Privacy Policy

1. Scope of this notice

This Privacy Policy covers the kidlio.net marketing site. The Kidlio mobile app is not released yet; this site does not create accounts, does not take payments, and collects no data about your child. When the app launches, a separate and more detailed policy will govern in-app processing.

2. Data controller

The controller for personal data processed through this site is BrainyTech. For any question, request or formal application: contact@brainytech.net

3. What this site processes

There are three forms on this site, and each one processes only its own fields:

• Launch waiting list — your email address, your chosen language and where on the page the form sat. Purpose: to send you a single notification email, with the list-only discount, on the day Kidlio reaches the stores. Legal basis: your consent, and your commercial electronic message consent under Turkish Law no. 6563.
• Contact form — your name, email address and the message you write. Purpose: answering you. Legal basis: performance of your request and legitimate interest.
• Activity suggestion — the title and description of your idea, and optionally your email. Purpose: reviewing the idea and replying if needed. Legal basis: legitimate interest.

Please do not type private details about yourself, your child or anyone else (address, phone, health information, photos) into these forms.

4. Processed automatically

• IP address — used only to block automated and abusive form submissions. It is held in the server's memory for a short counting window (5 or 10 minutes depending on the form) and then disappears on its own. It is never written to storage and never sent anywhere. Legal basis: service security and legitimate interest.
• Session cookie — the site uses exactly one cookie. It holds your language choice, your light/dark theme preference and a one-time form result. It carries no identity, and is only written when you press the language/theme button or submit a form. There are no advertising cookies, tracking pixels or third-party tracking scripts on this site.
• Usage measurement — we measure which pages are read, where a form is abandoned, and whether the site was opened on a phone or a computer, on our own server. No third-party tool such as Google Analytics is used, and nothing goes to an advertising network. Two keys are kept in your browser: a randomly generated visitor key (it renews itself after 12 months) and a session key that is deleted when you close the tab. Neither is a cookie — both are browser storage — and neither is tied to your name or email. Your IP address is written to the measurement record masked: its last part is zeroed (192.168.13.207 → 192.168.13.0), so rough geography remains and you cannot be singled out. Nothing you type into a form (email, message, activity idea) enters the measurement record; only “seen / submitted / accepted” is kept. Legal basis: legitimate interest.

5. Who receives your data

• Form records are sent to and stored in Brainy Tech Cortex, the request-management platform used by BrainyTech; the notification email is also sent from there. Only the form's own fields plus language and source reach Cortex — your IP address, browser details and cookies do not.
• Usage measurement records are written to the same infrastructure (Brainy Tech Cortex) and read only by BrainyTech. The IP that reaches it is masked; a name, an email address or form content is never sent.
• Fonts and icons are loaded from Google Fonts (fonts.googleapis.com, fonts.gstatic.com) and Cloudflare cdnjs (cdnjs.cloudflare.com). This means that when you view the site, your IP address and browser details technically reach these providers, whose servers may be located outside Türkiye.

Beyond this, your data is not shared with any third party, is never sold, and is never transferred for advertising. Legal obligations and duly issued requests from competent authorities are reserved.

6. What this site does not collect

• Nothing about your child — no name, age, photo, voice or location.
• No advertising pixels, heatmaps, session recordings or third-party analytics tools. (What our own measurement collects is set out in §4.)
• No location data, contacts, device identifiers or advertising IDs.
• No payment or card details — nothing is sold on this site.

7. Keeping and deleting

Form records are kept for as long as the purpose they were written for requires: your waiting-list entry until the launch notification is sent, and contact and suggestion records for a reasonable period after the request is resolved. You can ask us to delete your record at any time by writing to contact@brainytech.net; we answer within thirty days, free of charge.

Usage measurement records are kept for at most 180 days and are deleted automatically once that period is over. They contain no name, no email address and no text you typed, the IP is masked, and because the visitor key renews every 12 months the history also breaks by itself.

8. Security

Traffic between the site and your browser travels over an encrypted connection (HTTPS); the session cookie is signed, readable only by the server and closed to JavaScript. Forms are delivered over a server-to-server connection protected by an API key that is never sent to the browser. That said, no transmission over the internet is absolutely secure. If we learn that your personal data has been unlawfully accessed, we will inform you and the Turkish Data Protection Authority as soon as possible.

9. Your rights

Under Article 11 of Turkish Law no. 6698 (KVKK) you may apply to the controller to:

• Learn whether your personal data is being processed,
• Request information about it if it has been processed,
• Learn the purpose of processing and whether it is used accordingly,
• Know the third parties to whom it is transferred, at home or abroad,
• Request correction if it is incomplete or inaccurate,
• Request erasure or destruction under the conditions of Article 7,
• Request that corrections and erasures be notified to third parties the data was transferred to,
• Object to a result reached against you solely through automated analysis,
• Claim compensation if you suffer loss due to unlawful processing.

Send your application to contact@brainytech.net; it is resolved within thirty days, free of charge. If it is refused, the answer is inadequate or no answer arrives in time, you may complain to the Turkish Personal Data Protection Board within thirty days of learning the answer and in any case within sixty days of your application.

10. If you visit from Europe

If you connect from the European Union or the United Kingdom, the GDPR gives you further rights alongside those above: to receive your data in a portable form, to request restriction of processing, and to withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. You may also lodge a complaint with the data protection supervisory authority in your country.

11. Changes to this notice

When this policy changes, the update date at the top of the page changes with it. When the app reaches the stores, this text will be rewritten and merged into a single source with the in-app policy.

For questions: contact@brainytech.net