Privacy Policy

1. Data Controller

The organization designated as "Data Controller" in this Privacy Policy is UĞUR ÇELİK 7BİTBİTES E TİCARET VE YAZILIM ("Cardely"). For any questions or requests regarding your personal data, you may contact us by sending a message to iletisim@cardely.app.

2. Personal Data We Collect

When you use the Cardely platform, the following personal data is collected:

• Account Information: Email address, encrypted password, username
• Profile Information: Chosen profile image and biography (optional)
• Usage Statistics: Created decks, study history, session information
• Upload Information: PDF files and texts you upload to the Platform
• Technical Data: IP address, device type, browser information, site visit timestamps
• Notification Data: Device notification token for push notifications (Firebase Cloud Messaging)

Please note: PDF files you upload are not permanently stored on our servers. For the purpose of generating flashcards, files are temporarily transmitted to Google's Gemini API; after processing is complete they are deleted from Cardely's systems. For information on how Google handles this data, please refer to the Google Privacy Policy.

3. Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

• Account creation and management
• User authentication and account security
• Providing application services (deck creation, sharing, study tracking)
• Technical support and customer service provision
• Platform development and improvement
• Fulfillment of legal obligations
• Ensuring transaction security and preventing misuse

4. Legal Basis

The processing of your personal data is based on the following legal grounds under the Turkish Personal Data Protection Law (KVKK) Article 5:

• Performance of the contract for account and service management (Article 5/2-a)
• Your explicit consent (Article 5/2-c)
• Cardely's legitimate interests (platform security, abuse prevention) (Article 5/2-f)
• Legal obligations (Article 5/2-e)

5. Data Retention and Deletion

Your personal data is retained for the following periods:

• While your account is active: For as long as necessary to provide the service
• When your account is closed: Deleted within 30 days (excluding legal obligations)
• Technical data: Retained for a maximum of 1 month
• Legal disputes: May be retained until the legal statute of limitations expires

To delete your account, visit our account deletion page or send a request to iletisim@cardely.app.

6. Your Rights (KVKK Article 11)

Under the KVKK, you have the following rights:

• Right to Access: To learn whether data about you is being processed and for what purposes
• Right to Rectification: To request correction of inaccurate or incomplete data
• Right to Erasure: To request deletion of your data (subject to legal limitations)
• Right to Restrict Processing: To request suspension of data processing
• Right to Object: To object to processing based on legitimate interests
• Right to Data Portability: To receive your data in a transferable format to another organization

To exercise these rights, please send a written request to iletisim@cardely.app. We will respond to your request within 30 days.

7. Cookies and Analytics

Cardely uses technical cookies to manage user sessions and provide basic functionality. These cookies include:

• Session Cookies: Saving your login information and session management
• Preference Cookies: Language selection and appearance preferences

Platform usage data is retained solely on server logs for the purpose of improving the service. For details on the third-party services we use, please refer to Section 8 below.

If you wish to disable cookies, you can do so in your browser settings. However, this may affect some of the platform's functionality.

8. Third-Party Services

Cardely makes use of the following third-party services. These services may process data under their own privacy policies.

8a. Google Gemini (AI Processing)

PDF and text files you upload are temporarily transmitted to Google's Gemini API in order to generate flashcard suggestions. Files are deleted from Cardely's systems after processing is complete. For Google's data handling practices, please see: policies.google.com/privacy

8b. Firebase Cloud Messaging (Push Notifications)

We use Google's Firebase Cloud Messaging (FCM) service to deliver push notifications to iOS and Android devices. FCM generates a notification token for your device; this token is stored by Cardely and shared with Google/Firebase solely for the purpose of delivering notifications. You can disable notifications in your device settings. For Firebase privacy information, please see: firebase.google.com/support/privacy

8c. Google AdMob (Advertising)

We use Google AdMob to display advertisements in our mobile app. AdMob may collect advertising identifiers (IDFA on iOS, GAID on Android), device information, and usage data for the purposes of ad targeting and measurement. To opt out of personalized ads:

• iOS: Settings → Privacy & Security → Apple Advertising → Turn off Personalized Ads
• Android: Settings → Google → Ads → Opt out of Ads Personalization

For AdMob privacy information, please see: policies.google.com/privacy

8d. Google Firebase Analytics (App Analytics)

We use Google Firebase Analytics to collect aggregated, anonymized usage data such as app sessions, feature interactions, and crash reports. This data is used to improve the application. Firebase Analytics may share usage data with Google and can integrate with Google's advertising infrastructure. To opt out of analytics collection:

• iOS: Settings → Privacy & Security → Tracking → Disable "Allow Apps to Request to Track"
• Android: Settings → Google → Ads → Opt out of Ads Personalization

For Firebase Analytics privacy information, please see: firebase.google.com/support/privacy