KVKK Notice — Account Holders
The notice Turkish data-protection law (KVKK, article 10) requires, for teachers, parents and guardians who have an account.
Version 1.0 · In force from 13 October 2026 · Last updated 13 October 2026
This notice is given under article 10 of Türkiye’s Personal Data Protection Law no. 6698 (“KVKK”) and the communiqué on the duty to inform. The Turkish text is the authoritative one. Student accounts created by teachers are not covered here (see section 9).
1. Data controller
YourWorksheets is run by an individual based in Türkiye, who is the data controller under the KVKK.
YourWorksheets — run by an individual based in Türkiye.
Our full name and an address for legal notices are being added here; until then, reach us by the routes below.
E-mail: privacy@yourworksheets.com · Help center · www.yourworksheets.com
2. Personal data processed, purposes and legal grounds
| Category | Data | Purpose | Legal ground (KVKK art. 5(2)) |
|---|---|---|---|
| Identity and contact | Display name, e-mail address; with Google sign-in, the name, e-mail and profile picture of your Google account | Creating your account, verifying your identity, sending password-reset e-mails, running the account | (c) Formation or performance of a contract |
| Customer transactions | Your plan, plan status, customer and subscription identifiers at the payment provider (your card details never reach us) | Applying your plan; handling subscription, cancellation and refunds | (c) Formation or performance of a contract |
| Content | Your worksheets, templates, uploaded images and files, titles and descriptions; your display name as author when you publish | Storing, editing, printing and exporting worksheets; publishing them in the library at your choice | (c) Performance of a contract |
| AI use | The subject, topic, grade or level, language, question types and difficulty you choose; counts and outcomes of generations (the text of your request is not stored) | Producing the draft and applying your monthly allowance | (c) Performance of a contract |
| Transaction security | IP address, browser details, sign-in times, bot-check (reCAPTCHA) signals, rate-limit counters | Keeping the service secure and preventing abuse and automated attacks | (f) Legitimate interest |
| Choice and acceptance records | Your cookie choice, the document versions you accepted and when, a coarse browser family (no IP address) | Respecting your choices and proving our compliance | (ç) Legal obligation; (e) Establishing, exercising or protecting a right |
| Requests and complaints | Your help-form and in-app messages, data-subject applications, content reports | Answering you and enabling you to exercise your rights | (c), (ç), (e) and (f) |
| Messages with your students | Messages between you and your own students | Providing the messaging feature | (c) Performance of a contract |
| Analytics — only with your explicit consent | A random identifier, IP address, device and browser details, pages and features used, page-load timings | Understanding how the site is used and fixing slow pages | Explicit consent (KVKK art. 5(1)), given and withdrawn separately under Cookie settings |
3. How we collect it
Automatically and partly automatically: through the forms on the website and in the app, account settings, the help form, Google sign-in, and cookies and similar technologies (see the Cookie Policy).
4. Transfers: to whom and why
We do not sell personal data or share it with advertisers. We share it only with the service providers below, for the purposes shown. Most of them are outside Türkiye, mainly in the United States, so your data is transferred abroad.
| Provider | Purpose | Data | Location | Role |
|---|---|---|---|---|
| Vercel Vercel Inc., San Francisco, USA Privacy policy | Hosting of the website and its server functions; delivery of pages; if you allow it, page-speed measurement (Speed Insights). | IP address, request details, and everything that passes through our server (account, worksheet and form data). | United States, with worldwide edge locations | Processor (acts for us) · Handles student data |
| Google Firebase and Google Cloud Google LLC, Mountain View, USA Privacy policy | Sign-in (Firebase Authentication), the database (Cloud Firestore), file storage (Cloud Storage), and the bot check (App Check with reCAPTCHA). | Account data, worksheets and uploads, class and student records, messages, IP address and browser details for sign-in and the bot check. | United States for sign-in; the database and file storage are in the Google Cloud location chosen for our project | Processor (acts for us) · Handles student data |
| Google Analytics for Firebase (only with your consent) Google LLC, Mountain View, USA Privacy policy | Counting visits and how features are used, only if you allow analytics in the cookie settings. | A random identifier, IP address, device and browser details, pages and features used. | United States | Processor (acts for us) |
| Google Gemini API Google LLC, Mountain View, USA Privacy policy | Writing worksheet drafts in AI Studio from the settings you enter. | The subject, topic, grade or level, language, question types and difficulty you choose. No account details are sent. | United States and other Google locations | Processor (acts for us) |
| Anthropic (Claude) Anthropic, PBC, San Francisco, USA Privacy policy | Writing worksheet drafts on the AI Studio page, and pictures for your picture library, from what you ask for. | What you ask for — subject, topic, goals, level, languages, question types, a theme and any text you paste, or a few words describing a picture — and an anonymous code in place of your account. Never your name or e-mail. | United States | Processor (acts for us) |
| Upstash Upstash, Inc., USA Privacy policy | Rate limiting: short-lived counters that stop the service being overwhelmed or abused. | IP address and account identifier, held only for the length of the counting window (at most one day). | The Upstash region chosen for our database | Processor (acts for us) |
| Resend Resend, Inc., USA Privacy policy | Delivering a copy of your help-form message, data request or content report to our inbox so we can answer it. | Your name, e-mail address and the text of your message. | United States | Processor (acts for us) |
| Polar Polar Software, Inc., Dover, Delaware, USA Privacy policy | Selling the Plus and Pro plans as merchant of record: checkout, payment, tax, receipts, refunds and the subscription portal. | Your e-mail address and account identifier from us; your name, billing address and card details, which you give directly to Polar and which we never see. | United States | Independent controller |
For transfers abroad, KVKK article 9 requires an appropriate safeguard such as the standard contract announced by the Board. The status for each provider:
| Provider | Location | Türkiye (KVKK art. 9) | EU and UK |
|---|---|---|---|
| Vercel | United States, with worldwide edge locations | We are putting in place the standard contract announced by Türkiye’s Personal Data Protection Board with this provider; its date will be shown here once signed. | EU–US Data Privacy Framework and Standard Contractual Clauses, per Vercel’s data processing addendum |
| Google Firebase and Google Cloud | United States for sign-in; the database and file storage are in the Google Cloud location chosen for our project | We are putting in place the standard contract announced by Türkiye’s Personal Data Protection Board with this provider; its date will be shown here once signed. | EU–US Data Privacy Framework and Standard Contractual Clauses, per the Google Cloud data processing terms |
| Google Analytics for Firebase (only with your consent) | United States | We are putting in place the standard contract announced by Türkiye’s Personal Data Protection Board with this provider; its date will be shown here once signed. | EU–US Data Privacy Framework and Standard Contractual Clauses, per Google’s terms |
| Google Gemini API | United States and other Google locations | We are putting in place the standard contract announced by Türkiye’s Personal Data Protection Board with this provider; its date will be shown here once signed. | Google’s data processing terms for the Gemini API |
| Anthropic (Claude) | United States | We are putting in place the standard contract announced by Türkiye’s Personal Data Protection Board with this provider; its date will be shown here once signed. | Anthropic’s data processing addendum, with Standard Contractual Clauses |
| Upstash | The Upstash region chosen for our database | We are putting in place the standard contract announced by Türkiye’s Personal Data Protection Board with this provider; its date will be shown here once signed. | Upstash’s data processing agreement |
| Resend | United States | We are putting in place the standard contract announced by Türkiye’s Personal Data Protection Board with this provider; its date will be shown here once signed. | Resend’s data processing agreement |
| Polar | United States | We are putting in place the standard contract announced by Türkiye’s Personal Data Protection Board with this provider; its date will be shown here once signed. | Polar’s own privacy policy and buyer terms (Polar decides how payment data is handled) |
Personal data is disclosed to public authorities only where the law requires it.
5. Retention
We keep personal data for as long as the purpose requires and the law prescribes, and then delete, destroy or anonymise it.
| Data | How long | How it is removed |
|---|---|---|
| Account profile and sign-in record | Until you delete your account; removed at once when you do | When you or a teacher delete it |
| Your worksheets, templates and uploads | Until you delete them, or your account | When you or a teacher delete it |
| Worksheets you published to the library | Public until you unpublish or delete them; deleting your account removes them | When you or a teacher delete it |
| Classes, student accounts, their work, results, rewards and messages | Until the teacher removes the student or the class, or deletes their own account; teacher–student messages are kept 90 more days for safeguarding, then deleted | When you or a teacher delete it |
| Messages of a removed student | 90 days after the student was removed | Scheduled clean-up |
| AI usage records (counts and outcomes; no prompt text is stored) | 13 months | Scheduled clean-up |
| Monthly generation counters for your plan | 13 months | Scheduled clean-up |
| AI Studio history: the requests you wrote and the drafts made from them | 90 days, or until you delete them | Scheduled clean-up |
| AI credit counters, and the record of changes to them | 13 months | Scheduled clean-up |
| Short-lived records that stop one AI request being charged twice | 30 days | Scheduled clean-up |
| Pictures you make, upload or generate for your picture library | Until you delete them, or your account | When you or a teacher delete it |
| Rate-limit counters with IP address or account identifier | From one minute up to one day, then they expire | Provider’s own settings |
| Help-form and in-app messages to us | 24 months after you sent it | Scheduled clean-up |
| Data requests and our answers | 3 years after the request is closed | Scheduled clean-up |
| Content reports and our decisions | 3 years after the decision, longer only while a legal claim is open | Scheduled clean-up |
| Records of your cookie choices (no IP address is stored) | 3 years after the choice | Scheduled clean-up |
| Records of the documents you accepted and when | While your account exists, and 3 years after you delete it | Scheduled clean-up |
| Request logs at our hosting provider | The short period set by Vercel for our plan; we keep no separate copy | Provider’s own settings |
| Analytics data, only if you allowed it | The data-retention period set in our Google Analytics account | Provider’s own settings |
| Orders, invoices and payment records | Kept by Polar as seller under its own legal duties; we keep only your plan status | Provider’s own settings |
6. Your rights under KVKK article 11
By applying to the data controller you may:
- learn whether your personal data is processed,
- request information if it is,
- learn the purpose of processing and whether data is used accordingly,
- know the third parties in Türkiye or abroad to whom it is transferred,
- request correction of incomplete or inaccurate data,
- request deletion or destruction under the conditions of KVKK article 7,
- request that third parties to whom data was transferred be told of actions taken under items 5 and 6,
- object to a result against you that arises exclusively from automated analysis of processed data,
- claim compensation if you suffer damage because of unlawful processing.
7. How to apply
- In your account, under Account → Your data, you can download your data, correct your profile or delete your account.
- Use the Data requests form we built for applications.
- Write from the e-mail address registered with us to privacy@yourworksheets.com.
- Addresses for applications by signed letter or registered electronic mail (KEP) will be published on the Legal information page once added.
We verify your identity as far as the request requires. We conclude your application free of charge as soon as possible and within thirty days at the latest; if it involves an additional cost, a fee from the Board’s tariff may be charged.
8. Complaint to the Board
If your application is refused, the answer is insufficient or no answer is given in time, you may complain to the Personal Data Protection Board within thirty days of learning the answer, and in any case within sixty days of your application (KVKK art. 14).
9. Student accounts
For student accounts created by teachers in their classes, the teacher or the school is the data controller, and we process the data on their behalf as processor. Details: Children and schools, Data Processing Terms and the Parent letter.
10. Other information
- Automated decisions: we make no decision about you that significantly affects you and is based solely on automated systems.
- Is providing data mandatory: an e-mail address is needed to open an account; without it no account can be opened. Other fields are optional.
- Changes: when we update this notice we publish the new version and keep earlier ones in the version history.
This notice is information only; it needs no acceptance or approval. Processing that requires your explicit consent (optional analytics) is asked about separately and is optional.