> ## Documentation Index > Fetch the complete documentation index at: https://docs.lala.ist/llms.txt > Use this file to discover all available pages before exploring further. # Privacy Policy > How Lala collects, uses, shares, and protects personal data. **Version 1.0. Effective date: 18 August 2026.** This policy explains how we handle personal data in the Lala mobile application and the Lala service. Read it with the [Terms of Service](/legal/terms-of-service). This policy is also available in [Turkish](/legal/gizlilik-politikasi). If the two versions conflict, the Turkish version governs for a consumer in Türkiye. ## 1. Who we are Lala is an artificial intelligence study companion for students who prepare for the Turkish YKS and LGS examinations. Derece Kampüsü Eğitim ve Ticaret Limited Şirketi operates Lala. The data controller is: | Item | Value | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------ | | Controller | Derece Kampüsü Eğitim ve Ticaret Limited Şirketi | | Registered address | Bahçelievler Mah. 323/1 Cad. C Blok, Gazi Üniversitesi Teknokent Binası, No: 10/50C, İç Kapı No: 22, Gölbaşı / Ankara, Türkiye | | Telephone | +90 (312) 870 00 28 | | Company e-mail | [info@derecekampusu.com](mailto:info@derecekampusu.com) | | Privacy contact | [privacy@lala.ist](mailto:privacy@lala.ist) | | Support contact | [destek@lala.ist](mailto:destek@lala.ist) | In this policy, "we", "us", and "our" mean the controller named above. "You" means the person who uses Lala. "Service" means the Lala application, the Lala API at `client-api.lala.ist`, and every related feature. We are the data controller under the Turkish Personal Data Protection Law No. 6698 (KVKK). We are also the controller under the General Data Protection Regulation (EU) 2016/679 (GDPR) for users in the European Economic Area. ## 2. Scope of this policy This policy applies to the Lala mobile application and to the Lala backend service. It does not apply to a third-party website or service that you reach from a link in Lala. ## 3. Personal data that we collect We collect the data below. The table names each category, the specific data, and the source. ### 3.1 Identity and contact data | Data | Source | | ------------------------------------- | ------------------------------------------------- | | First name, last name, preferred name | You, at sign-up and in settings | | E-mail address | You, or your Google account | | Mobile telephone number | You, at sign-up with a one-time SMS code | | Profile picture URL | Your Google account, when you sign in with Google | | Account identifier | Created by our authentication provider | ### 3.2 Study profile data We collect the examination type (YKS or LGS), the field, the school grade, the target ranking, the daily study hours, the strong subjects, and the weak subjects. We also collect optional context that helps Lala give better guidance. This context includes the study location, attendance at a private course (kurs), preferred books, preferred teachers, the communication style, and topics that you ask Lala to treat with care. ### 3.3 Conversation data We collect and store every message between you and Lala. This data includes: * The text of your messages and of Lala's replies. * Photographs and files that you attach to a message, and the original file name. * Reactions that you add to a message. * Summaries of your conversations that the model writes. * Notes and a private notebook that the model keeps about your study situation. ### 3.4 Voice call data When you start a voice call with Lala, we process your microphone audio in real time. We store a written transcript of the call and a summary of the call. We do not store the audio recording itself. ### 3.5 Study and performance data We collect your practice examination results (denemeler), including the examination name, the publisher, the date, the per-subject correct, incorrect, and blank counts, the calculated net scores, and your notes. We also collect your study plan blocks, your completed study time, and your study streak. ### 3.6 Technical data We collect the data that the service needs to operate. This data includes the request time, the API endpoint, error records, model usage records, and cost records. A model usage record holds your account identifier, the model name, and token counts. It does not hold message text. The application also reads the device model, the operating system version, and the application version. The application keeps this technical data on your device. It leaves your device only when you send a diagnostic report to us yourself. ### 3.7 Data that we do not collect We do not collect location data. We do not collect contacts. We do not use advertising identifiers. We do not use a tracking or attribution SDK. We do not sell personal data. ## 4. Why we process personal data, and our legal basis | Purpose | Data used | KVKK basis | GDPR basis | | ------------------------------------------- | ----------------------------------------------------- | -------------------------------------- | ---------------------------------- | | Create and manage your account | Identity, contact | Art. 5/2(c) — necessary for a contract | Art. 6(1)(b) — contract | | Give the AI study guidance that you ask for | Conversation, study profile, study and performance | Art. 5/2(c) — necessary for a contract | Art. 6(1)(b) — contract | | Run a voice call | Voice audio, transcript | Art. 5/2(c) — necessary for a contract | Art. 6(1)(b) — contract | | Remember your situation between sessions | Summaries, notes, notebook | Art. 5/2(c) — necessary for a contract | Art. 6(1)(b) — contract | | Send a reminder or a check-in message | Account identifier, message text | Explicit consent (Art. 5/1) | Art. 6(1)(a) — consent | | Develop, evaluate, and fine-tune our models | Conversation, voice transcript, study and performance | Art. 5/2(f) — legitimate interest | Art. 6(1)(f) — legitimate interest | | Keep the service secure and correct | Technical | Art. 5/2(f) — legitimate interest | Art. 6(1)(f) — legitimate interest | | Measure and control model cost | Technical, account identifier | Art. 5/2(f) — legitimate interest | Art. 6(1)(f) — legitimate interest | | Manage a subscription or a credit purchase | Identity, purchase records | Art. 5/2(c) — necessary for a contract | Art. 6(1)(b) — contract | | Meet a legal obligation | As required | Art. 5/2(a) — legal obligation | Art. 6(1)(c) — legal obligation | You can withdraw consent for push notifications at any time. Turn off notifications in your device settings, or write to [privacy@lala.ist](mailto:privacy@lala.ist). A withdrawal does not affect processing that happened before the withdrawal. You can object to the use of your data for model improvement. Section 5.1 explains how. ### 4.1 Special categories of data Lala does not ask for health data, religious belief, or any other special category of personal data. A conversation with a study companion can still contain such information, because you write in free text. We do not use this information for any purpose other than the reply that you asked for. CAUTION: Do not write information about your health, your beliefs, or another person into a chat message or a voice call. ## 5. How Lala uses artificial intelligence Lala answers with a large language model. To produce an answer, we send the following to our model providers: * Your recent messages, up to the last 60 messages. * Your study profile, your notes, your notebook, and your conversation summaries. * Your study plan for the last day and the next six days. * Your practice examination profile. * Up to four images that you attached. * Excerpts from a reference collection of study-coaching conversations. Our model providers process this data to generate the reply. Our contracts with them do not permit them to use your data to train their own models. Lala can also do the following: * Search the web when a question needs current information. We send the search words only. * Query the public YÖK Atlas university data service through a third-party server. We send the query words only. Lala does not make an automated decision that produces a legal effect for you, and it does not profile you for any such decision. Lala gives study guidance. You decide what to do with it. ### 5.1 Using your data to develop our models We use your conversations, your voice call transcripts, and your study and performance data to develop, to measure, and to fine-tune our artificial intelligence models and prompts. This work includes the models that run Lala. It can also include a general-purpose model that we develop for another product or another purpose. We apply the following limits to this work: * We remove or replace direct identifiers before the data enters a training or an evaluation set. Direct identifiers are the name, the e-mail address, the telephone number, and the account identifier. * We do not sell a dataset that contains your data, and we do not license one to another company. * A model that we develop does not reproduce your conversations. We test each model to confirm this. * Our model providers may not use your data to train their own models, under our contracts with them. * Only the staff who do this work can read the data, and each one is under a duty of confidentiality. Our legal basis is legitimate interest, under KVKK Article 5/2(f) and GDPR Article 6(1)(f). Our interest is to develop artificial intelligence models that give correct guidance in the correct register. We balanced this interest against your privacy, and the limits above are the result of that balance. **You can object at any time.** Write to [privacy@lala.ist](mailto:privacy@lala.ist) and state that you do not want your data used for model improvement. We stop within 30 days, and we remove your data from a future training or evaluation set. An objection does not change the answers that you get, and it does not limit any other part of the Service. We cannot remove your data from a model that we already trained. WARNING: A language model can produce a wrong or incomplete answer. Check important facts, such as an examination date, a quota, or a ranking, against an official source. ## 6. Who we share personal data with We share personal data with the service providers below. Each one acts as a data processor for us, under a contract. | Provider | Purpose | Data shared | Location | | -------------------- | ------------------------------------------------------------ | ------------------------------------------------------------- | -------------- | | Supabase | Database, authentication, file storage | All account and application data | Ireland (EU) | | OpenRouter | Access to language models for chat, summaries, and reminders | Prompt content described in section 5, and the model reply | United States | | Google (Gemini API) | Voice call model, and text embeddings for search | Live call audio, call transcript, prompt content, search text | United States | | OneSignal | Push notification delivery | Account identifier, notification text | United States | | Langfuse | Model tracing and quality analysis | Prompt content, model replies, account identifier | European Union | | YÖK Atlas MCP server | Public university and quota data | Query words only | Unknown | | Hetzner Online GmbH | Application server hosting | All data in transit and in process | Finland (EU) | | Apple, Google | Application distribution, purchases, subscriptions | Purchase and subscription records | United States | We also disclose personal data when the law requires it. We disclose it to a court, a prosecutor, or a public authority that makes a lawful request. If we sell or transfer the business, we transfer personal data to the buyer under this policy. We do not share personal data with an advertiser or a data broker. ## 7. International transfers Our servers and our database are in the European Union. Some of our processors are in the United States, as section 6 shows. For a transfer out of Türkiye under KVKK Article 9, we rely on a standard contract (standart sözleşme) with the recipient, or on your explicit consent where a standard contract does not apply. For a transfer out of the European Economic Area under GDPR Chapter V, we rely on the European Commission Standard Contractual Clauses, or on an adequacy decision where one applies. You can ask for a copy of the transfer safeguards. Write to [privacy@lala.ist](mailto:privacy@lala.ist). ## 8. How long we keep personal data | Data | Retention period | | ----------------------------------------------------------- | -------------------------------------- | | Account, profile, conversation, study, and performance data | While your account is active | | Voice call transcript and summary | While your account is active | | Media files | While your account is active | | Data in a training or an evaluation set | 36 months from the date that we add it | | Model usage and cost records | 24 months | | Records that a tax or commercial law requires | 10 years, as Turkish law requires | When you delete your account, we delete your personal data within 30 days. We keep only the data that a law requires us to keep, and we keep it for the period that the law states. An account deletion also removes your data from a future training or evaluation set. It cannot remove your data from a model that we already trained, because a trained model does not hold the original records. ## 9. Your rights Under KVKK Article 11, you have the right to do the following: 1. Learn whether we process your personal data. 2. Ask for information about the processing. 3. Learn the purpose of the processing, and learn whether we use the data for that purpose. 4. Learn the third parties, in Türkiye or abroad, that receive your personal data. 5. Ask us to correct incomplete or incorrect personal data. 6. Ask us to delete or destroy your personal data. 7. Ask us to tell the third parties in item 4 about a correction or a deletion. 8. Object to a result that comes only from automated analysis, when the result harms you. 9. Ask for compensation for damage that comes from unlawful processing. Under GDPR Articles 15 to 22, you also have the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, the right to object, and the right to withdraw consent. ### 9.1 How to exercise a right Write to [privacy@lala.ist](mailto:privacy@lala.ist) from the e-mail address on your account. State the right that you want to exercise. We answer a KVKK request within 30 days. We answer a GDPR request within one month. We can extend a GDPR answer by two months for a complex request, and we tell you when we do. We do not charge a fee. If a request is clearly excessive or repeated, we can charge the fee that the Personal Data Protection Board tariff states. ### 9.2 How to complain If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) at `kvkk.gov.tr`. If you are in the European Economic Area, you can complain to the supervisory authority of the country where you live. ## 10. Children and parental consent Lala is for students who are 13 years old or older. If you are under 18, a parent or a legal guardian must read this policy and must consent before you use Lala. By using Lala, you confirm that your parent or your guardian gave this consent. A parent or a guardian can ask to see, to correct, or to delete the personal data of their child. Write to [privacy@lala.ist](mailto:privacy@lala.ist). We can ask for proof of identity and of the parental relationship before we act. If we learn that a child under 13 uses Lala, we close the account and we delete the personal data. ## 11. Security We protect personal data with the measures below: * All traffic between the application and our servers uses TLS encryption. * The database is private. It is not open to the public internet, and row-level security denies every direct client connection. * Media files are in a private storage bucket. Each read needs a signed link that expires after one hour. Each upload needs a signed link that expires after 15 minutes. * Access to production systems is limited to the staff who need it. * Secrets are encrypted at rest and are never held in plain text in our code repository. No system is completely secure. We cannot guarantee absolute security. If a personal data breach creates a risk to you, we notify you and we notify the Personal Data Protection Board within 72 hours, as KVKK and GDPR require. ## 12. Data on your device The application stores the following on your device: * Your sign-in session. * A cache of your last 100 chat messages, so that the conversation opens fast. * Application log files, for fault diagnosis. The application hides tokens, keys, and telephone numbers in these files. This data stays on your device. It leaves the device only when you send a diagnostic report to us yourself. Delete the application to remove this data. ## 13. Cookies The Lala mobile application does not use cookies. Our documentation website uses only the cookies that the site needs to operate. ## 14. Changes to this policy We can change this policy. When we make a material change, we tell you in the application or by e-mail at least 15 days before the change starts. The date at the top of this page shows the current version. Continued use after the change starts means that you accept the new policy. ## 15. Contact For a privacy question or a data subject request, write to **[privacy@lala.ist](mailto:privacy@lala.ist)**. For general support, write to **[destek@lala.ist](mailto:destek@lala.ist)**.