This notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and Articles 13–14 of the GDPR. It explains how personal data is processed in connection with the Kidelon apps and the kidelon.com website.
1. Data controller
Your personal data is processed by HK Solutions (Hasan Ömer Kocakaya, Istanbul, Türkiye) as data controller. Contact: dpo@kidelon.com.
2. Personal data we process
- Identity and contact data (parent): first name, last name, email address, phone number.
- Account and security data: password hash, PIN hash, session and device tokens, IP address, audit records.
- Family and child profile data: family name, member roles, child's name, age and avatar (entered by the parent).
- Child device usage data: app name and duration, visited domains, entry/exit events for the safe zones you define, device model, OS version, battery level. Message content, keystrokes and screenshots are not processed.
- Financial data: subscription status and purchase receipt (card details are handled by Google Play and never reach us).
- Website data: name, email and phone submitted on the early-signup form; anonymised analytics cookies if you consent.
3. Purposes of processing
- Providing the parental-control service, creating and managing your account.
- Pairing family members, relaying commands and sending notifications.
- Managing subscriptions and premium features, billing and refunds.
- Information security, abuse prevention and access control.
- Customer support and communication.
- Running the early-signup (waitlist) campaign and informing you about the launch.
- Meeting legal obligations and lawful requests from authorities.
- Measuring and improving service quality (anonymised, aggregated data only).
4. Legal bases
- Performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6/1-b) — delivering the service.
- Compliance with a legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6/1-c) — financial and legal records.
- Legitimate interests (KVKK Art. 5/2-f; GDPR Art. 6/1-f) — security, service improvement.
- Consent (KVKK Art. 5/1; GDPR Art. 6/1-a) — early-signup communications and analytics cookies. You may withdraw consent at any time.
Children's data is processed on the instruction and with the consent of the parent holding custody, in the child's best interest and under the principle of data minimisation.
5. Recipients and transfers
- Hosting: Hetzner Online GmbH (Germany, EU) — primary server; backup server in Türkiye.
- Push notifications: Google Firebase — device token.
- Subscription management: RevenueCat and Google Play — purchase receipt.
- Error tracking: Sentry — error record and device version.
- Public authorities — where legally required.
International transfers are made only to countries with adequate protection or to processors bound by appropriate safeguards (KVKK Art. 9; GDPR Chapter V), and where required on the basis of your explicit consent. No third party can access the content of child usage data.
6. How data is collected
Electronically, through the Kidelon parent and child apps, the kidelon.com forms, email correspondence and automated in-app means (device sensors and system permissions).
7. Retention
- Account and profile data: until deletion + 30-day grace period.
- Child device usage records: 90–180 days depending on category, then anonymised.
- Family messages: 365 days.
- Billing and payment records: 10 years (tax law).
- Anonymised audit summaries: 5 years.
- Early-signup list: 12 months after launch, or upon withdrawal of consent.
8. Your rights
Under KVKK Article 11 and GDPR Articles 15–22 you have the right to: learn whether your data is processed; request information about it; learn the purpose and whether it is used accordingly; know the third parties it is transferred to; request rectification; request erasure or destruction; have those actions notified to recipients; object to decisions based solely on automated processing; and claim compensation for damage caused by unlawful processing. EU residents may also lodge a complaint with their supervisory authority.
9. How to exercise your rights
Email dpo@kidelon.com with information that verifies your identity. Requests are answered free of charge within 30 days at the latest. To delete your account or specific data categories directly, use the account deletion and data deletion pages.
10. Changes
This notice may be updated to reflect changes in law or in the service; the current version is always published on this page. See the Privacy policy for our full privacy practices.