Privacy Policy

Effective date: 2026-07-27 · Version: 1.0

This notice explains what personal data we process when you use the Mendum mobile app, why we process it, who we share it with, and how you can exercise your rights. It also serves as our information notice under the Turkish Personal Data Protection Law (KVKK) and the GDPR.

AI-related processing is covered by a separate document, the AI Processing Consent. That processing only begins if you give that separate consent.

1. Summary

• Mendum processes photos of questions you answered incorrectly, and the information extracted from them.
• The photo and the extracted question text are sent to Google’s AI service to generate solutions. We ask for your explicit consent for this.
• Your name and email are used only to manage your account; they are never sent to the AI service.
• No advertising, no third-party tracking, no data selling.
• You can delete your account from inside the app.

2. Data we process

2.1 Account data

2.2 App content data

2.3 Usage data

Your daily AI operation counter, per-subject and per-objective correct/incorrect counts, and timestamps of your mistake events. These are stored on our own infrastructure; we do not use any third-party analytics service.

2.4 Data that stays only on your device

Your nickname, target exam, interests, difficulty preference, language and region selection, downloaded solution texts and review-session state are stored only on your phone and are not sent to our servers. Deleting the app removes them from your device.

2.5 Data we do not process

We do not collect date of birth, age, national ID, phone number, postal address, location, contacts, health data or any other special-category personal data. We also never see your payment card details — subscriptions are processed by Apple and card data never reaches us.

3. Purposes and legal bases

The only processing based on consent is the transfer of your data to the AI service. You can withdraw that consent at any time via Profile → Legal → AI Processing Consent. Analysis, solution and practice-question generation will stop working, but your saved notebook, statistics and account remain intact.

4. Who we share data with

We do not sell your data and never share it for advertising. We use only the following service providers:

4.1 Google (AI processing)

Your question photo, the extracted question text, the answer you marked, your free-response answer and your selected interests are sent to Google’s Gemini AI interface to generate solutions and practice questions.

Not sent: your name, email address, account identifier or any other account data. What reaches Google contains no information that directly identifies you.

Note: any handwriting, marks or notes visible in the photo are transmitted as part of the image. We recommend not uploading photos that contain personal information (for example an exam paper with your name written on it).

This processing happens only if you have given explicit consent. Details: AI Processing Consent.

4.2 Supabase (infrastructure)

Your account data, app content and question images are hosted on Supabase infrastructure in the Amazon Web Services Frankfurt (Germany) region.

4.3 Apple

If you purchase a subscription, Apple processes the transaction. Apple only tells us whether your subscription is valid; your payment details are not shared with us.

4.4 Legal requests

We may disclose data to courts, prosecutors or administrative authorities where legally required, limited to the scope of the request.

5. International transfers

Because our servers are in Germany and AI processing takes place on Google infrastructure, your personal data is transferred outside Türkiye. Under KVKK Art. 9 this transfer relies on your explicit consent, which you give when creating your account and when granting AI processing consent.

6. How question images are stored — an honest note

So that the app can display them quickly, your question images are currently stored in a location that is accessible to anyone who knows the link. Link addresses contain a hard-to-guess identifier tied to your account and are never published outside the app or given to search engines. Even so, if a link address were obtained by someone else, they could view that image.

We are in the process of moving these images behind short-lived, signed links tied to your account. When that is complete this section will be updated and the version number raised. We describe it this way so as not to present the app as more secure than it currently is.

7. Anonymous question cache

To avoid processing the same question over and over, the question text, options and solution extracted from a question are stored in a shared cache. This cache:

• Contains no user identifier. It is not known which user a record came from.
• Does not include the answer you marked, your mistake cause or any other personal field.
• Does not include your photo.

Because these records are not personal data, they are not deleted when you delete your account; they continue to be used when generating solutions for the same question for other users.

8. Retention periods

9. Deleting your account and data

You can permanently delete your account from inside the app via Profile → Legal → Delete Account. Deletion cannot be undone and covers: your account, your question photos (including archived copies), your mistake notebook, questions generated for you, your statistics, your feedback and your plan record.

Not deleted: the anonymous question cache described in section 7, and any records we are legally required to retain.

Important: Deleting your account does not cancel your App Store subscription. Cancel it separately on your iPhone via Settings → your Apple Account → Subscriptions.

If you cannot access the app, you can also request deletion via our account deletion page.

10. Your rights

Under KVKK Art. 11 and GDPR Art. 15-22 you have the right to:

• Learn whether your personal data is processed and request information about it
• Learn the purpose of processing and whether it is used in line with that purpose
• Know the third parties to whom your data is transferred, domestically or abroad
• Request correction of incomplete or inaccurate data
• Request erasure or destruction of your data
• Request that correction and erasure be notified to third parties the data was transferred to
• Object to a result produced against you solely through automated analysis
• Claim compensation if you suffer damage due to unlawful processing
• Withdraw your consent
• Receive a portable copy of your data

Send requests to the email address in the imprint below. We respond within 30 days at the latest.

11. About automated classification

Mendum automatically sorts your mistakes into four causes and generates questions accordingly. This classification exists only to personalize your study experience; it does not produce a decision with legal effect or similarly significant impact on you. You can change the classification yourself at any time inside the app.

12. Children’s data

Mendum is aimed at students preparing for exams such as LGS, YKS, SAT and AP; some of our users are under 18.

• If you are under 13 you may not use Mendum.
• If you are between 13 and 18, you may use the app only with the knowledge and consent of your parent or legal guardian. By creating an account you confirm that you have that consent.
• As a parent or legal guardian you may request deletion of your child’s account; we will do so after verifying identity.

13. Security

• Each user can access only their own data; this restriction is enforced at the database level (row-level security policies), not merely in the app.
• AI service credentials are held server-side only and are never embedded in the app bundle.
• Usage limits are enforced on the server and cannot be bypassed by the client.
• Connections are encrypted in transit (TLS).
• For the access model of question images, see section 6.

14. Changes

When we update this notice we change the version number and effective date. For changes that materially affect you we show an in-app notification and, where necessary, ask for your consent again. Which version you accepted is recorded on your account.

Data controller and contact

Requests are answered within 30 days at the latest.