Privacy Policy
This is an English translation for convenience. The Turkish Gizlilik Politikası ve KVKK Aydınlatma Metni is the binding version.
This policy explains how your personal data is processed when you use the Studio EA mobile app (the “App”), under Turkey's Personal Data Protection Law No. 6698 (“KVKK”).
1. Data controller
Your personal data is processed by Eda Aktaş Korol (“EA Studio”, “we”) as the data controller.
- Address
- Koşuyolu Cd. No: 24, Kartaltepe, 34145 Bakırköy, Istanbul, Türkiye
- [email protected]
The App is developed and operated on EA Studio's behalf by Velqor (velqor.io), which processes your data only on EA Studio's instructions, as a data processor.
2. What we process
| Data | Examples | Source |
|---|---|---|
| Identity and contact | Full name, email address | You, when you sign up; Google or Apple, if you sign in with them |
| Account and security | User ID, sign-in method, a one-way hash of your password (the password itself is not stored), sign-in records and IP address | Your use of the App |
| Exercise history | Lessons you watched, where you stopped in a lesson, lessons you completed and saved | Your use of the App |
| Subscription | Your Premium subscription's status, plan, start and renewal dates, store transaction ID. Your card details never reach us; the App Store or Google Play takes the payment. | When you subscribe, through the App Store / Google Play and RevenueCat |
| Device and notifications | A device token for sending notifications, platform (iOS/Android) | When you allow notifications |
| Usage and diagnostics | Screens opened, sign-in/sign-up events, app version, device model and operating system, approximate country; crash reports | Collected by the App automatically |
We do not ask for health information. The App does not ask for diagnoses, complaints or treatment details. Which section's lessons you watch (for example “Bel Fıtığı”, herniated disc) may still hint at a health condition. These records are kept in your account only to show you your progress; the name of the section or lesson you watch is not sent to analytics tools, and these records are not used for advertising or profiling.
We do not process card or payment details, location, contacts, camera or photo data. The App has no ads and your data is not sold.
3. Purposes and legal bases
| Purpose | Legal basis (KVKK art. 5) |
|---|---|
| Creating your account, signing you in, giving access to lessons and saving your progress | Formation and performance of a contract (art. 5/2-c) |
| Verifying your Premium subscription and opening locked lessons | Performance of a contract (art. 5/2-c) |
| Sending account confirmation and password reset emails, answering your requests | Performance of a contract (art. 5/2-c) |
| Keeping the service secure, preventing abuse, fixing errors and crashes | Legitimate interest (art. 5/2-f) |
| Measuring, in aggregate, how the App is used, to improve it | Legitimate interest (art. 5/2-f) |
| Sending notifications | The permission you give on your device; you can turn notifications off in your device settings at any time |
| Meeting legal obligations and requests from competent authorities | Legal obligation (art. 5/2-ç) |
4. Who we share data with
We share your data only with the service providers below, and only to provide the service:
- Supabase: database and authentication. Servers in Frankfurt, Germany.
- Cloudflare: storage and delivery of lesson videos. Cloudflare processes your IP address while you watch.
- Google Firebase: notifications (Cloud Messaging), usage analytics (Analytics) and crash reports (Crashlytics).
- Google and Apple: for the sign-in, if you choose to sign in with them; for taking payment and managing your subscription, if you subscribe (App Store, Google Play).
- RevenueCat: keeping track of your subscription status. RevenueCat receives your user ID and the subscription details from the store.
- Resend: sending account confirmation and password reset emails.
Data may be disclosed to competent public authorities when they request it and we are legally required to.
Transfers abroad
The servers of these providers are outside Turkey (in the European Union and the United States), so your data is transferred abroad. This transfer is made under article 9 of the KVKK on the basis of standard contracts published by the Personal Data Protection Board.
5. How long we keep data
- Account, profile, exercise history and saved lessons: while your account exists. They are deleted when you delete your account.
- Database backups: deleted data can remain in our infrastructure provider’s (Supabase) automatic daily backups until that backup expires, and is then deleted with it. Backups are used only to restore data after a loss.
- Usage analytics: 2 months; crash reports: 90 days.
- Records we must keep by law: for the period the law requires.
6. Security
All communication between the App and the servers is encrypted (HTTPS). Each user can access only their own data; lesson videos are not public and are served only to signed-in users through short-lived links.
7. Your rights
Under article 11 of the KVKK you have the right to learn whether your personal data is processed and to request information about it; to learn the purpose of processing and whether it is used for that purpose; to know the third parties, in Turkey or abroad, it is transferred to; to have incomplete or incorrect data corrected, and to have data erased or destroyed, and to have those third parties notified; to object to a result against you arising solely from automated analysis; and to claim compensation for damage caused by unlawful processing.
Send your request from your registered email address to [email protected]. We will resolve it free of charge within 30 days.
To delete your account and data, see Delete account.
8. Children
The App is not designed for people under 18. If you are under 18, use the App only with the consent of your parent or guardian.
9. Changes
We may update this policy. If a change is significant we will tell you in the App or by email. The current version is always on this page.