Privacy Policy
Last updated:
1. Controller
TURUNCU KATMAN YAZILIM VE TEKNOLOJİ ANONİM ŞİRKETİ ("Company")
- Address: Bahçesaray Mah. 135 / Necmettin Erbakan Bul. B Blok No: 129/1, 68100 Merkez / Aksaray, Türkiye
- Trade registry no. 15243 (Aksaray) · MERSİS 0872160780200001
- Contact: iletisim@turuncukatman.com.tr
This policy explains how the Skorlo mobile app ("App") processes personal data under the EU General Data Protection Regulation ("GDPR") and the Turkish Personal Data Protection Law No. 6698 ("KVKK"). The App is for teachers and academics and is not directed at anyone under 18.
2. Summary
- Your classes, students (name, ID, phone), exams, scores and page images are stored only on your phone; they are not sent to us.
- Our server holds only your account (sign-in with Apple, Google or email) and its session security records, your credit balance and your credit and purchase records. You can use classes and written grading without an account.
- Bubble-sheet reading happens entirely on the phone; the image is never sent anywhere.
- AI reading of written exams and class lists from photos is optional and needs your separate consent: then the page image (with the name/ID strip cut off on the phone) and the question texts, or the photo of the list, are sent to Google's Gemini AI. Our server does not store the image or text.
- Payments are processed by Apple and Google; we never receive your card details. There are no ads.
3. Data processed on our server
| Data | Purpose | Legal basis |
|---|---|---|
| Account ID, email address (Apple's relay address if you chose "Hide My Email"), the name shared when you sign in with Apple or Google (Google also provides a profile photo link; the app does not use it), sign-in method, sign-in times | Creating the account and signing in | Contract (GDPR Art. 6(1)(b)) |
| Credit balance and credit movements (type, amount, time; keyed by the random ID of the exam on your phone — no content) | Keeping and charging credits, never charging the same exam twice | Contract |
| Purchase records (store transaction ID, product, credits, price, currency, platform) | Adding credits, removing them on refunds, bookkeeping | Contract; legal obligation (Art. 6(1)(c)) |
| Pre-purchase information acceptance (product, price text, text version, language, platform, app version, time) | Proof that pre-contract information was given | Legal obligation |
| AI request log (random request ID, type, status, amount of processing — NO image or text) | Never charging a page twice, abuse and cost limits | Contract; legitimate interest (Art. 6(1)(f)) |
| One-way salted hash of your sign-in identity and email | Not giving the welcome credits to the same person twice | Legitimate interest |
| Session records: IP address, device/app information (user agent), when the session was created and refreshed | Keeping you signed in, account security and abuse prevention | Legitimate interest; deleted when the session ends or the account is deleted |
The server runs on Supabase Inc. infrastructure in the European Union (Frankfurt, Germany). Sign-in code emails are delivered through Resend (section 6).
4. Data kept on your phone (not sent to us)
| Data | Purpose |
|---|---|
| Classes and students (full name, student ID, optional phone number and whose phone it is) | Matching papers to students, sharing results |
| Exams, answer keys, questions and rubrics | Reading and grading |
| Bubble-sheet results, written exam page images, grading decisions, notes, score change history | Grading, appeals and review |
| AI suggestions and transcriptions (if you used AI) | Showing suggestions while grading |
| Settings (language, name, paper size, country, time of AI consent) | Running the app the way you chose |
For the student data in it, you (or your institution) are the controller, as the person who enters it into the App; make sure you are authorised to process your students' data and that you follow your institution's rules. When you share a result through WhatsApp or another app, the sharing happens from your phone under that app's terms; the Company sends no messages.
5. AI reading of written exams and class lists from photos (optional)
- It runs only when you start it and after you gave separate consent on first use; you can withdraw consent in Settings.
- Sent: the page image (the name/ID strip of the first page — or of every page, per your setting — is cut off on the phone), question labels and texts, expected answers, rubric items and the transcribed answer text. Personal details a student wrote inside an answer may still be in the image.
- For a class list from a photo, sent: the photo of the list you take or pick (student names and IDs, plus anything else written on the list). The names and IDs read return to your phone; you see and correct them before they are added to the class.
- The request passes through our server function (Frankfurt) to Google's Gemini API (Google LLC, paid service). Google does not use this data to improve its models; it keeps it for a limited period (up to 55 days) solely to detect abuse. Our server does not store the image or text; the result returns to your phone.
- For student data in this processing, the Company acts as processor on your behalf, with Google as sub-processor. Google's servers are outside the EU/Türkiye: transfers follow the GDPR's international transfer rules (including Standard Contractual Clauses) and KVKK Art. 9.
- AI reading is unavailable in some countries. Suggestions and names read can be wrong; you always set the score and check the list before adding it.
6. Other third parties
| Service | Data | Purpose | Legal basis |
|---|---|---|---|
| Apple App Store / Google Play | Purchase transaction (your store account) | Payment | Contract |
| RevenueCat, Inc. (USA) | Account ID (random), purchase information, device and platform information, store country | Verifying purchases and adding credits | Contract |
| Sign in with Apple / Google | Sign-in identity, email, name (and a profile photo link with Google) | Signing in | Contract |
| Resend (Resend, Inc.; USA, sent from the EU, Ireland) | Email address and sign-in code | Sending the code for email sign-in | Contract |
| Sentry (Functional Software, Inc.; data stored in the EU, Germany) | Error reports: app version, device model, account ID and installation ID (random); emails and long digit strings are masked, no student names and no screen recordings | Finding and fixing errors | Legitimate interest |
| Expo (650 Industries, Inc.; USA) | App update checks: random installation ID, app and operating system version, IP address | Delivering app fixes | Legitimate interest |
The servers of RevenueCat and Expo are outside the EU/Türkiye, and Resend is a US company; transfers follow the GDPR's international transfer rules and KVKK Art. 9. Your student and exam data are not shared with any of these services.
7. Backups and changing phones
If iCloud backup on iPhone or Google's automatic backup on Android is on, the operating system may include the App's data in your own backup (on Android only the database and settings; page images are excluded). Those backups are held by Apple or Google under your account; we cannot access them. The .skorlo file you create with Export backup contains student data; you decide where to keep it.
8. Retention
- Account data is kept until you delete your account.
- AI request logs are deleted after 90 days.
- Purchase, credit and pre-purchase acceptance records are kept for the statutory periods (e.g. 10 years for commercial books and records); they are unlinked from you when you delete your account.
- The welcome-credit trace (salted hash) is kept after account deletion; it does not reveal your name or email.
- Data on your phone stays until you delete it or uninstall the App.
9. Deleting your account
Delete your account immediately in the App under Settings → Account → Delete account. If you cannot reach the App, follow the steps on the support page.
10. Your rights
You have the right to access, rectify, erase and port your data, to restrict or object to processing, and to withdraw consent at any time. You directly control the data on your phone.
Contact iletisim@turuncukatman.com.tr; we respond within 30 days. You may also lodge a complaint with your local data protection authority (in Türkiye, the Personal Data Protection Board).
11. Changes
When we update this policy we announce it on this page, and in the App for significant changes.