Privacy Policy

This Privacy Policy explains how Macenta Eğitim Yayınları Sanayi ve Ticaret Anonim Şirketi("we", "us", or "our") collects, uses, and protects personal information when you use Learn with Odi(the "Service"). For information specific to European users, see our GDPR notice, and for Türkiye-specific disclosures see our KVKK Aydınlatma Metni.

1. Who we are (data controller)

Macenta Eğitim Yayınları Sanayi ve Ticaret Anonim Şirketi
Dikilitaş Mah. Barış Sok. Fulya Sitesi A Blok 9/A, Beşiktaş-İstanbul-Türkiye
Email: destek@macenta.com.tr (from your registered account email) · KEP: macenta@h01.kep.tr · Phone: +90 (212) 259 54 73

For the public website we act as controller. For school accounts we act as processor on behalf of the school (the controller), on the school's documented instructions.

2. Information we collect

Depending on your role (student, teacher, parent, administrator), we may collect:

• Account information — username, school / campus / class affiliation, role, and authentication credentials managed through our identity provider (Firebase Auth).
• Profile and learning data — progress, assignments, checkpoints, badges, quiz results, login streaks, and related educational activity.
• Assignment submissions — audio recordings and project/file uploads (and, where offered, video recordings) the student voluntarily submits as part of an assignment.
• Communications — support requests and notification preferences.
• Technical data — device type, browser, IP address, approximate location derived from IP, and diagnostic logs. Analytics events are pseudonymous, opt-in only, and retained ≤ 14 months.
• Push notification tokens — only if you opt in on supported devices.

Student assignment content: audio, project uploads, and video input

Some assignments ask the student for input in the form of audio recordings, project or file uploads, and (where offered) video recordings. The student provides this content voluntarily as part of completing the assignment. Microphone and camera access is used only when the student chooses to record or submit a spoken or video answer; we do not listen in the background or record outside of an assignment submission the student actively makes.

• Retention: assignment audio, project uploads, and video recordings are kept until the end of membership access and deleted afterwards.
• Access: each submission is accessible only by the submitting student and their own teacher, strictly for review and grading purposes.
• No external processing or sharing: assignment content is not processed externally, not shared with third parties, and not accessible by anyone else — it is never used for advertising, analytics, or model training.

3. How we use information

• Provide, maintain, and improve the Service;
• Authenticate users and enforce access controls;
• Display progress, reports, and class-scoped leaderboards (FirstName L. pseudonymisation, no public boards);
• Send service-related notifications you have requested;
• Respond to support requests and protect against fraud/abuse;
• Comply with legal obligations.

We do not sell personal information. We serve no ads.

4. Legal bases

Contract (Art. 6(1)(b)) to provide the Service; legitimate interests (Art. 6(1)(f)) for security and strictly necessary operations; legal obligation (Art. 6(1)(c)) where required; consent (Art. 6(1)(a)) for analytics / functionality cookies and for special-category assignment content (Art. 9(2)(a), KVKK m. 5/1, m. 6/1) — entirely optional and withdrawable.

5. Sub-processors and sharing

All sub-processors operate under Art. 28 DPAs; US transfers under SCCs 2021/914:

• Google Firebase (Auth / Firestore / Storage / Analytics) — auth, database, storage, opt-in analytics;
• AWS S3 — content and file storage;
• Vimeo — educational video playback only (student submissions are never uploaded to Vimeo);
• Sentry — error / performance monitoring;
• Resend / MailerLite — transactional and product-update emails;
• Stripe / RevenueCat — payment processing where applicable.

Assignment audio, project uploads, and video recordings are never shared with sub-processors for their own purposes.

6. Retention

• Assignment media → end of membership, then deleted (backups ≤ 90 days);
• Account / learning records → term + up to 2 years, then deleted/anonymised (KVKK m. 7);
• Analytics → ≤ 14 months (pseudonymous, opt-in only).

7. Security and breach

TLS 1.2+ in transit, AES-256 at rest, Firebase Auth with MFA-ready sessions, RBAC least-privilege access, VPC/WAF/DDoS protection, Sentry + Cloud Logging, daily backups (RPO < 24s, RTO < 1h). We notify the controller ≤ 48h after becoming aware of a breach and support 72h supervisory-authority notification.

8. Children and schools

Learn with Odi is a school platform for grades 1–4. Student accounts are created and supervised by schools and teachers, with parental involvement where local law requires it. We do not serve ads and we run no analytics on signed-in learning pages without the applicable consent. Assignment uploads always require explicit, parent-involved consent and are entirely optional. If you think a child provided information outside these flows, contact us immediately and we will promptly remove it.

9. Your rights (GDPR / KVKK / CCPA)

Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent (GDPR); KVKK m. 11 rights with 30-day, generally free response and KVK Kurumu complaint path (kvkk.gov.tr); CCPA disclosure/deletion rights (we do not sell personal data). Exercise rights via destek@macenta.com.tr from your registered email. DSR SLA: 1 month (GDPR) / 30 days (KVKK). Details: GDPR · KVKK · Account Deletion.

10. International transfers

Primary hosting in the EU / Türkiye where available; some sub-processors operate in the US under SCCs 2021/914 (plus UK Addendum where applicable) with transfer risk assessments.

11. Cookies

Essential (always on), Analytics (opt-in), Functionality (opt-in). Consent stored 365 days in localStorage; Consent Mode defaults to denied. Manage anytime via “Cookie preferences” in the footer. See Cookie Policy.

12. Contact and DPA

Email destek@macenta.com.tr, KEP macenta@h01.kep.tr, or post to Dikilitaş Mah. Barış Sok. Fulya Sitesi A Blok 9/A, Beşiktaş-İstanbul-Türkiye. Schools needing a countersigned agreement: see our Data Processing Agreement (GDPR Art. 28 / KVKK).