KVKK Privacy Notice

1 · Data controller

The Nenni app is provided by an individual developer; it is not a company or legal entity. The data controller is Mahmut Uğur Çeker, and for all your requests under KVKK you can write to kvkk@nenni.co.

2 · Personal data processed

• Identity & contact: your email, if you link one (only for signing in and recovering your account).
• Baby profile: name, date of birth, gender, weight/length/head circumference, a profile photo if you add one.
• Special-category health data (KVKK Art. 6): vaccine records, feeding/sleep/diaper entries, growth measurements, health notes, medication & fever, your postpartum mood journal and your Edinburgh scale result.
• If you use voice logging or a voice note: your voice recording and its text.
• If you use the AI features: the questions you write to the Assistant and the answers you get; the entry summary sent to the Assistant and sleep analysis.
• Subscription: your purchase status (Nenni+).
• Notifications: your device’s notification token, for caregiver notifications and the lock-screen timer.
• If you search for a nearby Family Health Center (ASM, in Türkiye): your location at that moment (only for the search, not stored).
• Caregiver sharing: the access details of the people you invite.
• Device & usage: operating system, language, version, (if you give consent) anonymous usage statistics; for AI features, a usage counter and cost record (which feature, how much, when).

3 · Purposes of processing

Providing the baby tracking service; backing up your data and syncing it across your devices; sharing with the caregivers you invite; (if you use it) voice logging and converting voice notes to text; (if you use them) generating AI Assistant and sleep analysis responses; verifying your subscription entitlement; keeping the service secure, preventing misuse and improving it.

Also, if you give consent: anonymous usage statistics are kept on our own server (no third-party analytics service is used); once a week, anonymous aggregate statistics (age in months, daily averages) are recorded for research; if you give marketing consent, Meta measures which ad led you to install the app (only if you have also granted iOS tracking permission). Your data is not sold for marketing purposes or rented to third parties; your baby’s health records are not used for advertising.

4 · Legal basis

Processing is necessary to provide the service (KVKK Art. 5/2); in addition, because health data is special-category data (Art. 6) and cloud storage and transfers abroad are involved, we rely on your explicit consent. You can withdraw your explicit consent at any time (see the rights below).

Your personal data is collected from the information you enter into the app and, while you use the app, by automated means in an electronic environment.

5 · Transfers, including abroad

The cloud infrastructure runs on Supabase; your data is stored on servers in the Frankfurt, Germany (EU) region. In the following cases, data is passed to service providers abroad: (a) if you use voice logging or voice notes, your audio and its text go to OpenAI (USA) only for that action, to be transcribed; (b) if you use the AI Assistant or sleep analysis, your question and entry summary go to Anthropic (USA) to produce the answer — your baby’s name is not sent, only their age and entry summaries; (c) to verify your subscription entitlement, your subscription status and account ID go to RevenueCat (USA); (d) for notifications, your notification token goes to Apple (APNs) / Google (FCM) and Expo (USA); (e) if you gave marketing consent and also allowed iOS tracking, your device ID goes to Meta (USA) for install measurement — your baby’s entries are not part of this measurement; (f) if you search for a nearby Family Health Center (ASM), only your location goes to the map service (OpenStreetMap) as a query; it is not linked to your account and is not stored.

Caregivers can access only with your explicit invitation. All of these transfers abroad rely on your explicit consent under KVKK Art. 9 and are encrypted with TLS in transit.

6 · Retention period

Your data is kept for as long as your account is active. When you delete your account from inside the app, your entries in the cloud and on your device are permanently deleted; if you only uninstall the app, the copy on your device goes away but the cloud entries remain. The AI usage counter and cost records are kept to prevent misuse and are deleted together with your account.

7 · Your rights (KVKK Art. 11)

You have the right to find out whether your personal data is being processed; to request information if it has been processed; to find out the purpose of processing and whether it is used in line with that purpose; to know the third parties it has been transferred to, in Türkiye or abroad; to ask for it to be corrected if it is incomplete or wrong; to ask for it to be deleted under KVKK Art. 7; to ask for these actions to be notified to the parties it was transferred to; to object to a result against you that comes from analysis solely by automated systems; and to ask for compensation if you suffered harm from unlawful processing. You can also download your data in a portable format (Profile → Download my data).

You can turn off voice logging and the other optional consents on the Profile → KVKK and explicit consent screen; because cloud backup is part of the service (data integrity), the way to withdraw cloud consent is to delete your account — you can do this from inside the app.

8 · Contact and complaints

For KVKK requests you can write to kvkk@nenni.co; your request is answered within 30 days at the latest. If you are not satisfied with the answer, you keep the right to complain to the Personal Data Protection Authority (kvkk.gov.tr).

This English version is a convenience translation of the Turkish text. If the two differ, the Turkish text is the one that applies. Read the Turkish text.