Privacy Policy and Personal Data Notice (KVKK)

Data Controller

Under the Turkish Personal Data Protection Law No. 6698 (“KVKK”), your personal data is processed by the sole proprietorship operating under the MiniZeka brand at the domain childhoodtech.com (“MiniZeka”, “we”), as data controller, within the scope described below.

Personal Data We Collect

The following categories of personal data are processed when you use MiniZeka:

Identity and Contact Information

• Parent/guardian full name
• Child's name and age
• Email address

Account Security Information

• Password (stored only in encrypted/hashed form; no one, including MiniZeka staff, can see your password in plain text)

Child's Educational and Performance Data

• In-game performance data such as games played, completion times, and counts of correct and incorrect answers
• Personalized development reports and recommendations generated from this data by our AI-assisted analysis engine

Transaction Security and Usage Data

• IP address, browser and device information, session/access logs
• General site usage statistics (such as page views; aggregated analytics not intended for individual tracking)

Payment Information (coming soon)

• When paid plans are purchased, payments will be processed directly through the iyzico infrastructure as described below; your card details will never be stored on MiniZeka servers.

Purposes of Processing

Your personal data is processed for the following purposes:

• Creating your MiniZeka membership and providing the service
• Offering personalized, age-appropriate educational content and games for your child
• Generating AI-assisted development analyses and reports
• Operating parent, teacher and (authorized) specialist panels
• In the institutional (Oak / “Meşe”) plan, providing the institution administrator with an aggregated activity summary of the institution's classes
• Ensuring account security and preventing unauthorized access
• Providing customer support and contacting you
• Measuring service quality, improving the service and fixing errors
• Fulfilling legal obligations
• Processing payments once paid membership plans are introduced

Collection Method and Legal Basis

Your personal data is collected electronically and automatically through the registration form, your child's game sessions and general use of the platform.

Your data is processed on the following legal grounds under Articles 5 and 6 of the KVKK:

• Establishment and performance of a contract: processing is necessary to provide the service under the membership agreement
• Explicit consent: processing of your child's data and AI-assisted analysis/report generation rely on the explicit consent you give as parent/guardian when signing up
• Legal obligation: fulfilling obligations arising from legislation
• Legitimate interest: processing basic usage/log data to keep the service secure and prevent misuse

Sharing and Third Parties

Your personal data is shared only to the extent necessary to provide the service, and only with the service providers listed below. These providers act as data processors on behalf of MiniZeka and may not use your data for their own purposes.

• Supabase Inc. — provides the platform's database, authentication and hosting infrastructure. Membership, child profile and game performance data are stored there.
• Hostinger — used for website hosting and email delivery.
• Cloudflare — used to measure basic site usage statistics that do not involve individual tracking (Web Analytics).
• iyzico — (coming soon) the payment institution that will process payments for paid membership plans. Your card details are sent directly to iyzico's secure infrastructure, not to MiniZeka.

Apart from the above, your personal data may be shared with competent authorities only where legally required (court order, request of a public authority, etc.) and to the extent permitted by law. Your data is never sold or rented to third parties for advertising or marketing purposes.

Processing of Children's Data

MiniZeka does not collect data directly from children. The platform is used only through a parent/guardian account; information about the child (name, age, game performance) is entered by the parent or created under the parent's supervision. You, as parent/guardian, give consent to the processing of your child's data when you sign up.

Your child's data can be accessed by your (parent) account and — if you authorize it — the teacher panel your child is linked to. If your child's class is linked to an institution, the institution administrator can also see it in summary form, within the limits described below. You can request deletion of your child's data at any time; see Your Rights Under the KVKK.

Institution Administrator Panel (Oak / “Meşe” Institutional Plan)

If a school or preschool uses MiniZeka with the institutional plan, the institution's administrator can use the institution management panel to see summary activity information about children in the classes of teachers linked to the institution. This view is only an institution-level summary of data the teacher can already see in the class panel; the data of a child the teacher cannot see is not shown to the institution administrator either.

What the institution administrator can see:

• Numbers of teachers, classes and children; number of active children
• Number of games played, total play time, totals of correct and incorrect answers, and breakdowns by day and by game type (development area)
• A child's name, age, last play time and their own summary counts in the class

What the institution administrator cannot see:

• The child's drawings and AI-assisted development reports and comments
• The parent's name, email address, plan information and consent status
• Individual game history; the child's email address

Accounts with more than one child profile (siblings) are excluded from the numbers and lists in the institution panel. If your child's class is linked to an institution, the app shows you this together with the institution's name in the class invitations section. You can end this sharing at any time by leaving the class; you can also reach us through the application method. The institution administrator can no longer access this summary data once the institution's MiniZeka institutional plan ends.

Retention and Data Security

Your personal data is retained for as long as the purpose of processing requires, subject to the limitation periods set by the relevant legislation. When you delete your account, personal data that is not subject to a legal retention obligation is deleted or anonymized within a reasonable time.

We apply reasonable technical and organizational measures, such as access authorization, encryption and regular security reviews, to protect your personal data. Nevertheless, we remind you that no transmission or storage of data over the internet can be guaranteed to be 100% secure.

Cookies

Our site uses strictly necessary cookies to keep your session and basic functions working, and analytics cookies through Cloudflare Web Analytics that collect aggregated usage statistics without individual tracking. You can manage or block cookies in your browser settings; however, some parts of the site may then not work as expected.

Your Rights Under the KVKK

Under Article 11 of the KVKK, as a data subject you have the right to:

• Learn whether your personal data is being processed
• Request information if your personal data has been processed
• Learn the purpose of processing and whether it is used in line with that purpose
• Know the third parties to whom your data is transferred, domestically or abroad
• Request correction if your data is incomplete or inaccurately processed
• Request deletion or destruction of your data under the conditions set by the legislation
• Request that corrections, deletions and destruction be notified to third parties to whom your data has been transferred
• Object to an outcome against you arising from the analysis of your processed data exclusively through automated systems
• Claim compensation if you suffer damage because your data was processed unlawfully

How to Apply

To exercise the rights above, you can send your requests by email to [email protected]. Stating the information that verifies your identity and your request clearly will help us process your application faster. Requests are answered free of charge as soon as possible and within 30 days at the latest, depending on their nature.

Changes

MiniZeka may revise this Privacy Policy and Personal Data Notice in line with changes in legislation or updates to our services. The current text is always published on this page; we will do our best to inform you separately of significant changes.

Questions? [email protected]