This policy explains how personal data is processed through the Kambvi mobile app (Android, iOS) and kambvi.com (together, "Kambvi") under Turkey's Personal Data Protection Law No. 6698 ("KVKK"). The Turkish version is the legally binding text; this English version is provided for convenience and has the same content.
1. Data controller
- Data controller
- Ahmet Yıldıran (sole proprietor) — Kambvi
- kambvii@gmail.com
- Phone
- +90 543 917 00 08
- Address
- Uğur Outlet Center, Değirmiçem Mah., Nail Bilen Cd. No:5 Kat:2 İç Kapı No:68, 27090 Şehitkamil / Gaziantep, Türkiye
2. In short
- No ads; no advertising identifier is collected and we do not track you across apps.
- Your personal data is not sold, rented or shared with third parties for marketing.
- Live lessons are not recorded; no video or audio is stored.
- We do not collect or store card details.
3. Personal data we process
All users
- Identity and contact: full name, email address, phone number.
- Account: password (never in plain text; stored with irreversible hashing); when you sign in with Google or Apple, the account identifier and email address of that account (with Apple's "Hide My Email", the relay address provided by Apple); language preference.
- Messages: messages you send to our support team and your in-app notifications.
Students
- Optional profile description and interests.
- Lesson records: teacher, date, time, lesson topic, lesson link, lesson status (cancelled, disputed).
- Ratings and reviews you give after a lesson (shown on the teacher's profile and on the kambvi.com landing page with your name shortened, e.g. "Ayşe Y.").
- Balance and balance transactions (top-up, lesson payment, refund, welcome credit), private package and Speaking Club participation.
Teachers
- Area of expertise, experience, profile description; optional profile photo and intro video.
- Availability calendar, lessons given and earnings records.
Technical data
- Sign-in records: time of sign-in, IP address, city/country estimated from the IP address, browser and device type. We never ask for your device's location permission; location is only roughly estimated from the IP address and used for sign-in security.
- Last-seen time (so that a teacher can appear "online").
- A session token stored on your device to keep you signed in.
We do not access your contacts, SMS, call logs or other files on your device. We do not collect special categories of personal data such as health, religion or biometrics; please do not enter such information in description or topic fields.
4. App permissions
- Camera and microphone: only to transmit video and audio during a live lesson. Lessons are not recorded.
- Photo and video picker: only for a teacher to upload a profile photo or intro video.
- Notifications: reminders 1 day, 1 hour and 30 minutes before a lesson; reminders are scheduled on the device.
- Alarms and reminders (Android): so that reminders arrive on time.
- Internet: to communicate with our server.
5. Payment and balance data
We store the balance transactions in your account (amount, date, description) and lesson payments. No card payments are taken in the mobile app. For transactions on the website, card details are processed on the licensed payment institution's own page; the card number, expiry date and security code never reach us — we only store the amount, order number and result.
6. Purposes and legal bases
- Creating your account, sign-in and authentication; lesson booking, calendar, lesson link, balance and payment operations — performance of a contract (KVKK Art. 5/2-c).
- Lesson reminders, balance and account notification emails, answering support requests — performance of a contract (Art. 5/2-c).
- Service-related information emails (e.g. a welcome email after signing up in the mobile app; when your balance is not enough for a lesson, at most one reminder per 24 hours) — legitimate interest (Art. 5/2-f).
- Showing teachers you have taken lessons with as "Book again" on your home page — performance of a contract (Art. 5/2-c).
- Sign-in security, preventing abuse and fraud (e.g. making sure the welcome credit is not given to the same person twice) — legitimate interest (Art. 5/2-f).
- Record-keeping obligations under tax and commercial law — legal obligation (Art. 5/2-ç).
- Optional profile photo, video, description and interests — explicit consent (Art. 5/1); you can delete these fields at any time.
Your data is not used for any other purpose, and no automated decisions are made by profiling.
7. Sharing of data
Your personal data is shared only as far as needed to provide the service, with:
- Our hosting provider (server and database, Türkiye).
- Video call infrastructure (Jitsi-based; video, audio and your display name during a lesson).
- Email delivery service (Google; lesson reminder and notification emails).
- Google (authentication, if you use Sign in with Google).
- Apple (authentication, if you use Sign in with Apple; when you delete your account, the Apple sign-in authorization is also revoked).
- A licensed payment institution (only for card transactions on the website).
- The other party of a lesson (teacher or student: name, lesson date and topic).
- Competent public authorities (when required by law).
The servers of the video call and email services may be located abroad; this transfer is necessary to provide the service and is carried out under KVKK Art. 9.
8. Retention periods
- Account data: as long as your account exists.
- Payment, balance and lesson records: for the period required by tax and commercial law (up to 10 years).
- Sign-in records (IP, device): up to 12 months.
- After account deletion: full name, phone number, profile details, photo and video, support messages and notifications are deleted within 30 days at the latest.
- Email address and phone number: kept after account deletion only to prevent the welcome credit from being given to the same person again.
9. Deleting your account
You can delete your account in the app or on kambvi.com via Profile → Close Account → Delete My Account (in the app: Profil → Hesabı Kapat → Hesabımı Sil), or by emailing kambvii@gmail.com with the subject "Account Deletion Request". Details: Account and data deletion (Turkish).
10. Data security
All communication uses an encrypted connection (HTTPS); passwords are stored with irreversible hashing; sessions are managed with signed, time-limited tokens; only authorised people can access data, as their duties require. In the event of a data breach, the Personal Data Protection Board and affected users are notified within the legal period.
11. Children
Kambvi is not intended for anyone under 18. Users under 18 may only open an account with the consent of a parent or legal guardian; if an account without consent is noticed, its data is deleted. To report one: kambvii@gmail.com.
12. Cookies
No advertising, analytics or third-party tracking cookies are used. Only the session information required to keep you signed in is stored on your device/browser.
13. Your rights (KVKK Art. 11)
You have the right to learn whether your data is processed, to request information about it, to learn its purpose and whether it is used accordingly and the third parties it is transferred to, to request its correction, deletion or destruction and that these are notified to the recipients, to object to a result against you arising from automated analysis, and to claim compensation for damage caused by unlawful processing. Send your requests to kambvii@gmail.com or to the address above; they are answered free of charge within 30 days at the latest. If you are not satisfied with the answer, you may complain to the Personal Data Protection Board.
14. Changes
This policy may be updated; the current version is always published at this address and the "Last updated" date changes. You will be informed separately of material changes.