PIRIL Campus home
Agreements and Information

Privacy and Security Policy

These documents concern the PIRIL application and related services.

PIRIL Campus Privacy and Security Policy

Last updated: 2026-11-02 Effective upon publication.

This Privacy and Security Policy (the “Policy”) applies to the pirilkampus.com domain and the products and services named PIRIL Campus (including the website, mobile applications, support channels and related services, together the “Services”) operated by Ali'nin Tasarım Fabrikası Ltd. Şti. (the “Company”). The Policy explains the purposes and legal grounds for processing personal data, with whom and for what purposes data is shared, the security measures taken and data subjects' rights.

1) Data Controller and Contact

  • Company name: Ali'nin Tasarım Fabrikası Ltd. Şti.
  • Address: İşçi Blokları Mah. Muhsin Yazıcıoğlu Cad. No:43/1 Çankaya/ANKARA
  • MERSİS:
  • Email: [email protected]
  • Telephone: 0312 285 27 10

Requests concerning personal data under this Policy may be sent through the contact channels above with the subject “Application under the KVKK Right to Apply (Article 11)”.

2) Scope and Definitions

  • Personal Data: Any information relating to an identified or identifiable natural person.
  • Child profile data: the name or nickname, age, optional gender, avatar, learning activity and parent-account link of a child profile.
  • Special Categories of Personal Data: Data covered by Article 6 of the KVKK.
  • Browser and device storage: this website stores the selected language locally; the app may store encrypted progress and session data on the device.

This policy covers parent accounts, child profiles, the Android and iOS apps, and visitors to this informational website.

3) Categories of Personal Data Processed

  1. Account and identity: email address, verification status, Google/Apple sign-in identifier, linked sign-in providers, chosen country and language.
  2. Child profiles: name or nickname, age, optional gender and avatar, linked to the parent account.
  3. Device and security: platform, app version, device/session identifiers, security and network verification records, and notification token when notifications are enabled.
  4. Learning activity: completed scenes and games, progress, stars or points, saved game state, and video viewing progress.
  5. Store purchases: Google Play or App Store name, product, transaction and subscription identifiers, verification, renewal and expiry status, and necessary financial records. Payment card details are handled by the store.
  6. Support and communication: messages and contact details that you choose to provide when seeking support or exercising a legal right.
  7. Preferences and consent: language, country, notification choices and parental consent records. If the AI assistant is used, the message is processed to answer it; the app does not require a child to provide a real name in that message.
  8. Technical and audit records: access, error, abuse-prevention and account-deletion records needed to operate and protect the service.

As a rule, special categories of data are not processed. Where necessary, explicit consent is obtained and the strict measures under Article 6 of the KVKK are applied.

4) Processing Purposes and Legal Grounds (KVKK Articles 5/2 and 6)

  • Provide parent accounts, child profiles, learning content and progress — contract performance.
  • Verify store subscriptions and provide paid access — contract performance and legal obligations.
  • Secure accounts, prevent abuse and investigate errors — legitimate interests and legal obligations.
  • Respond to support and data-rights requests — contract performance and legal obligations.
  • Process AI-assistant messages only when that feature is used under the required parent consent and applicable legal basis.
  • Keep only records required for accounting, disputes and legal compliance — legal obligations.

5) Children's Privacy and Parental/Consent Management

  • A parent or legal guardian manages the account and the child profiles. The app does not require school or teacher information for these profiles.
  • Only the minimum profile and learning data needed to provide the service is used. Additional parental approval is obtained where required.
  • Child profile data is not used for advertising targeting or sold to advertisers.

6) Cookies and Similar Technologies

  • This informational website does not use advertising or analytics cookies.
  • The website stores only the selected language in browser local storage; you can remove it through your browser settings.
  • The app may keep encrypted local progress and essential session data on the device. Store and sign-in services process their own technical data under their policies.
  • Optional push notifications are controlled by device permission and the app settings.

There is no cookie management panel on this informational website. You can change the website language at any time or clear its local storage in your browser.

7) Technical and Organizational Security Measures

  1. Encryption: Applications and administration panels are protected with TLS. Current symmetric encryption methods such as AES-256 are used to store sensitive data, and RSA (2048+/4096) is used for key management/distribution. Passwords are one-way hashed with Argon2/bcrypt; SHA-256/384 is preferred for data integrity and signature processes. Data is encrypted at rest and in transit.
  2. Access Control: Least privilege (RBAC), MFA and IP restrictions; access is logged.
  3. Network Security: Firewall, WAF/DDoS protection, rate limiting and bot detection.
  4. Application Security: Code reviews, dependency security (SBOM), secret key management (KMS), signed artifacts in CI/CD, regular penetration testing and vulnerability scans.
  5. Data Minimization and Masking: Purpose-limited data collection, masking/pseudonymization where needed.
  6. Backup and Continuity: Backups are encrypted, access-controlled and geographically redundant; business continuity and disaster recovery plans are tested.
  7. Audit and Awareness: Employee KVKK/security training, processor clauses in supplier contracts and confidentiality commitments.
  8. Incident Management: Impact analysis, log correlation and reviewable audit trails for security incidents; breaches are notified to the Authority and affected individuals.

8) Data Retention Periods

  • After account deletion, access is closed. Account, profile and learning data are erased or anonymized according to applicable law and the data retention policy.
  • Purchase, accounting, fraud-prevention and audit records required by law are kept only for the applicable legal period, with restricted access.
  • Support messages and consent records are kept only as long as needed for their purpose or a legal obligation.
  • Backup copies follow the same deletion process; anonymous aggregate statistics no longer identify an account.

At the end of these periods, data is securely deleted, anonymized or destroyed. Periods may be updated according to legislation and processing purposes.

9) Transfers of Personal Data (Domestic / International)

To operate the service, data may be shared only as needed with hosting, Google/Apple sign-in and store services, notification delivery and support providers. Any international transfer must have a lawful basis under KVKK article 9.

10) Automated Processing and Profiling

Automated scoring/adaptation may be used to personalize the educational experience; these processes do not constitute profiling with legal effects. Your right to object is reserved.

11) Data Subject Rights (KVKK Article 11) and Applications

  1. To learn whether your personal data is processed,
  2. To request information about the processing activity,
  3. To learn the purpose of processing and whether the data is used in accordance with that purpose,
  4. To know the third parties to whom it is transferred domestically or internationally,
  5. To request correction of incomplete or inaccurate processing,
  6. To request deletion/destruction under the KVKK and relevant legislation,
  7. To request that these actions be notified to third parties to whom the data was transferred,
  8. To object to an outcome against you resulting from analysis exclusively by automated systems,
  9. To claim compensation if you suffer damage.

Application Methods: Email: [email protected] Post: İşçi Blokları Mah. Muhsin Yazıcıoğlu Cad. No:43/1 Çankaya/ANKARA Applications are resolved within 30 days at the latest. If the request incurs additional costs, the fee specified in the Board's tariff may be charged.

12) Third-Party Websites and Applications

The Services may link to third-party websites/applications. The Company is not responsible for their content or privacy/security practices; please check their respective policies.

13) Changes to the Policy

The Policy may be updated to reflect changes in legislation and the Services. Updates take effect upon publication on pirilkampus.com, and the “Last updated” date above is changed. Users are notified of material changes.