Privacy Policy
Version 1.0 · Effective: Draft Draft
This document is a draft under legal review. Fields in square brackets will be completed after approval.
1. Who we are
Musichool (musichool.com) is an online learning platform offering recorded music courses made by Turkish musicians. The company that runs the platform and is the data controller for your personal data is:
| Item | Value |
|---|---|
| Company name | Barboros Yazılım ve Pazarlama Teknolojileri (BYPT) |
| Address | Kartaltepe Mah. Belediye Cad. No:3 Limanoğlu İş Merkezi No:38, Küçükçekmece / İstanbul |
| Phone | +90 554 434 09 99 |
| Data protection requests | [email protected] |
| Support | [email protected] |
"Musichool", "we" or "us" in this policy means this company. We are established in Türkiye. We do not have an establishment in the European Union. [KARAR: if the service targets EEA/UK users, decide whether an EU/UK representative under GDPR Art. 27 is required]
2. What this policy covers
This policy explains what happens to your personal data when you visit musichool.com, create an account, buy a course, start a Plus or instructor subscription, or use the features of the platform.
Our formal notice under Turkish data protection law (Law No. 6698, "KVKK") is the Data Protection Notice. For cookies, see the Cookie Policy.
Instructors' personal data is also processed under the Instructor Agreement. [KARAR: will there be a separate privacy notice for instructors?]
If you are in the European Economic Area (EEA) or the UK, the General Data Protection Regulation (GDPR) or UK GDPR may also apply to our processing of your data. This policy is written to meet both Turkish law and those rules.
3. Our core principles
We follow the principles in Article 4 of the KVKK (which closely match GDPR Article 5):
- We process your data lawfully and fairly.
- We collect only what we need, for specific and clear purposes.
- We try to keep data accurate and up to date.
- We do not keep data longer than needed; when the period ends we delete or anonymise it.
- We do not sell your data.
4. What data we collect
| Data group | Examples | Where it comes from |
|---|---|---|
| Identity | First name, last name | You, or Google sign-in |
| Contact | E-mail address, phone number (optional; required at checkout) | You, or Google sign-in |
| Account and security | One-way hash of your password (scrypt), Google account ID, two-factor authentication data, session data | You and our systems |
| Customer transactions | Orders, purchased courses, subscription status, amount paid | Your purchases |
| Learning data | Progress, video watch position, notes, quiz and skill results, badges, "struggle map" signals (rewinds, A-B loops, notes, questions to the Coach) | Your use of the platform |
| AI conversations | Messages you write to the AI Coach and to an instructor's twin, and the answers | You |
| Audio recordings | Only recordings you choose to send to your instructor with "Hoca Dinlesin" | You |
| Security | Security logs (IP address with the last part removed), request data | Our systems and Cloudflare |
| Marketing | Your consent to commercial messages | You (only if you opt in) |
| Cookies and preferences | Your cookie choices, analytics data (only with consent) | Your browser |
Your card details never reach us. Payment takes place on the secure payment screen of the payment provider PayTR.
We cannot see your password. It is stored only as a one-way hash (scrypt).
5. Why we use your data
| Purpose | Legal basis (KVKK Art. 5) | Legal basis (GDPR Art. 6) |
|---|---|---|
| Creating your account, signing you in, verifying your e-mail | Contract (Art. 5/2-c) | Contract (Art. 6(1)(b)) |
| Providing your courses and subscription, saving your progress | Contract (Art. 5/2-c) | Contract (Art. 6(1)(b)) |
| Taking payment, issuing invoices, keeping order records | Contract (Art. 5/2-c), legal obligation (Art. 5/2-ç) | Contract, legal obligation (Art. 6(1)(b), (c)) |
| Sending renewal reminders and transactional e-mails | Contract, legal obligation | Contract, legal obligation |
| Running the AI Coach and instructor twin | Contract (Art. 5/2-c) | Contract (Art. 6(1)(b)) |
| Delivering your Hoca Dinlesin recording to your instructor | Contract (Art. 5/2-c) | Contract (Art. 6(1)(b)) |
| Using recordings to improve the listening engine | Explicit consent (Art. 5/1) — only if you opt in | Consent (Art. 6(1)(a)) |
| Keeping accounts and the platform secure, preventing abuse | Legitimate interest (Art. 5/2-f), legal obligation | Legitimate interests (Art. 6(1)(f)) |
| Giving instructors aggregated, anonymous statistics | Legitimate interest (Art. 5/2-f) | Legitimate interests (Art. 6(1)(f)) |
| Improving search (search log without user ID or IP) | Legitimate interest (Art. 5/2-f) | Legitimate interests (Art. 6(1)(f)) |
| Establishing or defending legal claims | Art. 5/2-e | Legitimate interests (Art. 6(1)(f)) |
| Measuring site usage (Google Analytics) | Explicit consent — only with cookie consent | Consent (Art. 6(1)(a)) |
| Sending offers and announcements | Opt-in under Law No. 6563 — only if you opt in | Consent (Art. 6(1)(a)) |
Where we rely on legitimate interests, you can object (see section 16).
We do not aim to collect special categories of data (for example health or biometric data). Please do not type such information into the AI Coach, an instructor twin or your notes.
6. AI features
The AI Coach is a study assistant. Hocayla Çalış / Twin is an AI "twin" of an instructor that answers only from that instructor's own course material. Questions the twin cannot answer are passed to the instructor.
- Messages you send to these features are sent to Google's Gemini service (USA) to generate an answer.
- Because we use the paid tier, Google does not use this data to train its models. [KARAR: avukat doğrulasın — confirm Google's Gemini API paid-tier terms, including any temporary retention for abuse monitoring]
- AI Coach messages are kept for 30 days, then deleted. Usage counters (to track the daily free quota) are kept for 90 days.
- If the twin passes your question to the instructor, that instructor sees it.
- No AI language model is used in child mode.
AI answers can be wrong and are not professional advice. See the Terms of Use.
We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing.
7. Microphone and audio recordings
Çal, dinlesin ("Play, it listens"): While you play, your browser listens. The pitch and rhythm analysis runs entirely in your browser. Your audio is not sent to our servers for this. Your browser asks for microphone permission, and you can turn it off in your browser settings at any time. The resulting score may be saved as part of your skill results. [KARAR: technical team to confirm whether the score is stored on the server]
Hoca Dinlesin ("Let the instructor listen"): A recording is uploaded to our server only if you choose to send it to your instructor.
- Only you, that instructor and Musichool administrators can access it.
- It is deleted automatically after 90 days.
- You can delete it yourself at any time.
Improving the listening engine (optional): If you give separate consent, we may use your Hoca Dinlesin recordings to improve our listening engine. This is off by default and you can withdraw it at any time. The same 90-day deletion rule applies and your name or e-mail is never exported for this purpose. See Explicit Consent Texts.
8. What instructors see
- Instructors see the "struggle map" (where students find a course hard) only in aggregated form and only when there are at least 5 students. Individual students' data is never shown to instructors.
- An instructor sees content from you only when you send them something (a Hoca Dinlesin recording, or a question the twin passes on).
9. Who we share data with
We share data only with service providers we need to run the service, and only as much as needed:
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Hetzner Online | Server hosting | All account and platform data | Finland (Helsinki) |
| Cloudflare | Content delivery, DNS, security | IP address, request data | Global |
| PayTR | Payments | Name, e-mail, phone, amount | Turkey |
| Resend | Transactional e-mail | E-mail address, name, message content | USA |
| Google (Gemini) | AI Coach and instructor twin | Your messages and the relevant course material | USA |
| Google (Sign in with Google) | Signing in with a Google account | Name, e-mail, Google account ID | USA |
| Google (Analytics / Tag Manager) | Usage measurement — only with consent | Cookie IDs, usage data | USA |
| Google (Google Calendar) | Creating one-to-one lesson bookings and video meeting links in the calendar an instructor connects | Student name and email, lesson time; the instructor's busy times (event contents are not read) | USA |
| Vimeo | Video playback | IP address, playback data | USA |
| YouTube (youtube-nocookie) | Playback of some videos | IP address, playback data | USA |
When an instructor connects Google Calendar, Musichool only uses busy times, the calendar list and the lesson events it creates. Event contents are not read, and this data is not used for advertising or transferred for other purposes. Musichool's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Instructors can disconnect at any time from their panel.
Apart from these, we disclose data to public authorities and courts only where the law requires it.
Website fonts are served from our own server; no data is sent to a third party for this.
10. International transfers
Our server is in Finland and some providers above operate in the USA or globally. This means your data is transferred outside Türkiye.
Under Article 9 of the KVKK, we sign the standard contracts published by the Turkish Personal Data Protection Board with these providers and notify the Turkish Personal Data Protection Authority within 5 business days of signing. [KARAR: confirm standard contracts are signed and notified for every provider; assess the transfer basis for Google Analytics separately]
For users in the EEA/UK, transfers outside the EEA/UK (including to Türkiye and the USA) rely on [KARAR: GDPR transfer mechanism — e.g. EU-US Data Privacy Framework certification of the provider and/or EU Standard Contractual Clauses; lawyer to confirm per provider].
11. How long we keep data
| Data | Retention |
|---|---|
| Account data | While your account is open |
| Session cookie | 30 days |
| Password-reset link | 1 hour (single use) |
| E-mail verification link | 24 hours (single use) |
| AI Coach messages | 30 days |
| AI Coach usage counters | 90 days |
| Hoca Dinlesin recordings | 90 days (you can delete earlier) |
| Learning data | While your account is open |
| Search log (no user ID, no IP) | 90 days |
| Notification log | 90 days |
| Security log (IP with last part removed) | 180 days |
| Database backups | Last 14 days |
| Orders and payment records | For the period required by tax and commercial law, de-identified even after account deletion [KARAR: süre — VUK 5 yıl / TTK 10 yıl, avukat belirlesin] |
| Cookie consent records | [KARAR: retention period for cookie consent proof] |
| Support correspondence | [KARAR: retention period for support e-mails] |
When a period ends, data is deleted or anonymised. Deleted data may remain in backups for up to 14 days and is then deleted with them.
12. How we protect your data
- Passwords are stored only as scrypt hashes.
- We offer optional two-factor authentication (TOTP). The secret is encrypted at rest with AES-256-GCM; recovery codes are stored hashed.
- Connections are encrypted (HTTPS) and the session cookie uses secure settings.
- We remove the last part of IP addresses in security logs.
- Access to data is limited to people who need it for their work.
No system is 100% secure. If a data breach occurs, we notify the Turkish Personal Data Protection Board and affected people as required by law (and, where GDPR applies, as required by GDPR).
13. Cookies
No cookies other than strictly necessary ones are used without your consent. Google Analytics tags are not loaded at all before you consent. You can change your choices at any time using the "Çerez tercihleri" (cookie preferences) link at the bottom of every page. Details: Cookie Policy.
14. Marketing messages
We send offers or announcements by e-mail only if you separately opt in by ticking a box that is unticked by default. Your consent is registered in Türkiye's Message Management System (İYS). You can withdraw it at any time using the link in each message, through İYS, or by writing to us.
Transactional e-mails (for example password reset, order confirmation, renewal reminder) are not marketing and are sent as part of the service.
15. Children
[KARAR: minimum yaş — minimum age; is parental consent required under 18, and from what age? For EEA users also consider GDPR Art. 8]
Child mode is used under a parent's account and protected with a parent PIN. No AI language model is used in child mode. If you believe a child's data has been processed without a parent's permission, write to [email protected].
16. Your rights
Under Article 11 of the KVKK you have the right to:
- learn whether your data is processed,
- request information about it,
- learn the purpose of processing and whether data is used for that purpose,
- know the third parties in Türkiye or abroad to whom data is transferred,
- ask for incomplete or inaccurate data to be corrected,
- ask for deletion or destruction under the conditions of KVKK Article 7,
- ask for corrections and deletions to be notified to recipients,
- object to an outcome against you that results only from automated analysis,
- claim compensation if you suffer damage from unlawful processing.
If GDPR applies to you, you also have the right to access, rectification, erasure, restriction, data portability, objection (including to processing based on legitimate interests), and to withdraw consent at any time without affecting earlier processing. You can also complain to the data protection authority where you live or work.
See the Data Protection Notice for how to apply.
17. Deleting your account and downloading your data
- Download my data: In Settings you can download your data as a JSON file.
- Delete account: In Settings you can delete your account yourself. Your personal data is deleted or anonymised immediately. Order records are kept de-identified because the law requires us to keep them. Deleted data may remain in backups for up to 14 days.
18. Changes
We may update this policy. We will announce important changes on the site or by e-mail before they take effect. The version number and effective date are shown at the top of the page.
19. Contact
For questions about your personal data: [email protected]. For anything else: [email protected] or the Contact page.
The Turkish version of this policy prevails if there is any conflict between the two versions.