Legal information

This English text is a convenience translation. In case of any discrepancy, the Turkish version prevails.

This Privacy Policy explains how your personal data is collected, used, shared and protected when you use busespeaks.com, app.busespeaks.com and the Busespeaks iPhone/iPad app. For the full statutory notice under Turkish data protection law (KVKK), see the KVKK Notice.

Data controller

Kadir Alan, Limanreis Mah. Mithatpaşa Cad. No: 865, Narlıdere / İzmir. Tax office and number: Balçova Vergi Dairesi, 0480776823. Email: kaadiralan@gmail.com.

Personal data we collect

• •Identity and contact details: full name, email address, phone number; and, where an invoice is required, address and Turkish ID number.
• •Order and payment details: selected package, amount, payment method, order history. Credit card details are never collected or stored by us; card transactions are handled on iyzico's secure payment infrastructure.
• •Learning data: lesson plans, lesson notes, homework submissions and learning progress.
• •Technical data: a session cookie and a hashed IP address kept for security.

Purposes of processing

Your personal data is processed to provide the service and perform the contract, to open and manage your account, to plan lessons, to handle payments and invoicing, to respond to your requests and to keep the service secure, on the legal bases set out in Article 5 of the KVKK. Your data is never sold, rented or shared with third parties for advertising or marketing.

Account and learning data in the mobile app

The Busespeaks iPhone and iPad app processes your name, email address and account identifier to provide access to your account and assigned lessons. When you sign in with Apple or Google, authentication is handled by those providers and Firebase Authentication; Busespeaks does not receive your Apple or Google account password.

Your lesson notes, teacher corrections, study answers, activity choices, homework submissions and learning progress are stored in association with your account. They are available to you and to the teacher authorized to provide your educational service. Package and invoice information displayed in the app comes from existing service records; the mobile app does not collect payment card details.

Live lessons and voice homework

Live lesson audio and video are not recorded. Daily.co transmits audio and video to the participants during the call when you enable your microphone or camera. You can turn your microphone and camera off independently. Connection times, participant identifiers, device and network information, and technical diagnostics may be processed to operate the call and troubleshoot connection issues; these are not recordings of lesson audio or video.

Voice homework and speaking-practice recordings are separate from live calls. Recording begins only when you start it in the app. An unsent recording draft stays on your device; when you choose Send, the recording is uploaded to Firebase Cloud Storage for the educational service and associated with your account. You and your authorized teacher can listen to a submitted recording. Voice homework is not published publicly.

Microphone and camera access uses iOS permission for the relevant feature. You can change these permissions in your device Settings. Disabling a permission limits the related audio or video feature; camera permission is not required to access notes and other applicable study content.

Mobile notifications

If you enable notifications, Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM) deliver lesson reminders, lesson-start alerts and teacher messages. The notification token and app installation identifier are associated with your account and device. Notification preferences, app version, operating system, language and time zone may be processed to deliver notifications correctly and troubleshoot problems.

You can change notification permission in iOS Settings and notification preferences in the app’s settings. Disabling notifications does not prevent access to your lessons. The in-app notification inbox remains available without push notification permission.

Mobile usage analytics and crash reports

In mobile versions with Privacy preferences, usage analytics and crash-report sharing are separate choices and are off on first installation. You can change them in Privacy in the account menu. These choices are separate from website analytics preferences. The mobile app does not use PostHog session replay.

If you enable usage analytics, Firebase Analytics processes app launches, screen and notification interactions, app installation identifiers, device and app information, and approximate region derived from the IP address. The app does not request precise location permission. If you enable crash reports, Firebase Crashlytics processes crash information, technical error logs, device, operating-system and app-version information, and installation identifiers used for diagnostics. These data may be linked to an installation or device and are not treated as anonymous.

These choices support app improvements and troubleshooting; the data is not used for advertising tracking or to track you across other companies’ apps and websites for advertising. Turning a choice off does not automatically delete data already sent. Changes to Crashlytics crash-report sharing take full effect on the next app launch.

Technical records needed for sign-in, service security, abuse prevention, notification delivery and live connections are separate from these optional analytics. Depending on the service used, providers such as Firebase Authentication, App Check, Firestore, Cloud Storage, FCM and Daily process installation/account identifiers, IP addresses, device and software information, and request and connection diagnostics.

Cookies and site analytics

Vercel Analytics provides cookieless aggregate measurement with personal identifiers removed from URLs. Unless you have previously turned analytics off, PostHog starts automatically. PostHog measures the pages you visit, link and button interactions, and the time each page remains visible on screen. A random analytics identifier is stored in your device’s localStorage; your name and email address are not sent to PostHog. If you open a personal link sent on Instagram, its random reference code is stored in this browser for up to 30 days. Your teacher can associate visits from this link with the Instagram username it was sent to. The username is stored only in the teacher panel and is not sent to PostHog. Opening the link does not verify the visitor’s identity. Turning analytics off also clears this reference from your browser. About 20% of sessions on public information pages with analytics enabled are replayed with text masked; form fields, payment and sign-in pages, and student/teacher panel screens are excluded from replay. Data is sent to PostHog’s European Union region. You can turn analytics off or back on at any time using Privacy preferences in the website footer or the portal account menu. Turning analytics off applies on this device until you change your preference or clear browser storage; an on preference is stored for 180 days. Previous rejections are respected. Turning analytics off does not prevent you from using the service.

Payment security

Your card details never reach us; the payment page is served over an SSL-encrypted connection by iyzico, a licensed payment institution. Bank transfer details are used only to match your order.

Third-party service providers and international transfers

To provide the service, data is hosted or processed by the following providers: Google Firebase (authentication, database, file storage, app security, notifications, mobile analytics and crash reports), Vercel (site hosting and cookieless analytics), Daily.co (video lesson infrastructure), Resend (email delivery) and iyzico (payments). Transfers to providers whose servers are located abroad (US) rely on the mechanisms under Article 9 of the KVKK and on the explicit consent obtained during checkout. Site analytics also uses PostHog in the EU region. Analytics starts automatically unless previously turned off on this device, and can be turned off using Privacy preferences. Apple services are also used for mobile Sign in with Apple and APNs notification delivery, and Google services for Google sign-in.

Retention and security

Order and invoice records are kept for the minimum periods required by law; account and learning data is kept while your account is active and for a reasonable archival period. All connections are encrypted with SSL (HTTPS); access to data is limited to what is necessary to provide the service.

Submitted voice homework, written answers and teacher corrections form part of the learning records and follow the same retention approach. Deleting only the sign-in account does not automatically delete associated learning, order or file records. You can also request deletion of those records; an authorized person reviews and carries out the request. Records that must be retained by law remain subject to those obligations. Changing privacy preferences does not delete existing records or homework you have submitted.

Your rights

Under Article 11 of the KVKK you have the right to learn whether your data is processed, to request information about it, to access it, to have it corrected or deleted, to object to processing and to claim compensation for damages. Send your request to kaadiralan@gmail.com; it will be answered within 30 days at the latest.

Changes

When this policy is updated, the new version is published on this page and the date above is revised. For any privacy question: kaadiralan@gmail.com.

When analytics is enabled, the random code in a personal introductory-meeting link sent on WhatsApp is included in form-open, step-completion and submission events. Your teacher can associate that code with the phone number the link was created for in the teacher panel. Your phone number, form answers and voice recording are not sent to PostHog; the form is not recorded. The link code is not saved in browser storage. You can turn analytics off using Privacy preferences at the bottom of the form. Submitting the form still associates the application with the invitation when analytics is off. Forwarding a link may associate another person’s application with that link; the link does not verify identity.