Privacy Policy
This policy explains what personal data 4S Gump collects, why, who processes it, how long it is kept, and the rights you have under the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where it applies, the EU General Data Protection Regulation (GDPR). We wrote it to match what the app actually does; if the app changes, this policy changes with it.
1. Who is responsible for your data
The data controller is Pelik Eğitim ve Danışmanlık Ltd. Şti., a company registered in Türkiye ("we", "us"). For any question or request about your data, write to admin@4sgump.com.
2. What data we collect, and why
| Data | Where it comes from | Why we use it | Legal basis |
|---|---|---|---|
| Account data: email address, password (stored only as a hash), or the identifier returned by Google or Apple if you sign in with them; your display name | You, at sign-up | Creating and securing your account, signing you in, sending sign-up confirmation and password-reset emails | Performance of the contract (KVKK Art. 5/2-c; GDPR Art. 6/1-b) |
| Profile photo (optional) | You, if you choose to add one | Shown on your own Account and Edit Profile screens only; no other user can see it | Your consent, which you can withdraw by removing the photo (KVKK Art. 5/1; GDPR Art. 6/1-a) |
| Learning preferences: chosen exam, exam date, target score, current level, onboarding status, text-size setting | You | Showing the right exam content and tracking your goal | Contract |
| Practice data: your written answers, quiz answers, transcripts of your spoken answers, scores, AI feedback, progress and mock-exam results, remediation drills already shown to you | Generated as you use the app | Scoring, feedback, your progress dashboard, restoring your progress on a new device, choosing follow-up drills | Contract |
| Voice recordings of your speaking answers | Your microphone, only when you press record | Transcribing what you said and scoring pronunciation; producing feedback | Contract. The recording is sent to the processors in section 4 for this purpose only |
| Tutoring questions: the text you submit in the Tutoring tab. If you pick a photo to illustrate a question, it stays on your device — today the app does not upload it | You | Answering your question | Contract |
| Booking a lesson: when you tap “Book a lesson”, your own email app opens with a message addressed to our tutor. Nothing is sent until you send it, and we receive only what you write | You | Arranging a one-to-one lesson | Contract |
| Purchase data: subscription status, product bought, dates, an anonymous RevenueCat customer id; never your card number | Apple App Store / Google Play via RevenueCat | Unlocking what you paid for, restoring purchases, handling renewals and refunds | Contract; legal obligation for accounting records |
| Technical data: request logs on our servers (time, endpoint, user id, error messages) and per-user rate-limit counters | Automatic | Keeping the service running and secure, preventing abuse of the AI features | Legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6/1-f) |
We do not use advertising SDKs, third-party analytics, or a crash-reporting vendor. We do not sell personal data, and we do not use your recordings or answers to train AI models.
3. Where your data is stored
Your account, preferences, practice data, tutoring questions and profile photo are stored with Supabase, our hosting provider, in its EU West (Ireland) region. Generated listening audio, chart images and model-answer videos are stored with Cloudflare R2 and served to you through short-lived signed links.
4. Who processes your data for us
These providers act on our instructions and only for the purpose stated. All connections use HTTPS, and vendor credentials never leave our servers.
| Provider | What they receive | Purpose | Location |
|---|---|---|---|
| Supabase | Everything in section 3 | Database, authentication, file storage, server functions | Ireland (EU) |
| Deepgram | Your voice recording | Speech-to-text transcription | United States |
| Microsoft Azure Speech | Your voice recording and the text you were asked to say | Pronunciation assessment | Norway East (EEA) |
| Microsoft Azure OpenAI | Your written answer or the transcript of your spoken answer, with the task | Generating feedback and scores | ‹OWNER: confirm Azure OpenAI region› |
| Google Cloud Text-to-Speech | Exercise text only, not your personal data | Generating audio for prompts and model answers | Google Cloud |
| Cloudflare R2 | No personal data; media files | Serving audio, images and video | Global edge network |
| RevenueCat | Purchase receipts and an anonymous customer id | Subscription management | United States |
| Apple App Store / Google Play | Your payment; handled entirely by them | Billing | Per their own policies |
| Google / Apple sign-in | Your choice to sign in with them | Authentication | Per their own policies |
5. International transfers
Some processors are outside Türkiye and the EEA (Deepgram and RevenueCat in the United States). We transfer data to them only as needed for the purposes above, under written data-processing terms and, for GDPR, the European Commission's Standard Contractual Clauses or an adequacy decision. For KVKK, transfers abroad rely on your explicit consent given during sign-up or on the safeguards permitted by Article 9; ‹OWNER: lawyer to confirm the KVKK Art. 9 mechanism used›.
6. How long we keep data
- Account, preferences, practice data, progress, tutoring questions, profile photo: until you delete your account. The in-app Account → Delete account action removes the account and the data linked to it from our systems; backups are overwritten within ‹OWNER: backup retention, e.g. 30 days›.
- Voice recordings: sent for transcription and scoring, then not retained by us beyond the session; the transcript and score are kept as practice data. Processors keep audio only as long as their terms require for processing.
- Purchase records: for as long as required by tax and accounting law.
- Server logs and rate-limit counters: counters are purged after 24 hours; logs are kept for ‹OWNER: log retention, e.g. 30 days›.
7. Your rights
Under KVKK Article 11 and, where it applies, GDPR Articles 15–22, you may ask us: whether we process your data and for a copy of it; to correct it; to delete it; to restrict or object to processing based on our legitimate interests; to receive the data you gave us in a portable format; and to withdraw consent at any time without affecting earlier processing. You may also complain to the Turkish Personal Data Protection Board (KVKK Kurulu) or, in the EU, to your local supervisory authority.
To exercise a right, email admin@4sgump.com from the address on your account, or use the in-app Delete account action. We answer within 30 days (KVKK) or one month (GDPR), free of charge unless a request is clearly excessive.
8. Security
Data is encrypted in transit (TLS) and at rest by our hosting provider. Access is limited by row-level security so that you can only reach your own rows; server functions verify your session before doing anything; vendor API keys live only on our servers, never in the app. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.
9. Children
4S Gump is not directed at children under 13, and we do not knowingly collect their data. The app's store age rating is ‹OWNER: age rating›. If you believe a child has created an account, contact us and we will delete it.
10. Changes
We may update this policy when the app or the law changes. The effective date at the top tells you the current version; material changes are announced in the app.
11. Contact
Pelik Eğitim ve Danışmanlık Ltd. Şti. · admin@4sgump.com