Privacy Policy
This English text is a translation provided for convenience. Where the Turkish version differs, the Turkish version prevails for users in Türkiye.
- Controller: Hasan Akgül (Pingel).
- We process organisers' account and payment data, competition content and the team/contestant details organisers enter; the organising institution is the controller for contestant data.
- We do not sell your data and use no advertising or tracking cookies.
- To exercise your rights: hasan@pingel.dev
Who we are
Essah is a platform for running live, jury-judged quiz competitions for schools, institutions and events: halls, teams, a jury panel, a presentation screen, jokers and a live scoreboard. This policy applies to the service provided at essah.app and related apps.
| Data controller | Hasan Akgül (an individual developing software products under the Pingel brand; “Pingel”) |
|---|---|
| Location | Istanbul, Türkiye |
| hasan@pingel.dev | |
| Web | pingel.dev |
What we process and why
The table below lists the categories of data we process, why, the legal basis under Turkish law (KVKK) and how long we keep it. Legal bases for other regions are in the section for your region below.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account data Organiser's name, e-mail, profile photo (with Google sign-in), password (hashed by Firebase) | Creating your account, signing you in, providing the service and service notices | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)) | While your account is open; within 30 days after deletion |
| Competition content Competition name, logo, questions, halls, jury and admin passwords, settings, videos | Setting up and running the competition live | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)) | While your account is open; within 30 days after deletion |
| Team and contestant data (on the organiser's behalf) Team name, contestant names, team photo/avatar, scores | Running the competition and showing the scoreboard on screen (as processor) | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)) | Until the organiser deletes it; within 30 days after account closure |
| AI jury assistant inputs The competition question and the answer text | Suggesting to the jury whether an answer is correct (Google Gemini; fallback Cloudflare Workers AI) | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)) | At the time of the request; not stored |
| Payment and billing data Name/organisation, phone, e-mail, chosen plan, amount, reference code, payment notice date, sender name/IBAN (from the bank statement) | Taking the purchase request, matching the bank transfer, activating the plan, keeping income and accounting records | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)); Compliance with a legal obligation (KVKK Art. 5(2)(ç)) | 10 years under Turkish tax and commercial law |
| Agreement and consent records Documents you accepted, their versions, date and time | Proving that the agreement was concluded and you were informed | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)); Establishment, exercise or protection of a right (KVKK Art. 5(2)(e)) | 10 years after account closure (limitation period) |
| Contact and support Name, e-mail, message content | Answering your questions and requests | Our legitimate interests, provided your fundamental rights are not harmed (KVKK Art. 5(2)(f)); Establishment, exercise or protection of a right (KVKK Art. 5(2)(e)) | 2 years after the conversation ends |
| Technical and security logs IP address, browser/device info, request time, error logs | Running the service, keeping it secure, preventing abuse and attacks, obligations under Law No. 5651 | Our legitimate interests, provided your fundamental rights are not harmed (KVKK Art. 5(2)(f)); Expressly provided for by law (KVKK Art. 5(2)(a)) | Hosting provider logs 30 days; records under Law 5651 for the statutory period (1–2 years) |
We do not ask for sensitive data such as national ID numbers, health, religion or biometrics; please do not enter them in free-text fields either.
How we collect data
We collect personal data electronically, partly by automated means, through the forms you fill in, the actions you take in your account, the e-mails you send us and the technical information your browser or device sends automatically (including cookies and similar technologies).
Who we share data with
We do not sell or rent your data to anyone for their own purposes. To run the service we share data only with the following providers, and only as far as their service requires:
| Provider | Purpose | Location |
|---|---|---|
| Google Firebase / Google Cloud (Google Ireland Ltd., Google LLC) | Hosting, authentication, database, server functions | EU and/or US data centres |
| Google Gemini API (Google LLC) | AI features: the text or transcript you submit is processed | United States |
| Cloudflare, Inc. | Hosting, content delivery, DNS, attack protection | Global network (US-based) |
| Banks | Receiving and verifying bank-transfer payments | Türkiye |
We also disclose information to competent public authorities and courts only where there is a lawful request or legal obligation.
International transfers
Some of the providers above process data on servers outside Türkiye (in the EU, the US and other countries). Under Article 9 of the KVKK these transfers rely on appropriate safeguards such as standard contracts and the providers' data processing terms, and, for occasional transfers where these cannot be used, on the cases in Article 9(6) (necessity for the performance of a contract or explicit consent). For users in the European Economic Area, transfers rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.
How long we keep data
We keep data for the period stated in the table above or, if none is stated, for as long as the purpose requires. We then delete, destroy or anonymise it. Copies in backups are removed within the backup cycle (at most 35 days). Payment records that tax and commercial law require us to keep are retained for the statutory period (up to 10 years).
Security
Connections are encrypted with HTTPS; database access is restricted by roles and rules; administrative access is kept to a minimum and logged. No system is perfect; if a breach affects your personal data we will notify the competent authority and you as required by KVKK Art. 12(5) and GDPR Arts. 33–34.
Children
Organiser accounts are for adults. Contestants (including students) do not create accounts; the organising institution enters their names and photos and is the controller for them, responsible for informing parents and obtaining consent where needed.
Cookies
The cookies we use and how to change your choice: Cookie Policy
Your rights — by region
The section for your location opens automatically; you can open any section. Wherever you are, you can write to hasan@pingel.dev for any request; we reply free of charge within 30 days.
Türkiye — KVKK (Law No. 6698)
Under Article 11 of the KVKK you may ask whether your data is processed, request information about it, learn the purpose and whether it is used accordingly, know the third parties it is transferred to, request correction, deletion or destruction (under Art. 7) and notification of these to recipients, object to an adverse result arising solely from automated analysis, and claim compensation for damage caused by unlawful processing.
Send your request from the e-mail address registered with us to hasan@pingel.dev, or in writing. We reply free of charge within 30 days. If you are not satisfied you may complain to the Turkish Personal Data Protection Board. Details: KVKK Privacy Notice (Türkiye).
European Union / EEA, United Kingdom and Switzerland — GDPR
In these regions your data is protected under the General Data Protection Regulation (GDPR), the UK GDPR and the Swiss FADP. Our legal bases are:
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account data Organiser's name, e-mail, profile photo (with Google sign-in), password (hashed by Firebase) | Creating your account, signing you in, providing the service and service notices | Performance of a contract (GDPR Art. 6(1)(b)) | While your account is open; within 30 days after deletion |
| Competition content Competition name, logo, questions, halls, jury and admin passwords, settings, videos | Setting up and running the competition live | Performance of a contract (GDPR Art. 6(1)(b)) | While your account is open; within 30 days after deletion |
| Team and contestant data (on the organiser's behalf) Team name, contestant names, team photo/avatar, scores | Running the competition and showing the scoreboard on screen (as processor) | Performance of a contract (GDPR Art. 6(1)(b)) | Until the organiser deletes it; within 30 days after account closure |
| AI jury assistant inputs The competition question and the answer text | Suggesting to the jury whether an answer is correct (Google Gemini; fallback Cloudflare Workers AI) | Performance of a contract (GDPR Art. 6(1)(b)) | At the time of the request; not stored |
| Payment and billing data Name/organisation, phone, e-mail, chosen plan, amount, reference code, payment notice date, sender name/IBAN (from the bank statement) | Taking the purchase request, matching the bank transfer, activating the plan, keeping income and accounting records | Performance of a contract (GDPR Art. 6(1)(b)); Legal obligation (GDPR Art. 6(1)(c)) | 10 years under Turkish tax and commercial law |
| Agreement and consent records Documents you accepted, their versions, date and time | Proving that the agreement was concluded and you were informed | Performance of a contract (GDPR Art. 6(1)(b)); Legitimate interests (GDPR Art. 6(1)(f)) | 10 years after account closure (limitation period) |
| Contact and support Name, e-mail, message content | Answering your questions and requests | Legitimate interests (GDPR Art. 6(1)(f)); Legitimate interests (GDPR Art. 6(1)(f)) | 2 years after the conversation ends |
| Technical and security logs IP address, browser/device info, request time, error logs | Running the service, keeping it secure, preventing abuse and attacks, obligations under Law No. 5651 | Legitimate interests (GDPR Art. 6(1)(f)); Legal obligation (GDPR Art. 6(1)(c)) | Hosting provider logs 30 days; records under Law 5651 for the statutory period (1–2 years) |
Your rights: access, rectification, erasure (“right to be forgotten”), restriction, data portability, objection to processing based on legitimate interests and to direct marketing, withdrawing consent at any time, and not being subject to solely automated decisions. You may lodge a complaint with the data protection authority in your country. We have no EU representative; you can contact us directly at hasan@pingel.dev.
United States — California (CCPA/CPRA) and other states
In the last 12 months we collected personal information in the categories listed in the table above, from the sources and for the purposes shown there. We do not sell your personal information and we do not use sensitive personal information to infer characteristics about you. We do not do targeted advertising.
Under the laws of California, Colorado, Virginia, Connecticut, Utah, Texas, Oregon and similar states you have the right to know/access, correct, delete, obtain a portable copy and opt out of sale/sharing or targeted advertising. We will not discriminate against you for exercising these rights. We honour the Global Privacy Control (GPC) signal as an opt-out request. Send requests to hasan@pingel.dev; you may also use an authorised agent, and we will reasonably verify your identity.
Brazil — LGPD
Under the Lei Geral de Proteção de Dados (LGPD) you may confirm processing, access, correct, anonymise, block or delete data, obtain portability, learn with whom data is shared, withdraw consent and complain to the ANPD. Our legal bases are the same as in the GDPR section (contract, legal obligation, legitimate interests, consent). Requests: hasan@pingel.dev.
Canada — PIPEDA
You may access and request correction of your personal information and withdraw consent. Your information may be processed outside Canada and be accessible to authorities there. Please raise concerns with us first (hasan@pingel.dev), then with the Office of the Privacy Commissioner of Canada.
India — DPDP Act 2023
Under the Digital Personal Data Protection Act you may obtain a summary of the data processed, request correction and erasure, have grievances redressed and nominate a person to exercise your rights. Grievance contact: hasan@pingel.dev. If you are not satisfied you may approach the Data Protection Board of India.
Other countries
The laws of your country may give you additional rights. Wherever you are, you can ask us at hasan@pingel.dev to access, correct or delete your data or to withdraw consent. We reply within the period required by local law and at most 30 days.
Changes
We may update this policy. We announce material changes on the site and notify account holders. The date and version at the top show the current text.
Contact
For any privacy question or request: hasan@pingel.dev