Privacy Policy
Last updated: 19 September 2026
Kodpit Teknoloji A.Ş. ("Qedu AI", "we") cares about your privacy. This Privacy Policy explains how we process the personal data we collect through the qedu.ai website, the Qedu AI mobile applications and the web panel (together, the "Service"), who we share it with and what your rights are.
For users located in Türkiye, our information obligation under Law No. 6698 on the Protection of Personal Data ("KVKK") is additionally fulfilled by the KVKK Disclosure Notice. For users located in the European Economic Area, the United Kingdom and Switzerland, additional information under the General Data Protection Regulation ("GDPR") is provided in section 10.
1. Data Controller
| Company | Kodpit Teknoloji A.Ş. |
| Address | Fatih Sultan Mehmet Mah. Balkan Cad. Meydan İstanbul AVM No: 62A Ümraniye / İstanbul, Türkiye |
| [email protected] | |
| Phone | +90 (216) 606 44 47 |
2. Data We Collect
2.1 Data you provide directly
- Account information: full name, e-mail address, password (stored hashed), phone number (optional), language preference.
- Profile information: grade level, target exam (LGS/YKS/KPSS), school or institution name (teachers), profile photo.
- Contact form: name, e-mail, phone, subject and message content.
- Learning content: photos of questions you upload, mock-exam results (PDF), messages you send to the AI assistant and voice recordings.
2.2 Data collected automatically while using the Service
- Usage data: number and duration of sessions, features used, AI token consumption, plans and tests created.
- Device and connection data: IP address, device type, operating system, browser, app version, crash logs.
- Cookies: see the Cookie Policy.
2.3 Data received from third parties
- Payment provider (Paddle): subscription status, transaction ID, billing country. Your card details are never transmitted to us.
- App stores and RevenueCat: store subscription status and renewal information.
- Class invitations: when a teacher invites you to a class, your e-mail address is provided by that teacher.
3. Purposes and Legal Bases
| Purpose | Legal basis |
|---|---|
| Creating your account, verifying your identity and providing the Service | Performance of a contract |
| Generating personalised study plans, solutions and mock-exam analysis | Performance of a contract |
| Managing subscriptions, invoices and payments | Performance of a contract; legal obligation |
| Sharing progress reports with teachers and parents | Performance of a contract; consent (parental consent for users under 18) |
| Security, fraud and abuse prevention | Legitimate interest |
| Responding to support requests | Performance of a contract; legitimate interest |
| Improving the Service and producing anonymous statistics | Legitimate interest |
| Sending marketing e-mails | Consent (withdrawable at any time) |
| Complying with legal obligations (tax, accounting, official requests) | Legal obligation |
4. AI Processing
Qedu AI uses artificial-intelligence models to personalise your learning experience. Your questions, mock-exam results and chat messages are processed by these models. Your personal data is not used to train the general-purpose models of third-party providers. AI output is guidance only and should not be the sole basis for exam or education decisions.
5. Children's Privacy
The Service may be used by children under 13 only under the supervision of a parent or legal guardian. Accounts of users under 18 must be created or approved by a parent/guardian. If you believe a child's data was collected without permission, write to [email protected] and we will delete it promptly.
6. Sharing Your Data
We do not sell your data. We share it only in the following limited cases:
- Service providers (processors): Paddle (payments and Merchant of Record), Mailjet (e-mail delivery), Cloudflare (CDN, security, bot protection), cloud hosting provider, AI model providers, RevenueCat (mobile subscription management), Apple and Google (app stores).
- Teachers and parents: only the teacher whose class you join and the parent who manages your account can see your usage and progress summaries.
- Legal requirements: upon court order or request of a competent authority.
- Business transfer: in a merger or acquisition, in line with this policy.
7. International Transfers
Some of our service providers are located outside Türkiye (EU, UK, USA). Transfers are carried out under KVKK Article 9 based on your explicit consent, adequacy decisions or standard contracts approved by the Turkish Data Protection Board, and under the GDPR based on Standard Contractual Clauses.
8. Retention
| Data | Period |
|---|---|
| Account and profile data | While the account is active; deleted/anonymised within 30 days of a deletion request |
| Invoice and payment records | 10 years as required by tax law |
| Contact form messages | 2 years |
| Usage and token statistics | For the life of the account; anonymised afterwards |
| Server logs | 6 months |
9. Security
Your data is encrypted in transit with TLS; passwords are stored with one-way algorithms (Argon2id). Access is role-based and audited. In the event of a data breach we notify the relevant authorities and affected users within the legal deadlines.
10. Additional Information under the GDPR
If you are located in the EEA, the UK or Switzerland you have the following rights: access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent. You may also lodge a complaint with your local data protection authority. Send requests to [email protected]; we respond within 30 days at the latest.
11. Your Rights
Your rights under KVKK Article 11 are described in detail in the KVKK Disclosure Notice. You can delete your account and download your data in JSON format from the Security page of the web panel.
12. Changes
We may update this policy. We announce material changes by e-mail or in-app notification. The current version is always published on this page.