Privacy Policy
Last Update: November 2, 2026
MobiKreş and Renkli Kalem are management software used by preschools to run their student, parent and staff processes; below we refer to both of them simply as the "App". This document is both a privacy policy and a disclosure notice under Turkish Personal Data Protection Law No. 6698 (KVKK) and serves as our transparency notice under the GDPR.
In short
- The data controller for student data is the institution your child is enrolled in; MobiKreş processes that data on the institution's behalf.
- Student records, daily reports, messages, photos and videos are hosted in Europe.
- Authentication and push notification infrastructure are Google's global services; data is transferred abroad for these two paths. The full list is in section 6.
- Your data is never sold, never used for advertising, and never used to train artificial intelligence models.
- Card details are never collected; no credit card payment is processed through the App.
1. Who is the data controller?
The law distinguishes two roles: the data controller, who decides why and how data is processed, and the data processor, who processes it according to those instructions.
- For student, parent and staff data, the data controller is the institution the child is enrolled in (the preschool). The institution decides what data is collected; informing parents and obtaining the required explicit consent are its responsibility. MobiKreş processes this data only on the institution's instructions and only as far as the service requires.
- For website visits, contact form submissions, demo requests and support correspondence, MobiKreş is the data controller.
2. Personal data processed
- Identity: student's and parent's name, date of birth, class; staff name, title and field.
- Contact: email address, phone number.
- Education and daily tracking: attendance, pickup and handover records, sleep and nutrition information, end-of-day report, activity and development observations.
- Photos and videos: classroom activity footage, profile photo, documents shared by the institution.
- Payments and collections: fee plan, payment records. Card number, CVC or bank credentials are never collected at any stage.
- Read status: when you first open an announcement, survey, document or gallery post. Only the school's management and the staff member who published the content can see it; other parents cannot.
- Technical and security records: sign-in records, session information, the device's notification token, and activity logs showing who accessed which record.
- Health (special category data): allergy and allergen information, the name, dose and time of medication handed to the institution, height and weight measurements, and health notes entered by the institution.
3. Purposes and legal grounds
- Enabling the institution to run its student, class, staff and attendance processes,
- Keeping parents informed about their child's day and allowing communication with the institution,
- Managing the secure pickup flow (who is authorised to collect the child),
- Tracking fees and collections,
- Delivering health-related precautions on time (allergen warning, medication reminder),
- Service security and compliance with legal obligations.
Data is processed on the grounds of performance of the contract between the institution and the parent (KVKK Art. 5/2-c), compliance with the institution's legal obligations (Art. 5/2-ç) and legitimate interest in the security of the service (Art. 5/2-f). Health data and the sharing of a child's photos or videos additionally require explicit consent (Art. 6/2). Consent is obtained separately from this notice, and only by the institution.
4. Health data, photos and videos
Allergy, medication and growth measurements are necessary for a child's safety, yet they belong to the most strictly protected category of personal data. Therefore:
- These fields are filled in by the institution only with the parent's explicit consent; without consent they are left empty and the rest of the service continues to work.
- Health data is accessible only to the child's own parent and to staff authorised by the institution.
- Allergen warnings are sent only to the parent of the child concerned and to authorised staff.
- This data is never used for advertising, profiling or analytics, and is shared with no one other than the infrastructure providers listed in section 6.
- Please note: push notifications reach your device through Google's notification infrastructure, and the notification text may contain your child's name and the subject of the warning.
Activity photos are shown only to the parents of the class the institution shared them with and to authorised staff; they are never published at a publicly reachable address. If you do not want your child's photo shared, informing your institution is enough; explicit consent can be withdrawn at any time.
The App is not directed at children; it is used by parents, teachers and institution administrators.
5. Reports, blocking and content moderation
The App has zero tolerance for objectionable content and abusive behaviour; the rules are set out in the Terms of Use.
- Reporting: You can report an inappropriate message, gallery post, comment or person from within the App. A report records who made it, the reason chosen, your note if any, and an excerpt of the content at the time of the report. Reports are forwarded to the institution's management and reviewed within 24 hours; a report not resolved within that time is also escalated to MobiKreş. The content you reported is hidden from you until a decision is made, and you are notified of the outcome. Content that breaks the rules is removed; the responsible account may be suspended or closed.
- Blocking: You can block a person who bothers you; their messages and comments are no longer shown to you and their notifications no longer reach you. The blocked person can see that their messages are not delivered to you. The institution's management cannot be blocked; when a teacher blocks a parent, the management is informed.
- Objectionable language filter: If a message, caption, comment or announcement contains objectionable language, it is not sent. Messages and comments that reach the server are checked against the same list, and matching text is automatically reported to the institution's management. Photos and voice recordings are not scanned automatically; they are covered by reporting.
- Child safety: Content that exploits or endangers a child is removed immediately, the account is closed and the case is reported to the competent authorities as required by law; the content may be retained as evidence for that purpose. If a child is in immediate danger, first call the emergency number 112.
6. Recipients and international transfers
Data is never sold and never shared with third parties for advertising or marketing. Only the infrastructure providers below are used, purely to operate the service:
| Data | Provider and purpose | Location |
|---|---|---|
| Records, reports, messages | Google Cloud Firestore — database | Europe |
| Photos, videos, documents | Cloudflare R2 — file storage | Europe |
| Server logic (notifications, reporting) | Google Cloud Functions | Europe |
| Email, phone, hashed password | Firebase Authentication — identity | Outside Europe |
| Notification token and notification text | Firebase Cloud Messaging — push notifications | Outside Europe |
| Text or document sent to AI | Google Vertex AI — only when institution staff use the feature | Outside Europe |
| Name and email (password notice, invitation, support) | Resend — email delivery | Outside Europe |
Transfers marked "Outside Europe" fall under Article 9 of the KVKK and are necessary for the service to work; these providers process the data solely to deliver that service. Information may also be shared where a lawful request from a competent authority creates a legal obligation.
Cookies: the mobile app contains no analytics, advertising or crash-reporting tools. Google Analytics, the Google Ads conversion tag and Microsoft Clarity are used only on this website for visitor statistics and advertising measurement. You can block cookies through your browser settings.
7. Retention and deletion
- Data is retained while the institution's subscription and the child's enrolment continue.
- Photos and videos shared in the Moments Gallery are also kept while the institution's subscription continues; they are not deleted automatically. If the institution wants posts made before a certain date to be deleted, the deletion takes place on a date agreed between the institution and MobiKreş. The institution informs parents before the deletion and, if the institution allows downloads, parents can save the photos and videos to their own devices until that date. Deleted posts can be restored within 30 days and are then permanently deleted.
- Once a deletion request is fulfilled, data is removed from live systems. A copy of deleted data remains in backups for at most 98 days and is then deleted automatically: daily database backups are kept for 30 days, weekly database backups for 98 days and the user account backup for 30 days.
- Deleted photos, videos and documents are permanently removed from storage within 30 days; their copies in the file backup remain for at most 30 days after that.
- Records for which legislation requires a longer retention period (e.g. financial records) are kept for that period.
A parent or institution may request deletion of their account and their student's data. Simply send your request to destek@mobikres.com; it is completed within 30 days at the latest. Since the institution is the controller of student data, a deletion request concerning a currently enrolled student is fulfilled with the institution's approval.
8. Your rights and how to reach us
Under Article 11 of the KVKK you have the right to learn whether your personal data is processed, to request information about it, to learn the purpose of processing, to know the third parties to whom it is transferred at home or abroad, to request correction if it is incomplete or inaccurate, to request erasure where the conditions are met, to request that these actions be notified to the parties the data was transferred to, to object to a result against you produced solely by automated analysis, and to claim compensation for damages.
Requests concerning student data should first be addressed to the institution your child is enrolled in, as it is the data controller. If your request reaches us directly, we inform the institution in our capacity as processor and provide the support needed to fulfil it.
- ✉️ Email: destek@mobikres.com
- 📍 Web: www.mobikres.com
This document is updated whenever the infrastructure used or the applicable legislation changes; the update date appears at the top of the page.
Our technical and security practices (optional reading)
- Each institution's data is held in its own space; a user of one institution cannot reach another institution's data.
- Permissions are role-based (administrator, teacher, parent) and access decisions are made by server-side rules.
- All traffic is encrypted with TLS; data is stored encrypted at rest by the providers.
- Access to and changes in sensitive records are written to an activity log.
- You are asked to change your password at first sign-in; passwords are stored irreversibly and cannot be seen by anyone, including MobiKreş.
- The database can be restored to any minute within the last 7 days; daily backups are kept for 30 days and weekly backups, taken every Sunday, for 98 days. Database backups are stored in Europe.
- User account sign-in details are backed up every night in Europe; this backup is kept for 30 days.
- Photos, videos and documents are backed up to separate storage; a file deleted from the source remains in the backup for at most 30 more days.
- While photos and videos are being viewed, a copy of the file is cached on the server nearest to the device for up to 7 days.