Privacy Policy

​

1. Who we are

Lala is an artificial intelligence study companion for students who prepare for the Turkish YKS and LGS examinations. Derece Kampüsü Eğitim ve Ticaret Limited Şirketi operates Lala. The data controller is: In this policy, “we”, “us”, and “our” mean the controller named above. “You” means the person who uses Lala. “Service” means the Lala application, the Lala API at client-api.lala.ist, and every related feature. We are the data controller under the Turkish Personal Data Protection Law No. 6698 (KVKK). We are also the controller under the General Data Protection Regulation (EU) 2016/679 (GDPR) for users in the European Economic Area.

​

2. Scope of this policy

This policy applies to the Lala mobile application and to the Lala backend service. It does not apply to a third-party website or service that you reach from a link in Lala.

​

3. Personal data that we collect

We collect the data below. The table names each category, the specific data, and the source.

​

3.1 Identity and contact data

​

3.2 Study profile data

We collect the examination type (YKS or LGS), the field, the school grade, the target ranking, the daily study hours, the strong subjects, and the weak subjects. We also collect optional context that helps Lala give better guidance. This context includes the study location, attendance at a private course (kurs), preferred books, preferred teachers, the communication style, and topics that you ask Lala to treat with care.

​

3.3 Conversation data

We collect and store every message between you and Lala. This data includes:

• The text of your messages and of Lala’s replies.
• Photographs and files that you attach to a message, and the original file name.
• Reactions that you add to a message.
• Summaries of your conversations that the model writes.
• Notes and a private notebook that the model keeps about your study situation.

​

3.4 Voice call data

When you start a voice call with Lala, we process your microphone audio in real time. We store a written transcript of the call and a summary of the call. We do not store the audio recording itself.

​

3.5 Study and performance data

We collect your practice examination results (denemeler), including the examination name, the publisher, the date, the per-subject correct, incorrect, and blank counts, the calculated net scores, and your notes. We also collect your study plan blocks, your completed study time, and your study streak.

​

3.6 Technical data

We collect the data that the service needs to operate. This data includes the request time, the API endpoint, error records, model usage records, and cost records. A model usage record holds your account identifier, the model name, and token counts. It does not hold message text. The application also reads the device model, the operating system version, and the application version. The application keeps this technical data on your device. It leaves your device only when you send a diagnostic report to us yourself.

​

3.7 Data that we do not collect

We do not collect location data. We do not collect contacts. We do not use advertising identifiers. We do not use a tracking or attribution SDK. We do not sell personal data.

​

4. Why we process personal data, and our legal basis

You can withdraw consent for push notifications at any time. Turn off notifications in your device settings, or write to privacy@lala.ist. A withdrawal does not affect processing that happened before the withdrawal. You can object to the use of your data for model improvement. Section 5.1 explains how.

​

4.1 Special categories of data

Lala does not ask for health data, religious belief, or any other special category of personal data. A conversation with a study companion can still contain such information, because you write in free text. We do not use this information for any purpose other than the reply that you asked for. CAUTION: Do not write information about your health, your beliefs, or another person into a chat message or a voice call.

​

5. How Lala uses artificial intelligence

Lala answers with a large language model. To produce an answer, we send the following to our model providers:

• Your recent messages, up to the last 60 messages.
• Your study profile, your notes, your notebook, and your conversation summaries.
• Your study plan for the last day and the next six days.
• Your practice examination profile.
• Up to four images that you attached.
• Excerpts from a reference collection of study-coaching conversations.

Our model providers process this data to generate the reply. Our contracts with them do not permit them to use your data to train their own models. Lala can also do the following:

• Search the web when a question needs current information. We send the search words only.
• Query the public YÖK Atlas university data service through a third-party server. We send the query words only.

Lala does not make an automated decision that produces a legal effect for you, and it does not profile you for any such decision. Lala gives study guidance. You decide what to do with it.

​

5.1 Using your data to develop our models

We use your conversations, your voice call transcripts, and your study and performance data to develop, to measure, and to fine-tune our artificial intelligence models and prompts. This work includes the models that run Lala. It can also include a general-purpose model that we develop for another product or another purpose. We apply the following limits to this work:

• We remove or replace direct identifiers before the data enters a training or an evaluation set. Direct identifiers are the name, the e-mail address, the telephone number, and the account identifier.
• We do not sell a dataset that contains your data, and we do not license one to another company.
• A model that we develop does not reproduce your conversations. We test each model to confirm this.
• Our model providers may not use your data to train their own models, under our contracts with them.
• Only the staff who do this work can read the data, and each one is under a duty of confidentiality.

Our legal basis is legitimate interest, under KVKK Article 5/2(f) and GDPR Article 6(1)(f). Our interest is to develop artificial intelligence models that give correct guidance in the correct register. We balanced this interest against your privacy, and the limits above are the result of that balance. You can object at any time. Write to privacy@lala.ist and state that you do not want your data used for model improvement. We stop within 30 days, and we remove your data from a future training or evaluation set. An objection does not change the answers that you get, and it does not limit any other part of the Service. We cannot remove your data from a model that we already trained. WARNING: A language model can produce a wrong or incomplete answer. Check important facts, such as an examination date, a quota, or a ranking, against an official source.

​

6. Who we share personal data with

We share personal data with the service providers below. Each one acts as a data processor for us, under a contract. We also disclose personal data when the law requires it. We disclose it to a court, a prosecutor, or a public authority that makes a lawful request. If we sell or transfer the business, we transfer personal data to the buyer under this policy. We do not share personal data with an advertiser or a data broker.

​

7. International transfers

Our servers and our database are in the European Union. Some of our processors are in the United States, as section 6 shows. For a transfer out of Türkiye under KVKK Article 9, we rely on a standard contract (standart sözleşme) with the recipient, or on your explicit consent where a standard contract does not apply. For a transfer out of the European Economic Area under GDPR Chapter V, we rely on the European Commission Standard Contractual Clauses, or on an adequacy decision where one applies. You can ask for a copy of the transfer safeguards. Write to privacy@lala.ist.

​

8. How long we keep personal data

When you delete your account, we delete your personal data within 30 days. We keep only the data that a law requires us to keep, and we keep it for the period that the law states. An account deletion also removes your data from a future training or evaluation set. It cannot remove your data from a model that we already trained, because a trained model does not hold the original records.

​

9. Your rights

Under KVKK Article 11, you have the right to do the following:

1. Learn whether we process your personal data.
2. Ask for information about the processing.
3. Learn the purpose of the processing, and learn whether we use the data for that purpose.
4. Learn the third parties, in Türkiye or abroad, that receive your personal data.
5. Ask us to correct incomplete or incorrect personal data.
6. Ask us to delete or destroy your personal data.
7. Ask us to tell the third parties in item 4 about a correction or a deletion.
8. Object to a result that comes only from automated analysis, when the result harms you.
9. Ask for compensation for damage that comes from unlawful processing.

Under GDPR Articles 15 to 22, you also have the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, the right to object, and the right to withdraw consent.

​

9.1 How to exercise a right

Write to privacy@lala.ist from the e-mail address on your account. State the right that you want to exercise. We answer a KVKK request within 30 days. We answer a GDPR request within one month. We can extend a GDPR answer by two months for a complex request, and we tell you when we do. We do not charge a fee. If a request is clearly excessive or repeated, we can charge the fee that the Personal Data Protection Board tariff states.

​

9.2 How to complain

If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) at kvkk.gov.tr. If you are in the European Economic Area, you can complain to the supervisory authority of the country where you live.

​

10. Children and parental consent

Lala is for students who are 13 years old or older. If you are under 18, a parent or a legal guardian must read this policy and must consent before you use Lala. By using Lala, you confirm that your parent or your guardian gave this consent. A parent or a guardian can ask to see, to correct, or to delete the personal data of their child. Write to privacy@lala.ist. We can ask for proof of identity and of the parental relationship before we act. If we learn that a child under 13 uses Lala, we close the account and we delete the personal data.

​

11. Security

We protect personal data with the measures below:

• All traffic between the application and our servers uses TLS encryption.
• The database is private. It is not open to the public internet, and row-level security denies every direct client connection.
• Media files are in a private storage bucket. Each read needs a signed link that expires after one hour. Each upload needs a signed link that expires after 15 minutes.
• Access to production systems is limited to the staff who need it.
• Secrets are encrypted at rest and are never held in plain text in our code repository.

No system is completely secure. We cannot guarantee absolute security. If a personal data breach creates a risk to you, we notify you and we notify the Personal Data Protection Board within 72 hours, as KVKK and GDPR require.

​

12. Data on your device

The application stores the following on your device:

• Your sign-in session.
• A cache of your last 100 chat messages, so that the conversation opens fast.
• Application log files, for fault diagnosis. The application hides tokens, keys, and telephone numbers in these files.

This data stays on your device. It leaves the device only when you send a diagnostic report to us yourself. Delete the application to remove this data.

​

13. Cookies

The Lala mobile application does not use cookies. Our documentation website uses only the cookies that the site needs to operate.

​

14. Changes to this policy

We can change this policy. When we make a material change, we tell you in the application or by e-mail at least 15 days before the change starts. The date at the top of this page shows the current version. Continued use after the change starts means that you accept the new policy.

​

15. Contact

For a privacy question or a data subject request, write to privacy@lala.ist. For general support, write to destek@lala.ist.