Privacy Policy
Last updated: 11 October 2026
This policy explains what personal data the Sermovo mobile app (“the app”) and the sermovo.com website (“the site”) process, why, who receives it and how long it is kept. It covers both the EU General Data Protection Regulation (GDPR) and Turkey’s Personal Data Protection Law No. 6698 (KVKK). A Turkish version is available; if the two differ, the Turkish version prevails.
In short
- Your voice recordings are not kept. Audio is processed during the conversation; what remains is a written transcript and your corrections.
- Your voice and text go to AI services only after you give explicit consent on the in-app consent screen. You can withdraw it in settings.
- No advertising tracking. Your data is not sold.
- You can delete your account from inside the app, and that removes all personal data linked to it.
- The site uses no cookies or trackers.
1. Who is responsible
Ümüt Günaydın (an individual)
For any privacy question or request: privacy@sermovo.com
2. What the app collects
| Data | What it includes |
|---|---|
| Account | An anonymous user ID the app creates on first launch. If you link Apple or Google, that account’s ID and email address (Apple lets you hide your email). |
| Profile and settings | Your goal (work, interviews, exams, life abroad), self-assessed level, level test result (CEFR level, strengths and weaknesses), daily target, time zone, reminder time, coach accent and speed, and the date and version of your AI consent. |
| Conversation content | Written transcripts of your conversations (your lines and the coach’s), correction cards, Turkish explanations, conversation summaries, and counts of your mistakes by type. |
| Voice | Audio from the microphone while you speak. Not stored; see section 4. |
| Usage and progress | Conversation length, daily progress and streak, and service usage records used to enforce limits and measure cost. |
| Your reports | Corrections you mark as wrong and coach replies you report as inappropriate. |
| Subscription | Plan, status, trial or renewal date, store (App Store or Google Play) and transaction IDs. We never see card details; Apple or Google takes the payment. |
| Device and technical data | A device ID created at install (to prevent abuse of free usage), app and OS version, crash and error reports, and in-app events such as “conversation ended” or “Türkçe açıkla tapped”. |
3. Why we use it, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Creating your account, running the app, showing your conversations and progress | Account, profile, conversation content, usage | Contract (GDPR 6(1)(b); KVKK 5/2-c) |
| Processing your voice and text with AI services: conversation, transcription, corrections, Turkish explanations, speech, level assessment | Voice, conversation content, profile | Consent (GDPR 6(1)(a); KVKK 5/1), given on the in-app consent screen |
| Managing your subscription | Subscription | Contract |
| Preventing abuse, enforcing usage limits, measuring service cost | Device ID, usage records | Legitimate interests (GDPR 6(1)(f); KVKK 5/2-f) |
| Finding and fixing bugs | Crash and error reports, technical data | Legitimate interests |
| Improving the app: seeing which steps people complete and where they get stuck | In-app events | Legitimate interests |
| Answering support requests | Correspondence | Contract and legitimate interests |
| Meeting legal obligations | Only what is required | Legal obligation (GDPR 6(1)(c); KVKK 5/2-ç) |
| Early access list (site) | Email, language, date | Consent (the form’s checkbox) |
If you don’t consent to AI processing, your account stays open but the voice and AI features won’t work, because the app’s core function depends on them.
4. Voice recordings
In live conversation, your audio streams from your device directly to OpenAI’s realtime service and is processed there; it does not pass through our servers. In practice turns, a short recording is sent to our server, forwarded to OpenAI for transcription and deleted from memory once processed. Audio files are never written to storage or to logs. The only thing kept is the text transcript.
Under its API terms, OpenAI does not use this data to train its models and may keep it for up to 30 days for abuse monitoring.
5. AI consent
Before the first voice step (the level test), the app shows a consent screen listing which AI services receive your voice and text, and why. Nothing is sent to them until you agree; our server rejects requests from accounts without consent. You can withdraw consent at any time in Settings. Withdrawal stops new processing; transcripts created earlier stay in your account until you delete it.
6. Who receives your data
These service providers help us run the app. Each processes your data only for the job it does for us.
| Provider | Data | Purpose | Location |
|---|---|---|---|
| Supabase | Account, profile, transcripts, corrections, progress, usage records, subscription status, device ID | Database and server functions | EU (Frankfurt, Germany) |
| OpenAI | In live conversation: audio stream, text, and the level, goal and frequent mistake types included in the coach’s instructions. In practice turns: the audio recording | Voice conversation, transcription | United States |
| Anthropic | Conversation text; your level, goal and frequent mistake types | Corrections, mistake types, Turkish explanations, summaries, level assessment | United States |
| Microsoft (Azure AI Speech) | The coach’s lines to be spoken | The coach’s voice | EU (Netherlands) |
| RevenueCat | User ID, purchase and subscription records | Subscription management | United States |
| PostHog | In-app events, user ID | Product analytics | EU |
| Sentry | Crash and error reports, device and version | Error monitoring | EU |
| Cloudflare | Site traffic, early access emails, spam checks | Site hosting, early access list | Global network; list database in the EU (Western Europe) |
| Zoho | Emails you send us | EU |
Apple and Google act as separate controllers for account linking and store payments, under their own terms.
We do not sell your personal data or share it for advertising. We may disclose it to public authorities where the law requires.
7. International transfers
Some of these providers process data outside Turkey and outside the European Economic Area, in particular in the United States. Transfers out of the EEA rely on the EU Standard Contractual Clauses in our providers’ data processing agreements. Transfers out of Turkey are made in line with Article 9 of the KVKK.
8. How long we keep it
| Data | Retention |
|---|---|
| Account, profile, transcripts, corrections, progress | While your account exists. Deleted immediately when you delete the account; removed from backups within 30 days. |
| Unused anonymous accounts | Deleted after 12 months without use. |
| Subscription and usage records | For the life of the account, and longer only where the law requires. |
| Crash and error reports | Up to 90 days. |
| In-app events | Up to 12 months. |
| Support correspondence | Deleted 2 years after the request is closed. |
| Early access list | Removed as soon as you ask; otherwise 6 months after the app launches. |
9. Deleting your account
In the app, go to Settings › Delete account. This removes your account, profile, transcripts, corrections, mistake statistics, progress and usage records, and deletes your customer record with our subscription provider. If you can’t get into the app, follow the steps on the account deletion page.
Deleting your account does not cancel your subscription. Cancel it separately in your App Store or Google Play subscription settings.
10. Your rights
Under the GDPR you can ask to access, correct or delete your data, restrict or object to its processing, and receive it in a portable format. You can withdraw consent at any time without affecting processing that already happened. Under KVKK Article 11 you also have the right to learn whether your data is processed, for what purpose, and which third parties in Turkey or abroad receive it, and to object to a result produced solely by automated analysis that goes against you.
Send requests to privacy@sermovo.com from the email linked to your account, or include the user ID shown in the app. We reply within 30 days, free of charge. You can also complain to your local data protection authority or, in Turkey, to the Personal Data Protection Board (KVKK Kurulu).
11. Age
The app is for people aged 13 and over. If you are under 18, use it with the consent of a parent or guardian. If you believe a child under 13 has used the app, write to us and we will delete the data.
12. This website
The site uses no cookies, analytics or tracking code. It is hosted by Cloudflare, which processes connection data such as IP addresses to deliver pages and protect against attacks.
Early access list
When you submit the form, we store your email address, the page language, the sign-up date and the version of the consent text in a Cloudflare D1 database. Your address is used only to tell you when the app is ready to try. It is not used for anything else or shared with anyone. To prevent spam, the form uses Cloudflare Turnstile to check that the browser isn’t an automated program; according to Cloudflare, this check sets no cookies. To leave the list, email privacy@sermovo.com.
13. Security
Secret keys for AI and payment services live only on the server, never inside the app. In the database, each user can reach only their own records, and connections are encrypted. No system is perfect; if a breach affects your data, we will notify the authorities and affected users as the law requires.
14. Changes
When we update this policy we change the date at the top. Significant changes are also announced in the app, and if the scope of AI processing changes we will ask for your consent again.