Privacy Policy
EduDiamond AI is a mobile app (iOS and Android) under the EduDiamond brand that solves the school question you photograph or type, step by step, with the help of AI. This policy explains which personal data is processed when you use the app, why, and which rights you have, under Turkish Personal Data Protection Law No. 6698 (KVKK). The Turkish version prevails in case of conflict.
If you sign in with your EduDiamond account (through your institution), the EduDiamond Privacy Policy and EduDiamond KVKK Information Notice also apply.
1. Who is responsible for which data
EduDiamond AI acts in two roles:
- Users signing in with an EduDiamond institution account: the school the student is registered with is the data controller for student data. Codesseum Yapay Zeka Hiz. San. Tic. Ltd. Şti. (“Codesseum”) is the data processor, acting on the institution’s instructions and only to provide the service.
- Individual users (own account via Apple, Google or email): Codesseum is the data controller.
Data controller: Codesseum Yapay Zeka Hiz. San. Tic. Ltd. Şti.
Fevzi Çakmak Mah. İstanbul Cad. No 68/4, Yalova, Türkiye
Email: help@edudiamond.com
2. Data we process
| Data | Purpose | Legal basis |
|---|---|---|
| Account: Firebase user ID, email address, sign-in method (Apple, Google, email link, EduDiamond), your name; for institution users, institution and branch | Create your account and sign you in | Performance of contract (KVKK Art. 5/2-c) |
| Profile: grade, goal (school, LGS, YKS), birth year | Explain solutions at your level; ask for parental consent under 13 | Contract; legal obligation |
| Parent details (individual users under 13): parent name and email, consent time | Obtain and record parental consent | Legal obligation; parental consent |
| Question photos and text, follow-up and topic questions, generated solutions | Solve your question step by step, explain topics | Contract; explicit consent for transfer abroad (Art. 9) |
| Notebook entries and notes | Show the solutions you saved | Contract |
| Usage counters: daily solutions and questions, error counts | Apply the daily limit, prevent abuse, improve the service | Legitimate interest (Art. 5/2-f) |
| Subscription: store product ID, transaction ID, expiry, status | Verify your Plus subscription | Contract |
| Technical data: IP address, request time, app version, error logs | Security, rate limiting, debugging | Legitimate interest; legal obligation (Law No. 5651) |
Special categories of personal data (health, beliefs, political opinions, etc.) are never required; please do not include them in question photos. Your payment details never reach us; Apple or Google takes the payment.
3. AI solutions and transfer abroad
The content needed to solve your question is sent to our AI provider. Current provider: Anthropic PBC (Claude), USA.
- Content is limited to the task: question photo/text, follow-up and topic questions, grade and goal. Your name, email, account ID and institution are not sent.
- Purpose: only to solve your question and explain the topic.
- Model training: the provider does not use the content to train its AI models.
- Transfer abroad: based on your explicit consent under KVKK Art. 9. Consent is asked in the app before the first solution; you can withdraw it any time via Profile > “Withdraw AI consent”. After withdrawal no new questions can be solved; your notebook and records stay.
- Outputs are suggestions: AI can make mistakes; check solutions with your teacher or textbook. Outputs are not used to make automated decisions about you (grades, assessments, etc.).
4. Sharing
We do not sell or rent your data or share it for advertising or marketing. Data is shared only as needed to run the service, with contracted providers:
- Hosting: account, question, notebook and counter data are stored on our server in Türkiye (Istanbul).
- Google LLC – Firebase Authentication and Hosting (USA): sign-in and authentication, hosting of these pages (KVKK Art. 9).
- AI: Anthropic PBC (USA), under section 3 above.
- Payments: Apple Inc. / Google LLC (App Store, Google Play): app distribution and subscription payments; they are independent controllers for payments under their own privacy policies.
- EduDiamond institution: for institution users, at the institution’s request and within the law.
- Competent authorities: only when legally required.
5. Retention
- Account and profile: while your account is open.
- Solutions and photos saved to your notebook: until you delete them or your account.
- Solutions and photos not saved to your notebook: 90 days, then deleted automatically.
- Daily usage counters: 90 days. Aggregate, non-personal statistics may be kept indefinitely.
- Subscription records and other records the law requires us to keep: for the statutory period.
- Technical logs: up to 2 years (Law No. 5651).
Expired data is deleted, destroyed or anonymised. To delete your account: Account and Data Deletion.
6. Security
Connections are encrypted with HTTPS. Authentication uses signed, expiring Firebase ID tokens; we never see your password. Each request can access only your own account’s data. Server access is limited to authorised staff, secrets are not kept in code, and backups are taken regularly.
7. Cookies, tracking and ads
The app uses no cookies, advertising or tracking (profiling, analytics) SDKs and shows no ads. These pages use no cookies either.
8. Children and parental consent
The app is designed for students. If an individual user’s birth year shows they are under 13, the app asks for parental consent: a consent link is sent to the parent via QR code, SMS or email, and solving is disabled until consent is given. Parents can exercise all rights over their child’s data at help@edudiamond.com.
For institution users, informing the student (and, for minors, the parent) and obtaining any required consent is the responsibility of the institution that has the relationship with the student.
9. Your rights (KVKK Art. 11)
You have the right to learn whether your personal data is processed; request information if so; learn the purpose and whether it is used accordingly; know the third parties in Türkiye or abroad to whom it is transferred; request correction if incomplete or inaccurate; request deletion or destruction; request that corrections and deletions be notified to those third parties; object to an adverse result arising solely from automated analysis; and claim compensation for damage caused by unlawful processing. You can withdraw your explicit consent (AI consent) in the app at any time.
Requests: help@edudiamond.com. We respond within 30 days at the latest. Institution users should first direct requests about student data to their institution; we forward such requests we receive to the institution and follow up. You may also complain to the Turkish Personal Data Protection Board. Details: KVKK Information Notice.
10. Changes
When this policy changes, the date at the top changes; significant changes are announced in the app. The current version is always at this address.
11. Contact
Questions about this policy: help@edudiamond.com