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu — KVKK Board) at www.kvkk.gov.tr, or with your local supervisory authority in the EEA.

Children's Privacy

ScolerAI is designed for learners of all ages, including students in primary, secondary and higher education.

For users under 16 years old, we require verifiable parental or guardian consent before collecting or processing personal data for AI personalization. Until that consent is provided, AI personalization, voice features and any optional analytics are disabled, and only the minimum data needed to operate the service is collected.

Parents or guardians can at any time:

• Review the data we hold about their child.
• Withdraw consent and disable personalization.
• Request export or full deletion of the child's account and data via info@scolerai.com.

We do not knowingly create accounts for users under the minimum age required by local law. If we discover an account has been created in violation of this rule, we will suspend it and delete the data.

Data Security

We apply technical and organizational measures appropriate to the risk:

• All data in transit is protected with TLS / HTTPS.
• Data at rest in Firebase Firestore and Storage is encrypted by Google's infrastructure.
• Authentication is handled by Firebase Auth with industry-standard credential hashing.
• Access to production data is restricted to a minimum number of authorized personnel and is logged.
• Firestore security rules enforce strict per-user isolation — your data is stored under your own user identifier and is not accessible to other users.

No system is 100% secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the KVKK Board within 72 hours and inform affected users without undue delay, in line with KVKK Article 12 and GDPR Articles 33–34.

Data Retention

We keep your data only as long as needed for the purposes set out in this Policy:

• Account, profile and study content — kept while your account is active.
• Aggregated/anonymized analytics — may be retained indefinitely as they no longer identify you.
• Diagnostic and security logs — typically kept for up to 12 months.
• Voice/audio streams — processed in real time and not stored beyond what is needed to return the AI response.

When you delete your account, your personal data and study content are removed from our active systems promptly, and from backups within 30 days, except where we are required by law to retain certain records (e.g. accounting or fraud-prevention obligations).

International Data Transfers

Some of our processors (Firebase, OpenAI, Google, Anthropic, Apple) operate servers located outside Turkey, including in the European Economic Area and the United States. When your data is transferred abroad, we rely on legal safeguards required by KVKK Article 9 and GDPR Chapter V, including:

• Standard Contractual Clauses approved by the European Commission.
• Provider commitments not to use your content for model training.
• Strict purpose limitation in our contracts with each processor.

For users in Turkey, transfers abroad take place only where the conditions of KVKK Article 9 are met, including your explicit consent for transfers requiring it.

Cookies & Local Storage

On the web version of ScolerAI we use strictly necessary cookies and browser local storage to keep you signed in, remember your preferences (theme, language, AI provider) and protect against abuse. We do NOT use advertising or cross-site tracking cookies.

On mobile, we use the equivalent platform mechanism (SharedPreferences) to store the same kind of local settings on your device.

You can clear cookies and local storage at any time from your browser or device settings; doing so will sign you out and reset local preferences.

Governing Law & Supervisory Authority

This Privacy Policy is governed by the laws of the Republic of Turkey, in particular the Turkish Personal Data Protection Law No. 6698 (KVKK) and its secondary legislation.

The competent supervisory authority is the Personal Data Protection Authority of Turkey (Kişisel Verileri Koruma Kurumu — "KVKK Board"). Users in the European Economic Area also retain the right to lodge a complaint with their local supervisory authority under the GDPR.

Any dispute relating to the processing of your personal data shall be subject to the exclusive jurisdiction of the courts and enforcement offices of Istanbul (Çağlayan / Istanbul Mahkemeleri ve İcra Daireleri), Turkey, without prejudice to your statutory rights as a consumer.

Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our service or in applicable law. When we make material changes, we will notify you in advance through the application and, where required, ask for renewed consent before the changes take effect.

The "last updated" date at the bottom of this page (in the application) indicates the most recent revision. Your continued use of ScolerAI after the changes take effect means you accept the updated Policy.

Contact Us

For any privacy-related question, data subject request, parental-consent matter, or to report a possible data breach, you can contact us at:

info@scolerai.com

We aim to respond to all verified requests within 30 days. To help us serve you faster, please include the email address associated with your ScolerAI account and a clear description of your request.