KVKK Privacy Notice
Last updated: November 3, 2026
In accordance with Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”), Exalang AI, as data controller, explains below for what purposes and on what legal grounds we process your personal data, to whom we transfer it, and what your rights are.
1. Data Controller
Exalang AI
Address: Fişekhane Cad. No:5 Carousel AVM 2B Katı, 34158 Bakırköy/İstanbul
Phone: 0212 660 43 43
Email: [email protected]
Web: exalang.ai
2. Personal Data We Process
- Identity and contact: name and surname, email address; profile photo when you sign in with Google.
- Account and security: password hash, session records, IP address, device/browser information.
- Learning and performance: exam and exercise answers, Writing texts, Speaking audio recordings and transcripts, handwriting images, scores and progress data, target band.
- Customer transactions: purchased package, access period, payment and invoice records (excluding card details).
- Marketing: campaign email preferences only if you have consented; cookie identifiers only if you have accepted cookies.
- Requests and complaints: support and live chat messages.
3. Purposes and Legal Grounds
- Membership, providing the learning service, AI scoring and feedback, progress tracking, purchases and payments: establishment and performance of a contract (KVKK Art. 5/2-c).
- Invoicing, accounting, statutory retention and requests from public authorities:explicitly provided for by law and compliance with a legal obligation (Art. 5/2-a and ç).
- Information security, abuse prevention, improving service quality and responding to support requests: legitimate interest (Art. 5/2-f).
- Analytics and advertising cookies, the live support tool, campaign and announcement emails: your explicit consent (Art. 5/1). These consents are optional; not giving them does not affect your membership, and you can withdraw them at any time.
4. Method of Collection
Your personal data is collected electronically and by automated means through registration and login forms, Google sign-in, the exercises you complete on the Platform, notifications from the payment provider, support channels and (if you have consented) cookies.
5. Recipients and Transfers Abroad
To provide the service, your personal data is transferred to the service providers (data processors) listed below. Their servers are located outside Türkiye; transfers are made under KVKK Art. 9 on the basis of appropriate safeguards such as the standard contracts published by the Personal Data Protection Board and the providers’ data processing agreements. Data is transferred to analytics, advertising and live support providers only with your cookie consent.
| Recipient | Purpose | Data transferred | Country |
|---|---|---|---|
| DigitalOcean, LLC | Server and database hosting | Account, usage and exam/performance data, speaking recordings (transcribed on our server) | Outside Türkiye (DigitalOcean data center; company headquartered in the USA) |
| Google LLC — Gemini API | AI scoring of Writing and Speaking answers and feedback generation | Texts you write, transcripts of audio recordings, handwriting images | USA |
| Google LLC — Google ile Giriş | Signing in with a Google account (only if you choose this method) | Name, email, profile photo | USA |
| Modal Labs, Inc. | Generating the virtual examiner (avatar) video in speaking practice | Examiner scripts; requests containing no personal data | USA |
| Lemon Squeezy, LLC (Stripe, Inc.) | Payment collection and invoicing (merchant of record) | Name, email, billing address, payment and order details | USA |
| Resend, Inc. ve Google LLC (Gmail) | Sending verification codes, password resets and account emails | Name, email, email content | USA |
| Cloudflare, Inc. | Site security, DDoS protection and content delivery | IP address, browser and connection information | USA |
| Google LLC — Google Analytics ve Google Ads | Site usage statistics and ad conversion tracking (only with your cookie consent) | Cookie IDs, page view and event data, truncated IP | USA |
| tawk.to, Inc. | Live support chat (only with your cookie consent) | Chat content, your name/email (if you share them), browser information | USA |
Apart from these, your data may be transferred only to legally authorized public institutions, within the scope of their requests and our legal obligations. Your personal data is never sold.
6. Retention Period
Your data is kept for as long as you are a member and for the periods required by applicable law (e.g. 10 years for commercial and tax records); after that it is deleted, destroyed or anonymized. If you delete your account, data that we are not legally required to retain is deleted.
7. Your Rights under Article 11 of the KVKK
By applying to the data controller, you have the right to:
- learn whether your personal data is processed and, if so, request information about it,
- learn the purpose of processing and whether it is used in line with that purpose,
- know the third parties in Türkiye or abroad to whom it is transferred,
- request correction if it is incomplete or inaccurate,
- request its deletion or destruction under the conditions of KVKK Art. 7,
- request that correction, deletion and destruction be notified to the third parties it was transferred to,
- object to a result against you arising solely from analysis by automated systems,
- claim compensation if you suffer damage due to unlawful processing.
8. How to Apply
In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your requests from your registered email address to [email protected], or in writing to Fişekhane Cad. No:5 Carousel AVM 2B Katı, 34158 Bakırköy/İstanbul. Your application will be concluded free of charge within 30 days at the latest.
For more details, please see the Privacy Policy and the Cookie Policy.