Privacy Policy

Kepyil is an app in which schools and classes put together their graduation yearbook: the iOS and Android app, app.mezuniyetyilligi.com and the school panel. This policy explains what personal data is processed when you use Kepyil, why, who it is shared with, and your rights under the Turkish Personal Data Protection Law No. 6698 (KVKK).

Who is the data controller?

It depends on how the yearbook was set up:

• For yearbooks a school runs under a contract with Kepyil, the school is the data controller. Kepyil processes the data on the school’s behalf and on its instructions (data processor).
• For yearbooks a teacher, parent or student sets up in the app themselves, Kepyil is the data controller.
• In every case, Kepyil is the data controller for account, sign-in, purchase and security records.

Kepyil: [company name], [company address]. You can reach us at [email protected] or at our KEP address [KEP address].

What data do we process?

• Identity and contact: first and last name, role (student, teacher, parent, school administrator), school and class; the phone number or e-mail address we send your sign-in code to; a student number if the school added one.
• Age: the year of birth only, used to decide whether parental consent or a parent-managed account is needed. We never ask for a date of birth or a national ID number.
• Yearbook content: the messages you write and receive, your profile answers, your portrait, photos and captions added to the memory wall, voice and video memories played from a QR code, your time capsule letter, your votes in the superlatives and your likes.
• Consent records: the parent’s name and relationship to the child, the consents given, the version and digest of the consent text, and the time, method and IP address of the consent.
• Moderation and security records: moderation results of messages, reports and blocks, sign-in times and IP addresses, and app crash reports. The text of messages is never added to crash reports.
• Purchases: the product bought on the App Store or Google Play, the transaction number, the amount and the yearbook it was bought for. Your card details never reach us; Apple or Google takes the payment.
• Notifications: the push token needed to send notifications to your device, your device language so notifications arrive in the right language, and your notification preferences.
• Print requests: a delivery address and contact person, if the yearbook is printed through us.

The camera and microphone are used only when you scan a QR code, take a photo or record a memory, and only with your permission. Location, contacts and advertising identifiers are not used.

Purposes and legal grounds

• Opening your account, sending sign-in codes, and preparing, printing and digitally delivering the yearbook: establishing and performing the contract (KVKK Art. 5/2-c).
• Checking messages for inappropriate content, passing signs of self-harm to a responsible adult, handling reports and keeping the service secure: legitimate interest and legal obligation (Art. 5/2-f, Art. 5/2-ç).
• Verifying purchases and keeping statutory records: performing the contract and legal obligation (Art. 5/2-c, Art. 5/2-ç).
• Processing data of students under 18, printing photos in the yearbook, AI moderation of messages and storing data on servers abroad: the parent’s explicit consent (Art. 5/1, Art. 9).

Your data is never used for advertising, marketing or profiling, and it is never sold.

Parental consent and children

• When a student under 18 joins a yearbook, the app prepares a consent link for their parent. Until the parent consents, the student cannot write and does not appear in the yearbook.
• Consents are asked for separately. Processing the data and storing it on servers abroad are required; photos and AI moderation are optional. Without photo consent the page shows the child’s initials instead of a photo. Without AI consent, messages go through rule-based checks and teacher approval only.
• Children under 13 do not join with their own account: a parent uses the app on the child’s behalf.
• A parent can withdraw consent at any time: in the app, through the school or by writing to [email protected]. Withdrawing removes the data from the app and the digital yearbook; pages in books already printed cannot be recalled.
• The app is rated 13+ and is not listed in the stores’ kids categories.

Who can see the data?

• Students in the same yearbook: your name, your class, your photo if there is photo consent, and messages approved by a teacher. Yearbook content is never shown to people in other yearbooks.
• Teachers, school administrators and the adult organizing the yearbook: additionally phone numbers, e-mail addresses and student numbers, messages awaiting moderation and reports. An organizer under 18 does not see phone numbers or flagged messages.
• Anyone who scans a QR code: the QR code printed in the yearbook opens a voice or video memory once a teacher has approved it. A time capsule’s QR page shows only the first name and the opening date; the letter itself stays encrypted until that date.
• Anyone with a printed or PDF copy of the yearbook: the messages and photos in the book.

Beyond this there are no public profiles, no shared class lists and no content visible to search engines.

Service providers and transfers abroad

We use the following companies to run Kepyil. Each processes data only for its own service and on our instructions. Transfers abroad comply with Article 9 of the KVKK.

AI moderation applies to messages written by teachers, by students in university yearbooks, and by students whose parent consented to it. The message is sent with the names in it masked; your name and class are not sent. The model can only send a message to a teacher for review or back to its author for changes; it never approves or deletes a message by itself. Messages sent for moderation are not used to train AI models.

Apple and Google provide the app stores and payments independently, under their own privacy policies.

Cookies on the website

On mezuniyetyilligi.com, Google Analytics runs only if you allow it. We use it to see, in aggregate, which pages are read, where visitors come from and what devices they use. We use no advertising or personalization cookies.

• If you decline: Google Analytics is not loaded and no request is sent to Google.
• If you accept: Google Analytics sets the _ga and _ga_… cookies, kept for up to 2 years. The legal ground is your explicit consent.
• Your choice is stored in your browser (localStorage) and never sent to a server. Your light or dark mode choice is stored the same way.
• You can change your mind at any time with the Cookie settings link at the bottom of the page. When you withdraw consent, the Google Analytics cookies are removed.

How long do we keep data?

• Original photos and messages: deleted 12 months after the yearbook is delivered.
• Print files (PDF): deleted 24 months after delivery.
• Rejected messages: deleted 30 days after the yearbook is locked.
• Deleted accounts: the account closes at once and the data is permanently deleted after 30 days. Details: Account deletion.
• Consent, purchase and moderation records: kept for as long as legal obligations and possible disputes require.

How do we protect data?

• All traffic between the app and our servers is encrypted (HTTPS).
• Everyone sees only their own yearbook and what their role allows; this rule is also enforced in the database.
• Photos are not stored at public addresses; the app shows them through short-lived signed links.
• Time capsule letters are stored encrypted until their opening date.
• If a data breach occurs, we notify the Personal Data Protection Board and the people affected within the legal deadline.

Your rights

Under Article 11 of the KVKK you have the right to learn whether your data is processed, to request information about it, to learn its purpose and whether it is used accordingly, to know the third parties it is transferred to, to request its correction if incomplete or wrong, to request its deletion or destruction, to request that these steps be notified to those it was transferred to, to object to an outcome against you that results solely from automated analysis, and to claim compensation for damage.

• In the app: Me → Download my data, and Me → Delete my account.
• By writing to us: at [email protected], stating your registered phone number or e-mail address. We will contact that number or address to confirm it is you.
• Through the school: for yearbooks where the school is the data controller you can also apply to the school, which forwards the request to us.

We answer free of charge within 30 days at the latest. If you are not satisfied with our answer, you can complain to the Personal Data Protection Board (KVKK).

Changes to this policy

When we change this policy we update the date on this page, and we announce important changes in the app. Every change to the parental consent texts is published as a new version, and consent is asked for again where needed.