Policy version 2.1 · Effective: 5 November 2026 · Data controller: Ender Soyuince (natural person)
Notice on the Processing of Personal Data
Data controller and contact
ExamLuma is published by Ender Soyuince (a natural person) under the developer name AlazSmartSystems. The data controller is Ender Soyuince. Address: Salihler Mah. Gülkent Sitesi, Ege Caddesi No:162, 35980 Dikili / İzmir, Türkiye. Support: support@examluma.com. KVKK applications: privacy@examluma.com.
Method of collection, purposes and legal grounds
This notice is prepared under KVKK Article 10 and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, separately from consent texts. Data comes from what you enter in the app, electronic app operations, identity and store verifications, and security records. We do not ask for or knowingly process special categories of data (Article 6); do not write sensitive information such as health in your notes and coach answers.
| Data and purpose | Legal ground |
|---|---|
| Account/installation identifier, language, permissions, account recovery; your chosen study/mock exam, date/goal and synchronization information | Performance of a contract, Article 5/2(c) |
| Account linking with an optional linked account name, email and profile image link | Performance of a contract, Article 5/2(c) |
| Your study records, and your answers and times in question sets, so you can track your progress | Performance of a contract, Article 5/2(c) |
| Age group; for ages 13–17, the parent/guardian declaration and your permission records | Providing the service suitably for your age, Article 5/2(c); showing that permissions were obtained, legitimate interests Article 5/2(f) and protection of a right Article 5/2(e) |
| AI coach: personalization, profile, your answers to questions and coach memory | Explicit consent, Article 5/1. For ages 13–17, explicit consent given with parent/guardian approval; not offered under 13 |
| Solving questions from photos: photo, question text read and solution | Explicit consent, Article 5/1. For ages 13–17, with parent/guardian approval |
| Putting the question text read from the photo, after personal information is removed, into the question pool to improve question content | Separate explicit consent, Article 5/1. For ages 13–17, only with parent/guardian approval and your separate checkbox confirming that your parent/guardian allows this use, recorded with the consent. When the account is deleted the text becomes fully anonymous and is no longer personal data |
| Subscription, purchase, credit and refund transactions | Performance of a contract, Article 5/2(c); protection of a right in a dispute, Article 5/2(e) |
| Keeping payment records, with their link to your account removed, after account deletion | Legal obligation, Article 5/2(ç); kept for 10 years under Turkish Commercial Code Article 82 and Tax Procedure Law Article 253, then deleted |
| Your support correspondence (email, account and issue information) | Performance of a contract by answering your request, Article 5/2(c); protection of a right in a dispute, Article 5/2(e) |
| IP, app/device verification, prevention of fraud/unauthorized access and necessary error diagnostics | Legitimate interests, Article 5/2(f); limited to necessary and proportionate security operations that do not prejudice your fundamental rights, and does not cover analytics |
| Optional adult analytics/performance measurement and ad personalization | Explicit consent, Article 5/1 |
| Non-personalized (contextual or restricted) ad display | Performance of the ad-supported service, Article 5/2(c) and legitimate interests, Article 5/2(f) |
| Notification preferences and notification identifier | Performance of your chosen reminder service, Article 5/2(c); this does not replace marketing permission |
| Announcements: notification identifier, language and subscription status for product news and announcements; the record of when you turned them on and off (time, language and app version). Only if you are 18 or older and turn them on in settings | Explicit consent, Article 5/1; you can turn them off in settings at any time. For the record: showing that permission was obtained, legitimate interests Article 5/2(f) and protection of a right Article 5/2(e) |
Your full date of birth, health information, family income or school address are not asked for. The app does not upload contacts, installed apps or browsing history. Google Play processes your card information. You do not have to give explicit consent; if you do not, only the related feature is unavailable, and you can withdraw your consent at any time. Details of the data types are in the Privacy Policy.
Recipients and transfers abroad
| Recipient | Purpose and place of processing |
|---|---|
| Account, storage and security service providers | Account, synchronization, security and running the service; domestic and abroad |
| Artificial intelligence service provider abroad | Coach and photo solutions; abroad |
| Identity, notification and diagnostics service providers | Account access, security, notifications and diagnostics; domestic and abroad |
| Google Play | Purchases, payment and refunds; abroad |
| Advertising and analytics service providers | Suitable advertising and permitted measurement; abroad |
Authorized support/administration staff have access limited to their duties. Information is given to public authorities only as far as an applicable legal request requires. Sharing with advertising/analytics recipients is also explained in the store data declaration.
Basis for transfers abroad
Some of the artificial intelligence, identity/notification/diagnostics, advertising/analytics and infrastructure service providers are abroad. Transfers abroad are made under KVKK Article 9:
- We do not rely on a Board adequacy decision for a country as the basis for a transfer (Article 9/1–2).
- For regular transfers we rely on the standard contract announced by the Board (Article 9/4-c). After the contract is signed, it is notified to the Authority within five business days (Article 9/5). The same safeguards are required for onward transfers (Article 9/8).
- Under the amended Article 9, explicit consent is not a regular route for transfers abroad; it is sought only for occasional (non-regular) cases and after you are informed of the risks, under Article 9/6(a). The coach, photo and other permissions in the app therefore cover the processing of data (Article 5/1); the basis for the transfer is the standard contract.
- We do not make regular transfers to a recipient with whom a standard contract cannot be provided.
We do not promise that data will be kept only in Türkiye or never stored.
For the AI coach, separate, withdrawable explicit consent is obtained in the app. The AI coach does not run without this permission. You can withdraw it in Settings. Language/exam/age group, numerical study and mock exam summaries, topic codes, a structured profile and limited memory, recommendation outcomes and your quick response selections are sent to the coach. A pseudonymous request number is used. Your name, email, phone number, account/device identifier, raw notes and free-text answers are not sent to the model. An artificial intelligence service provider abroad processes the coach request; therefore coach data is transferred abroad.
When solving questions from photos is offered, the photo you submit is sent to an artificial intelligence service provider abroad to prepare the solution. We do not store the photo; the provider may store it temporarily under its own rules. The question text read from the photo and the solution are kept in your history until you delete them or delete your account.
Question pool: The question texts read from photos of adult users and, only with parent/guardian approval, of users aged 13–17 are put into a question pool after personal information is removed, to improve the service and question content. If you are aged 13–17, your texts enter the pool only if, in addition to the parent/guardian approval, you confirm in a separate checkbox that your parent/guardian allows this use; this confirmation is recorded together with the consent. If you delete your account, the link between the texts in the pool and your account is fully removed; the text becomes fully anonymous, stops being personal data and may continue to be used in question content. If you delete a solution or withdraw your photo permission, the related text is not taken into later uses. You can withdraw your photo permission in the privacy section of Settings; this does not automatically delete your history, but you can delete solutions one by one. Include only the question in the photo; do not add names, faces or contact information.
Google Play acts under its own terms for purchases and payment; your card information does not reach us. The information needed to verify a purchase is shared with Google Play within the framework of Article 9 in the same way.
These permissions are not a blanket permission for all transfers by other services.
The coach is unavailable to children under 13. Ages 13–17 require a parent/guardian self-declaration; this is not identity verification by document and does not replace other child protection conditions. Optional collection does not start until your age is known. For children and teens, analytics, performance and session measurement are off; necessary error diagnostics may run once the age is known. Your notification preference applies separately. Declining coach permission does not block your usable local records and statistics.
Retention and deletion
Your account, study, coach, question set and photo records are kept for as long as the purpose of processing continues and you do not delete them, that is, while your account is open; they are not deleted automatically after a set period. Withdrawing coach or photo permission does not delete your history; you can delete photo solutions one by one.
When you apply for verified account deletion, the records tied to your account on our servers are deleted immediately (your account and device records, study and mock exam records, coach, question set and photo records, your remaining credit balance, and notification records); your sign-in account is deleted separately within a short time; account data on this device is also cleared. To show that the deletion took place, a small deletion record that does not carry your identity, together with your request code, is kept for 30 days after the process is completed and then deleted. Overall usage and cost totals that are not linked to your account may remain. When you delete your account, the link between your payment records and your account is removed; the records are kept for 10 years solely for accounting and legal obligations and then deleted. Texts put into the question pool become fully anonymous as described above.
Deleted records may remain in our infrastructure’s automatic restore history for up to 30 days and drop out automatically when that period ends. Google Play payment history and records with analytics, advertising and artificial intelligence service providers are subject to their own retention rules and are not deleted by our account deletion. If a legal obligation or the protection of a right requires it, we may keep the relevant records for the period the law requires (Articles 5/2(ç) and 5/2(e)).
Your rights and how to apply
Under KVKK Article 11, you can learn whether your data is processed, its purposes and whether it is used accordingly, and its domestic/foreign recipients. You can request correction of incomplete/incorrect data; deletion/destruction where the conditions are met, and notification of the operation to recipients. You can object to a result against you arising solely from automated analysis, and request compensation for damage arising from unlawful processing. Your KVKK rights.
Send your application to privacy@examluma.com or to the postal address above. Use your registered email or an application route verified inside your account. Include the information needed for the application and any documents related to the subject; do not share identity documents or payment information on public channels. To prevent unauthorized deletion, we verify your link to the account.
We respond to your request with reasons, in writing or electronically, as soon as possible according to its nature and within 30 days at the latest (Article 13). Applications are free except for a special cost tariff permitted by law. If your application is rejected, the answer is insufficient or no answer is given in time, you can complain to the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your application (Article 14).
To delete your account, use Settings → Delete account and data or the account deletion page. You must cancel your Google Play subscription separately; account deletion does not automatically delete Play’s independent payment history.
