Privacy Policy

1. Scope of this notice

This Privacy Policy covers the kidlio.net marketing site. The Kidlio mobile app is not released yet; this site does not create accounts, does not take payments, and collects no data about your child. Processing inside the Kidlio mobile app is governed by a separate, more detailed policy: App Privacy Policy. That policy applies from the day the app is released in the stores.

2. Data controller

The controller for personal data processed through this site is Meryem Bilginer, a sole proprietor trading as BrainyTech.

Address: Selimpaşa Mah. 1010. Sk. No: 10/1 İç Kapı No: 79, Silivri/İstanbul, Türkiye
Email: contact@brainytech.net

3. What this site processes

There are three forms on this site, and each one processes only its own fields:

• Launch waiting list — your email address, your chosen language, where on the page the form sat, your answer to the two consent boxes (with the consent wording and date), and your IP address with its last part removed. Purpose: to send you emails about Kidlio's launch and the list-only discount; and, if you ticked the optional second box, to keep emailing you after the launch about news, activity ideas and offers. Legal basis: your consent, and your commercial electronic message consent under Turkish Law no. 6563, given separately for each box.
• Contact form — your name, email address and the message you write. Purpose: answering you. Legal basis: performance of your request and legitimate interest.
• Activity suggestion — the title and description of your idea, and optionally your email. Purpose: reviewing the idea and replying if needed. Legal basis: legitimate interest.

Please do not type private details about yourself, your child or anyone else (address, phone, health information, photos) into these forms.

4. Processed automatically

• IP address — used only to block automated and abusive form submissions. It is held in the server's memory for a short counting window (5 or 10 minutes depending on the form) and then disappears on its own. The one exception is the waiting list: if you join it, your IP address is kept with your consent record with its last part removed (85.105.12.47 → 85.105.12.0); the full address is never stored or sent anywhere (see §3 and §7). Legal basis: service security and legitimate interest.
• Session cookie — the site uses exactly one cookie. It holds your language choice, your light/dark theme preference and a one-time form result. It carries no identity, and is only written when you press the language/theme button or submit a form. There are no advertising cookies, tracking pixels or third-party tracking scripts on this site.
• Usage measurement — we measure which pages are read, where a form is abandoned, and whether the site was opened on a phone or a computer, on our own server. No third-party tool such as Google Analytics is used, and nothing goes to an advertising network. Two keys are kept in your browser: a randomly generated visitor key (it renews itself after 12 months) and a session key that is deleted when you close the tab. Neither is a cookie — both are browser storage — and neither is tied to your name or email. Your IP address is written to the measurement record masked: its last part is zeroed (192.168.13.207 → 192.168.13.0), so rough geography remains and you cannot be singled out. Nothing you type into a form (email, message, activity idea) enters the measurement record; only “seen / submitted / accepted” is kept. Legal basis: legitimate interest. You can switch measurement off at any time: the button at the end of this page stops it, your choice is stored in your browser, and no event is sent after that.

5. Who receives your data

• Form records are sent to and stored in Brainy Tech Cortex, the request-management platform used by BrainyTech; the notification email is also sent from there. Only the form's own fields plus language and source reach Cortex — your IP address, browser details and cookies do not. Cortex servers are located in Türkiye; your form records are not transferred abroad.
• Usage measurement records are written to the same infrastructure (Brainy Tech Cortex) and read only by BrainyTech. The IP that reaches it is masked; a name, an email address or form content is never sent. Measurement records are also held in Türkiye.
• Fonts and icons are loaded from Google Fonts (fonts.googleapis.com, fonts.gstatic.com) and Cloudflare cdnjs (cdnjs.cloudflare.com). This means that when you view the site, your IP address and browser details technically reach these providers, whose servers are located outside Türkiye (Google Ireland Limited / Google LLC and Cloudflare, Inc.), which makes this a technical transfer abroad under Article 9 of the KVKK. Only the connection itself is transferred: your name, your email address, your form content and your measurement records do not reach these providers.

Beyond this, your data is not shared with any third party, is never sold, and is never transferred for advertising. Legal obligations and duly issued requests from competent authorities are reserved.

6. What this site does not collect

• Nothing about your child — no name, age, photo, voice or location.
• No advertising pixels, heatmaps, session recordings or third-party analytics tools. (What our own measurement collects is set out in §4.)
• No location data, contacts, device identifiers or advertising IDs.
• No payment or card details — nothing is sold on this site.

7. Keeping and deleting

Form records are kept for as long as the purpose they were written for requires: your waiting-list entry until the list-only discount email is sent (or, if you ticked the optional second box, until you withdraw that consent), and contact and suggestion records for at most 12 months after the request is resolved. You can ask us to delete your record at any time by writing to contact@brainytech.net; we answer within thirty days, free of charge.

The consent record is kept separately. When your waiting-list entry is deleted, or when you withdraw a consent, the record showing which wording you agreed to and when (your email address, the consent wording and version, the dates of consent and withdrawal, and your IP address with its last part removed) is kept for 3 years from the date the consent ends. This is the retention period the Turkish Regulation on Commercial Communication and Commercial Electronic Messages (Article 13(2)) sets for consent records, and the burden of proving that consent was given is ours. The record is used only to prove that consent existed, in a complaint, a dispute or an inspection, and no email is ever sent on the basis of it. It is deleted when the period ends. Legal basis: compliance with a legal obligation and the establishment, exercise or defence of a right.

Usage measurement records are kept for at most 180 days and are deleted automatically once that period is over. They contain no name, no email address and no text you typed, the IP is masked, and because the visitor key renews every 12 months the history also breaks by itself.

8. Security

Traffic between the site and your browser travels over an encrypted connection (HTTPS); the session cookie is signed, readable only by the server and closed to JavaScript. Forms are delivered over a server-to-server connection protected by an API key that is never sent to the browser. That said, no transmission over the internet is absolutely secure. If we learn that your personal data has been unlawfully accessed, we will inform you and the Turkish Data Protection Authority as soon as possible.

9. Your rights

Under Article 11 of Turkish Law no. 6698 (KVKK) you may apply to the controller to:

• Learn whether your personal data is being processed,
• Request information about it if it has been processed,
• Learn the purpose of processing and whether it is used accordingly,
• Know the third parties to whom it is transferred, at home or abroad,
• Request correction if it is incomplete or inaccurate,
• Request erasure or destruction under the conditions of Article 7,
• Request that corrections and erasures be notified to third parties the data was transferred to,
• Object to a result reached against you solely through automated analysis,
• Claim compensation if you suffer loss due to unlawful processing.

Send your application to contact@brainytech.net; it is resolved within thirty days, free of charge. You may also send your application, together with information identifying you, as a signed letter to the postal address above, by secure electronic signature or mobile signature, or from an email address you have previously notified to us and that is registered in our records (Communiqué on the Procedures and Principles of Application to the Data Controller, Art. 5). If it is refused, the answer is inadequate or no answer arrives in time, you may complain to the Turkish Personal Data Protection Board within thirty days of learning the answer and in any case within sixty days of your application.

10. If you visit from Europe

If you connect from the European Union or the United Kingdom, the GDPR gives you further rights alongside those above: to receive your data in a portable form, to request restriction of processing, and to withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. You may also lodge a complaint with the data protection supervisory authority in your country.

11. Changes to this notice

When this policy changes, the update date at the top of the page changes with it. If a change is material — for example if we start processing a new type of data, or the recipients change — everyone on the waiting list is notified separately; that notice is not a commercial message and is separate from the launch and marketing emails. The app's own policy is on a separate page (App Privacy Policy) and is kept identical to the text shown inside the app; when the app reaches the stores, this notice will be reviewed together with it.

For questions: contact@brainytech.net