1. Data Controller
This Privacy Policy explains how Zenith Solutions / Kıvılcım AI ("we") processes personal data collected while you use the Kıvılcım: Sınav Koçun mobile application ("App"). The data controller is Zenith Solutions. Contact: info@zenithsolutions.ai
2. Data We Collect
We collect the following categories of data:
- Account data: email address, name (optional), password hash, unique user identifier provided by Apple Sign-In / Google Sign-In.
- Profile data: target exam (YKS/TYT/AYT), grade, target programs, study schedule and similar info you enter.
- Usage and product analytics: app open frequency, screens viewed, features used, number of questions solved, mock exam stats, streak days, XP, achievements, and error events.
- Campaign attribution data: campaign name, source, channel, and link parameters (such as UTM) that referred you to the App. We do not combine this data with an advertising identifier.
- Content data: question photos you take or upload, notes you create, prompts you ask, and AI responses.
- Device and technical data: device model, OS version, app version, language, time zone, IP address (during session), unique device identifier (used solely to prevent trial abuse).
- Billing data: subscription status, purchase date, product ID. Credit card information is not stored by us; all payments are processed by Apple App Store / Google Play.
3. How We Use Data
- To create your account, authenticate you, and provide core functionality.
- To send your question photos to AI models and produce solutions.
- To deliver personalized daily plans, weak-topic radar, and recommendations.
- To run motivation features such as streaks, achievements, and leaderboards.
- To verify Premium subscriptions and manage the trial period.
- To debug errors and improve performance.
- To understand which features are useful and evaluate campaign outcomes in aggregate.
- To comply with legal obligations (KVKK, tax, audit).
4. Legal Bases (KVKK Art. 5 / GDPR Art. 6)
- Performance of contract: Data required to provide the Service.
- Legitimate interest: Security, fraud prevention, product improvement.
- Consent: Push notification permission and optional personalization.
- Legal obligation: Tax, accounting, requests from authorities.
5. Third-Party Service Providers
We share data with the following providers only to operate the Service. They cannot use it for their own purposes.
- Supabase (Germany / EU) — user account and database hosting.
- Vercel (Germany / EU / USA) — serverless API hosting.
- Google Gemini (via Vercel AI Gateway) — AI solution and text generation. Content is not used for model training.
- RevenueCat — verification of subscription status and purchase entitlements across app stores. It does not receive credit card details.
- Google Firebase Analytics / Crashlytics — aggregate app usage measurement and diagnosis of crashes and technical errors. We do not collect an advertising identifier or use this data for ad targeting.
- Apple / Google — app store, payments, Apple Sign-In, Google Sign-In.
6. Data Retention
- Data is retained while your account is active.
- Question photos are kept for a maximum of 90 days after a solution is generated.
- Product analytics and campaign attribution events are retained while your account is active for product improvement and security, and are deleted with your account deletion request.
- When you delete your account, all personal data is permanently deleted within 30 days (except where required by law).
- Backups rotate every 90 days.
7. Children's Privacy
The App is not directed at children under 13. If we learn we have collected data from a child under 13, we delete it immediately. Users aged 13-18 should use the App with parental / guardian consent.
8. Data Security
- All traffic is encrypted with TLS 1.2+.
- Passwords are stored as bcrypt / Argon2 hashes.
- The database is protected by Row Level Security (RLS).
- Personnel access is granted on a "least privilege" basis.
9. Your Rights (KVKK Art. 11 / GDPR Art. 15-22)
You have the right to:
- Access and obtain a copy of your data.
- Request correction of inaccurate data.
- Request deletion ("right to be forgotten").
- Request restriction of processing.
- Data portability — receive your data in a machine-readable format.
- Object to processing and withdraw consent.
- File a complaint with the Data Protection Authority (KVKK in Türkiye, or your local DPA).
For requests: info@zenithsolutions.ai. You can also use the Account Deletion page for deletion options and scope. We respond within 30 days.
10. International Data Transfers
Data is primarily stored in the EU. AI requests routed via Vercel AI Gateway may be transferred to servers in the USA; such transfers are protected by Standard Contractual Clauses (SCCs).
11. Cookies and Tracking
The mobile App does not use browser cookies. Only functional keys (session token, preferences) are stored on your device. First-party product analytics are stored in Supabase, while aggregate usage and crash diagnostics are processed through Firebase Analytics / Crashlytics. We do not use third-party advertising or marketing trackers and do not collect an advertising identifier.
12. Changes
This policy may be updated. We will notify you in-app or by email about material changes. The current version is always available on this page.
13. Contact
For all privacy questions and requests to exercise your rights: info@zenithsolutions.ai