1. Introduction

Welcome to Velacai ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website (collectively, the "Platform").

The data controller for the personal data processed on the Platform is GDO Medya Limited Şirketi (trading as Velacai), Zafer Mahallesi Sanayi Alt Yol Sokak No:75 Çorlu/Tekirdağ, Turkey (MERSİS no. 0389200616100001). We process personal data in accordance with the Turkish Personal Data Protection Law No. 6698 ("KVKK"). If you joined the Platform through a course (an education provider or teacher that uses Velacai with its students), that course is also responsible for the processing it carries out itself, such as the information it collects directly from you and your parent or legal guardian.

2. Information We Collect

2.1 Personal Information

When you register for an account, we may collect:

Full name and email address
Password (stored in encrypted form)
Profile information (avatar, preferences)
Payment information (processed securely via third-party providers)

2.2 Usage Data

We automatically collect certain information when you use the Platform:

Exam scores, study progress, and performance analytics
Device information (type, operating system, browser)
IP address and general location data
Usage patterns and feature interactions

2.3 Parent or Legal Guardian Contact Data

If your course uses parent summaries, your course enters the e-mail address of your parent or legal guardian and, optionally, their name and their relationship to you (mother, father, guardian or legal representative, or other). We also record when the address was added, when confirmation e-mails were sent and who triggered them, when your parent confirmed, declined or stopped the summaries, and the delivery status of each summary. If you are recorded as 18 or older, we also record when this was recorded and whether your course or you recorded it, and when you approved or withdrew the sharing. Students cannot enter or change a parent's contact details.

3. How We Use Your Information

We use the collected information for the following purposes:

To provide and maintain the Platform
To personalize your learning experience with AI-powered recommendations
To generate performance analytics, study plans, and progress reports
To implement spaced repetition algorithms for optimal learning
To process transactions and manage subscriptions
To communicate with you about updates, features, and support
To send your parent or legal guardian a progress summary every two weeks, only when your course uses this feature and your parent has confirmed their e-mail address (and, if you are recorded as 18 or older, only after you have approved it)
To detect and prevent fraud or unauthorized access
To improve our Platform through anonymized analytics

4. Data Sharing and Disclosure

We do not sell your personal information. We may share your data with:

Service Providers: Third-party services that assist in operating our Platform (hosting, e-mail delivery, analytics, payment processing)
AI Processing: Anonymized content may be processed by AI services (OpenAI, Google) to generate study materials and analytics
Legal Requirements: When required by law or to protect our rights
Your Course and Teachers: If you joined through a course's invite or promo code, or a teacher is linked to your account, the course owner and your linked teachers can see your exam results, answers, study activity, goals and performance analytics. They can assign exams to you, prepare progress reports for your parent or legal guardian from this information, and manage the parent summaries described below. Each course sees and manages only the parent contacts it added itself. When your link to the course is removed, the course no longer has access to this information.
Your Parent or Legal Guardian: If your course uses parent summaries and your parent or legal guardian confirms their e-mail address, we e-mail them a progress summary every two weeks on behalf of your course. The summary contains your name, your course's name, the two-week period it covers, your latest practice-exam score and its date, the change in your score across recent full practice exams, the number of days you studied, questions you solved, full practice exams and short exams you completed and practice sessions you did in the period, how long no study has been recorded and your last study date if that is the case, your target score and the points still needed to reach it, your correct-answer rate and level by subject, and your teacher's note and name if there is a note. It never contains your individual answers, rankings or comparisons with other students, and it contains no advertising. We do not store your date of birth: if you are 18 or older, you can state this on your profile, or your course can record it; this record cannot be undone. Without this record, your course may start the summaries for your parent or legal guardian, who is your legal representative; you are notified and can see the status on your profile. With this record, nothing is sent until you approve it on your profile, and you can withdraw your approval there at any time; if summaries you had not approved were already running, they stop until you approve; once you approve, they resume if your parent had already confirmed, and otherwise your parent is sent a confirmation e-mail first. Your parent can stop the summaries at any time with the link in every summary. How we process your parent's data is explained in the Parent Notice (Veli Aydınlatma Metni, in Turkish).
Service Providers Abroad: Our servers are hosted in Turkey by Bitwise Yazılım İnternet ve Ticaret Limited Şirketi. Our e-mails, including parent summaries, are delivered by Resend, Inc. in the United States, and the AI services mentioned above are also located abroad. Using these providers abroad means that personal data is transferred abroad; we carry out these transfers in line with the procedures and safeguards set out in Article 9 of the KVKK.

5. Data Security

We implement industry-standard security measures to protect your data, including encrypted data transmission (TLS/SSL), secure password hashing, regular security audits, and access controls. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. You may request deletion of your account and associated data at any time by contacting us. Certain data may be retained for legal or regulatory compliance purposes.

Parent or legal guardian contact data is kept while the summaries continue. When your parent stops the summaries or declines the request, or when you withdraw your approval (if you are recorded as 18 or older), their e-mail address is deleted immediately. If your link to the course that added the contact ends, the summaries stop and the e-mail address is deleted when this is detected on the next send day. In these cases we keep only a one-way hash of the address, so that no summary reaches a stopped address without a new confirmation and a declined request is not sent to the same address again for you. A request your parent has not confirmed is deleted 30 days after the last confirmation link expired (if no confirmation e-mail was ever sent, 30 days after the contact was added or last updated), and a contact that has been waiting for your approval for more than 60 days is deleted. The rest of the parent record (name, relationship and dates) is deleted at the latest when your course removes it, when your account is deleted or anonymized, or when the account of the course that added the contact is deleted; if your parent declined or stopped, only the name is deleted when your course removes the record, and the address hash, relationship, status and dates are kept for the purpose above until your account is deleted or anonymized or the account of the course that added the contact is deleted. A log of confirmation e-mails (address hash, who triggered the send and when) is kept for 30 days to limit repeated requests. A copy of each summary (only the student data needed to recreate that summary exactly, and the teacher's note) is kept for 180 days. Data kept for 30, 60 or 180 days is deleted at the first scheduled clean-up after that period. The send log (address hash, period, delivery status and date) is kept until your account is deleted.

7. Your Rights

Depending on your jurisdiction, you may have the following rights:

Access and receive a copy of your personal data
Rectify inaccurate or incomplete data
Request deletion of your personal data
Object to or restrict processing of your data
Data portability — receive your data in a structured format
Withdraw consent at any time

To exercise these rights, please contact us at privacy@velacai.com

8. Children's Privacy

Many of our students are under 18. Our Platform is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such information, we will take steps to delete it promptly. If you are between 13 and 17, you should use the Platform with the knowledge of your parent or legal guardian, who is your legal representative. Your parent or legal guardian can receive the progress summaries described in section 4 and can exercise your data protection rights on your behalf. We share the data of students under 18 with their parent or legal guardian only as described in this Privacy Policy.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Platform after any changes constitutes acceptance of the updated policy. Where the law requires your consent for a processing activity, we ask for it separately; continued use of the Platform is never treated as that consent.

10. Contact Us

If you have any questions about this Privacy Policy, please contact us at: privacy@velacai.com