Privacy Policy and KVKK Disclosure Notice

Last updated: 2026-09-09 Effective date: 2026-07-10

This document describes how Vorinfo (“we”, “the Platform”) processes your personal data when you use our mobile application and web services, and also serves as a disclosure notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK). The policy complies with KVKK, the EU General Data Protection Regulation (GDPR), and the platform policies of Apple App Store / Google Play.

1. Personal Data We Collect

1.1 Account Information

• Display name (first/last name) and username
• Email address
• Profile photo (optional)
• Sign-in is only via your Google or Apple account. Vorinfo does not collect or store passwords; authentication is handled through Google/Apple and the Supabase Auth infrastructure.

1.2 Service Usage Data

• Content you create (quizzes, info cards, stories)
• Content interactions (views, likes, saves, shares, completions)
• Learning Break session data
• Game progress and score data
• Subscription tier and quota usage statistics

1.2a Source Document Export Records

When you generate a personally shortened copy of the document a piece of content was created from, we keep the following records of that operation:

• When the export was requested and for which source document
• The outcome (produced, or the reason it could not be produced) and how long it took
• The document’s total page count, the number of pages kept, and the page numbers that were removed
• How many pages were linked to a question at that moment
• Who made each page decision: the system’s suggestion, your changes, and the number of pages where the two disagreed
• The history of your manual page marks (which page, when, from which decision to which)

Why we keep it: to produce the export and to enforce limits against abuse (§2.1); and to measure, correct and debug the calculation that suggests which pages can be removed (§2.3). The places where your decision contradicts the system’s suggestion are the only signal that this calculation was wrong.

Sharing: these records are never shared on an individual basis with anyone, including the person who uploaded the source document or published the content. Only you can access your own records.

1.2b Document Generation Records

When you use the Generate Document feature by entering a topic and/or selecting your own documents, the following records are kept for the generation job:

• The topic you entered
• The title and summary of the generated plan
• The full text of the generated document — including passages taken from your own files
• The title, address and evaluation labels of the web sources used
• The job status, a timestamped generation log, and any error message
• When your document generation entitlement was consumed and whether it was refunded

Why we keep it: to run the generation, display it to you, and correctly count your entitlement (§2.1); to diagnose generation failures (§2.3).

What leaves our systems during document generation

Document generation sends data to three external services:

⚠️ The CONTENT of your own files is sent to Google Gemini. This happens in three distinct ways: the beginning portion of the files you select is added to the plan-generation prompt; all source excerpts are sent to the embedding service for similarity scoring; and the selected excerpts enter the writing prompt for each section. Your own sources rank highest in selection, so in practice they are used in nearly every section.

Your files are NOT sent to Brave or Jina. File reading and text extraction happen entirely on our own server; your files are never used as a search query and never pass through the web extraction chain.

Audio and video files are not supported and are never sent to any third party.

Account deletion: when you delete your account, all of these records — including the generated document text — are deleted.

1.2c Study Material Generation Records

When you use the Generate Material feature to pick a topic from a source document, the page slice of that topic is sent to Google Gemini and the following records are kept for the generation job:

• Which source document and page range were processed, and the model used
• The block statistics of the generated material (how many sections, how many blocks of each type) and the list of issues found during validation

⚠️ If you attach media to a material: the title, description and address of the YouTube links you provide and the images and audio recordings you upload are placed into the generation prompt and sent to Google Gemini. The audio file itself (its content) is not sent — only its address and the title/description you wrote.

⚠️ Images and audio files you upload are stored in a publicly readable storage area. Even if your material is private, anyone who knows the file address can access it. Do not upload personal or sensitive images or audio, and do not upload another person’s voice without their consent — a voice recording is personal data belonging to the speaker.

⚠️ If you search for an image: the query you type (by default the topic title you selected) is sent to Wikimedia Commons. Your identity, account details and documents are not sent; the image you pick is copied into our own storage, and its author and licence are shown in the material.

Why we keep it: to produce the material and correctly count your entitlement (§2.1); to diagnose generation failures (§2.3).

Account deletion: when you delete your account, these records and the image/audio files you uploaded are deleted.

1.2d Study Material Progress (Position) Records

While you study a material, where you left off is saved to your account:

• The section number you stopped at
• Marks for the exercise blocks you attempted and the sections you viewed

⚠️ Your answers and your correct/incorrect results are NOT kept. What you answered, how many you got right, and how long it took are written nowhere. Materials have no points, scores or exam results; what is stored is not knowledge but position.

Why we keep it: so you can continue where you left off, and resume from the same place when you switch devices (phone → web) (§2.1).

Account deletion: when you delete your account, these records are deleted.

1.3 Payment and Billing Information

• Payment amount, currency, billing period, payment status, coupon usage
• Last 4 digits of card, card type and family
• Turkish ID Number (T.C. Kimlik No) — collected and stored at the time of payment as required for issuing electronic invoices (e-Archive) and under Law No. 5549 (MASAK / anti-money-laundering) obligations.
• Billing address (province/district) — collected to issue e-Archive invoices under Turkish Tax Procedure Law.
• Saved card information for auto-renewal — to enable automatic renewal of your subscription, your card is stored in tokenized (encrypted key) form at iyzico.
• Full card numbers, CVV, and expiry dates are NOT stored by Vorinfo. These are processed by iyzico’s PCI DSS-compliant infrastructure.

1.4 Technical Data

• IP address (for transaction security, fraud prevention, and payment verification)
• Device type, operating system, device model
• App version
• Session information and timestamps

1.4a Advertising and Device Identifiers (Android only)

• Google advertising identifier (Android: GAID)
• IP address (for ad serving and fraud prevention)
• Device brand, model, and OS version

This data is processed only on Android devices, during rewarded-ad display, by Google AdMob for ad serving, reward verification (Server-Side Verification), and click-fraud prevention. (iOS ads are not currently active.) You may reset your advertising identifier or opt out of personalized ads via device settings.

1.5 Communication Records

• Support requests and messages
• Feedback forms
• Subscription cancellation reason and description (optional)

1.5b Content Report Records

• Reporter’s identity (set to an anonymous audit record when the account is deleted)
• Reported content ID and type (quiz, story, info card, playlist)
• Report reason category (spam, violence, sexual content, copyright violation, hate speech, other)
• Optional description text (max 500 characters)
• Timestamp and review status

This data is processed to identify and act on Community Guidelines violations. Report records are accessible only to Vorinfo’s authorized moderation team and are never shared with other users.

1.5c Account Deletion Request Records

When you request account deletion, for auditability we store an irreversible digest (hash) of your email address, the IP address and browser information at the time of the request, and (optionally) your deletion reason. This record is kept to evidence the existence of your deletion request.

2. How We Use Your Information

We process your personal data on the following legal bases and purposes:

2.1 Performance of a Contract (KVKK Art.5/2-c, GDPR Art.6/1-b)

• Creating and managing your account
• Activating subscription packages and managing quotas
• Processing payments
• Providing content creation, sharing, and consumption services
• AI-powered question generation (for this purpose, the PDF content you upload is sent to Google Gemini for processing — see §3)

2.2 Legal Obligation (KVKK Art.5/2-ç, GDPR Art.6/1-c)

• Issuing e-invoices / e-Archives and tax law compliance
• Identity verification under Law No. 5549 (MASAK)
• Consumer law disclosure obligations
• Responding to lawful requests from authorities

2.3 Legitimate Interest (KVKK Art.5/2-f, GDPR Art.6/1-f)

• Platform security and fraud prevention
• Service quality improvement, performance monitoring
• Anonymous usage statistics and analytics
• Measuring and improving the accuracy of the page suggestion calculation (§1.2a)

2.4 Explicit Consent (KVKK Art.5/1, GDPR Art.6/1-a)

• Marketing and campaign notifications
• Personalized content recommendations

Giving consent is fully optional and can be withdrawn at any time.

3. Sharing with Third Parties

We share your personal data only with the following parties, for specific purposes:

We do not sell or rent your data to third parties for marketing purposes. In AI-powered question generation, the PDF content you upload is processed solely to generate the relevant questions; this content or its output is not used for advertising or profiling.

4. International Data Transfers

Among our service providers, Supabase’s servers are located in Germany (EU), while the servers of Google and Brave Software Inc. are in the USA. Jina AI GmbH, which we use to extract web page text during document generation, is established in Germany (EU); the company has been part of Elastic N.V. since October 2025 and its data processing is governed by Elastic’s data processing terms. Pursuant to KVKK Article 9, effective September 1, 2024, international data transfers are carried out via the appropriate one of the following mechanisms:

• Transfer to a country with an adequacy decision by the KVKK Board, or
• Provision of appropriate safeguards — a Standard Contract executed and notified to the KVKK Authority within 5 business days, Binding Corporate Rules (BCR), or a Letter of Undertaking, or
• The incidental-case exceptions provided under the Law.

Vorinfo conducts its international transfers under the appropriate safeguards of KVKK Article 9; the transfers are subject to the service providers’ applicable data processing agreements (DPAs), and the required Standard Contract and KVKK Authority notification processes are being completed. Explicit consent is not used as a standalone legal basis for continuous international transfers.

Generate Material: the page slice of the topic you select, and the title, description and address of any media you attach (image, audio, video), are also sent to Google Gemini (USA) (§1.2c). If you search for an image, only the search query goes to the Wikimedia Foundation (USA) (§1.2c).

5. Data Retention Periods

Upon your account deletion request, after a 7-day cancellation window your account is permanently deleted; data linked to your identity is deleted or anonymized. Records that must be legally retained (payment/invoice records — tax law) are kept with the identity link severed. Data with expired retention periods is deleted, destroyed, or anonymized through periodic processes.

6. Children’s Privacy

Vorinfo is designed for users aged 13 and over. We do not knowingly collect personal data from children under 13 (GDPR Article 8 and applicable child-protection principles).

For users aged 13-18, the service is assumed to be used with parental/guardian awareness and consent; parents may contact us at the address listed in §11 to request deletion of their child’s data.

If we learn that an account was created accidentally by a child under 13, that account will be deleted immediately.

7. Your Rights

7.1 KVKK Article 11 Rights (Turkey users)

1. Learn whether your data is being processed
2. Learn the purposes of processing and whether they are used appropriately
3. Know the third parties to whom data has been transferred domestically or abroad
4. Request correction if incomplete or inaccurate
5. Request erasure or destruction (KVKK Art.7)
6. Request that corrections/erasures be notified to third parties
7. Object to results arising solely from automated analysis
8. Claim damages for unlawful processing

7.2 GDPR Rights (EU users)

• Right of access (Art.15)
• Right to rectification (Art.16)
• Right to erasure / “right to be forgotten” (Art.17)
• Right to restriction of processing (Art.18)
• Right to data portability (Art.20)
• Right to object (Art.21)
• Right not to be subject to automated decision-making (Art.22)
• Right to lodge a complaint with a supervisory authority

7.3 How to Exercise Your Rights

• You can start an account deletion request directly from the Account settings in the app; the request is processed after a 7-day cancellation window.
• For other requests, write to the contact address listed in §11.
• Your requests will be answered within 30 (thirty) days, free of charge (KVKK Art.13). If the process requires an additional cost, the fee set by the Board may be charged.

8. Data Security

• Encrypted data transmission with TLS
• Database row-level access control (Row Level Security)
• JWT-based authentication (sign-in via Google/Apple OAuth; no passwords stored)
• Payment data on PCI DSS-compliant infrastructure (iyzico)
• Regular security assessments
• Access logs and audit records

In the event of a data breach, we will notify the KVKK Authority as soon as possible and within 72 hours and inform affected users as required.

9. Cookies and Similar Technologies

The Platform uses only essential cookies/local storage for session management, authentication, and core functionality. No analytics or marketing cookies, and no third-party tracking/analytics scripts, are used on our website or in our app. The advertising identifier is used only for ad serving in the Android app (see §1.4a).

10. Changes

This Privacy Policy may be revised in line with legal changes or updates to our data processing operations. The current version is always published on this page. Material changes will be announced at least 30 (thirty) days in advance via email and/or in-app notification.

11. Data Controller and Contact

Data Controller: VORİNFO BİLİŞİM TEKNOLOJİLERİ A.Ş. Address: Küçükbakkalköy Mah. Selvili Sk. No: 4 İç Kapı No: 20, Ataşehir/Istanbul MERSIS: 0925125127200001 Phone: 0531 610 0681 KEP: [KEP_ADRESI] Web: https://vorinfo.com