Privacy Notice

Last updated: 9 September 2026 · Version 1.0

This notice explains how personal data is processed on the Keşif Kutusu digital learning platform, in accordance with the Turkish Personal Data Protection Law No. 6698 (“KVKK”). The platform provides experiment and activity content for students from preschool to Year 8.

1. Data controller

Miniskop Eğitim Teknolojileri
E-mail: bilgi@kesifkutusu.com.tr
Web: kesifkutusu.com.tr

2. Children’s data

The platform’s primary users are students under the age of 18. Student data is processed under the agreement signed with the school and on the school’s instructions; in this relationship the school acts as the data controller and Miniskop Eğitim Teknolojileri as the data processor. Informing parents, and obtaining their consent where required, is a responsibility shared with the school.

A student joins with a class code, first name and school number. No e-mail address or phone number is requested. The aim is to collect the least possible data from a child.

3. Personal data processed

Group	Data processed	Source
Student	First name, school number, class/section, experiment progress and points, and an irreversible hash of the 4-digit login PIN	School / the student
Teacher	Full name, e-mail, phone (optional), school and classes taught	School / dealer order form
Parent	Parent access code and record of reports viewed	School / teacher
All users	Transaction logs, an irreversible hash of the IP address, browser error reports	Automatic

IP addresses are never stored in raw form; only a salted SHA-256 hash is kept. Passwords are stored irreversibly (scrypt) and cannot be read by any member of staff.

4. Purposes and legal grounds

Providing the educational service — showing experiment content, recording progress (performance of a contract)
Authentication and account security — login, limiting password attempts (legitimate interest, legal obligation)
Reporting to teachers and parents — class progress, badges and points (performance of a contract)
Error tracking and security — fault diagnosis, prevention of misuse (legitimate interest)
Statutory retention and audit — keeping access records (legal obligation)

5. Transfers

Data is never sold or rented to third parties for marketing. The following providers are used to run the service:

Provider	Purpose	Location
Supabase	Database and authentication	European Union (Frankfurt)
Netlify	Site and serverless functions	Europe / global delivery network
Sentry	Error reporting (personal data stripped)	European Union

In error reports, a child’s name, school number and e-mail are masked before sending; if masking fails, the report is not sent at all.

6. Retention periods

Data	Period
Student account and progress record	For the duration of the school agreement
Decided join requests	90 days
Pending join requests	180 days
Password setup links	7 days
Access/audit logs	2 years

When a period expires, records are deleted by an automated daily job. For a student who leaves the school, identifying fields are deleted; progress data may be kept anonymously for statistics once the link to the person is broken.

7. Your rights (KVKK Art. 11)

In relation to your personal data you have the right to:

Learn whether it is processed and request information about it
Learn whether it is used in line with its purpose
Request correction if it is incomplete or inaccurate
Request erasure or destruction where the conditions are met
Request that corrections/erasures be notified to third parties it was transferred to
Object to an adverse outcome produced solely by automated analysis
Claim compensation for damage caused by unlawful processing

You may send your requests to bilgi@kesifkutusu.com.tr. Requests concerning a student must be made through a parent or the school. Requests are answered within 30 days at the latest.

8. Cookies

The platform uses no advertising or tracking cookies. Browser storage (localStorage) is used only to keep you signed in. See the Privacy Policy for details.

This notice is version 1.0. Updates are published on this page.