Privacy Policy

1. Service provider, roles, and scope

For applicant, student, guardian, and operational data entered into Course by your organization, that organization is the data controller and iyely processes the data as a service provider/processor under its instructions. iyely acts as a controller to the extent it determines the purposes of processing for its own account security, service operations, support, and legal obligations. The contracting service provider is identified in your organization’s service agreement. This policy does not replace your organization’s own privacy notices.

This global policy applies to iyely Course users in all countries and does not describe the data practices of other iyely products. Applicable regional notices supplement this policy. Your mandatory rights under applicable local data-protection law remain unaffected.

2. Data sources and categories processed

We receive information from you, authorized users in your organization, the sign-in provider you choose, and technical records generated when operating the service. Without basic account and authorization information, we cannot create your account or provide workspace access. The AI feature is optional.

If your organization processes health or other sensitive data in documents, it must establish any additional legal conditions and access limits required for that data. Upload only what is necessary for the relevant purpose.

• Staff account and identity data: name, work email, phone number, job title, user ID, and workspace ID.
• Authentication data: password hash, session and refresh tokens, two-factor authentication status, and—when Google or Apple sign-in is used—the identity, email, and verification result supplied by that provider.
• Operational data entered by the organization: applicant/student/guardian contact information, applications, stages, tasks, notes, meetings, documents, and fee or sales records shown to authorized users.
• App activity: searches, records viewed or updated, and security/audit events.
• Technical data: IP address, timestamps, request and error logs, app version, and limited device information needed for service security.

3. Biometric data

The optional biometric lock is verified locally by the device operating system. iyely does not collect or transmit fingerprints, face images, or biometric templates; the app receives only whether authentication succeeded.

4. AI Assistant

When you choose to use the AI Assistant, the message you enter, recent messages in the selected chat, and only the Course records needed within your access permissions may be sent through the iyely gateway to the AI server managed by iyely. Those records may include applicant, student, guardian, application, task, note, membership, sale, and payment data together with tool results.

The mobile app asks for your explicit permission before the first message is sent. Declining does not restrict other Course features, and you can withdraw permission in the app. Data is used to generate responses and perform actions you explicitly request; it is not used for advertising or behavioral profiling. Chats are associated with your account to provide history, secure the service, and audit actions; you can delete chats from the interface.

AI responses and embeddings used for retrieval are generated by models running on servers managed by iyely. AI messages and CRM context are not sent to Google AI Studio or OpenRouter, and automatic cloud fallback is disabled. Changes to the processing infrastructure or scope of sharing will be disclosed in this policy and the mobile permission screen, with renewed permission before the changed sharing takes place. You can withdraw permission using the data-sharing control in the AI Assistant. Withdrawal stops new AI submissions and does not automatically erase previous chats. Deleting a chat removes it from active history; deleting your account deletes your Course AI conversations and messages.

5. Purposes and legal bases

Account and service communications with direct customers rely on entering into or performing a contract. Security, abuse prevention, and support for organizational users rely on legitimate interests balanced against your rights. Mandatory records and official requests rely on legal obligations. We ask for consent for optional processing where consent is required. Your organization determines the legal basis for its own records. These bases apply only as permitted by the relevant law; acknowledging this policy does not consent to every type of processing.

• Enable sign-in, enforce permissions, and protect accounts.
• Provide application, stage, task, meeting, document, and team workflows.
• Keep the service secure and reliable and prevent errors, abuse, and unauthorized access.
• Respond to support requests and comply with legal obligations.

6. Sharing, service providers, and international processing

We do not sell personal data or share it for advertising or behavioral tracking. Data is shared only with authorized workspace users and providers needed to operate the service.

Course application infrastructure runs in Google Cloud's Belgium region. Depending on the features you use and providers' global networks, data may be processed outside your country. An AI server managed by iyely does not mean processing occurs on your device or in your country. Cross-border processing is subject to the requirements of the relevant data-protection law. For information about processing locations and transfer arrangements applicable to your organization's service, contact kvkk@iyely.com.

• Google Cloud Platform: application infrastructure, database, and uploaded-document storage in a European region.
• Cloudflare: domain, network security, TLS, and traffic delivery.
• Google Fonts: loading fonts for the web interface. Your browser sends technical connection data, such as IP address and browser information, to Google when making these requests.
• Google and Apple: authentication when the corresponding social sign-in option is used.
• AI server managed by iyely: processing messages and necessary workspace context when you allow the AI Assistant.
• Authorized public authorities: when required by valid law or legal process.

7. Retention, deletion, and security

We retain data while the service and account are active and for the periods required by organizational instructions or applicable law. When in-app account deletion succeeds, your profile information is anonymized, sessions are revoked, and your Course AI conversations are deleted. Other data rights requests are handled within the applicable legal period and under the responsibility of the relevant controller. Limited records required for legal, financial, or security obligations may be retained with restricted access until the applicable period ends. Backup copies are securely overwritten during the normal backup cycle.

We use TLS in transit, one-way password hashing, Keychain/Keystore storage for mobile session data, and role-based access controls. No method of transmission or storage over the internet can guarantee absolute security.

8. Your choices and contact

Depending on applicable law, you may have rights to access, correction, deletion, restriction, portability, withdrawal of consent, and a complaint to a competent supervisory authority. To exercise these rights, contact your organization administrator or email kvkk@iyely.com. For general support, email esenlik@iyely.com. We may need to verify your identity and workspace authority to protect the account.

Right to object: Where applicable law allows, you can object to processing based on legitimate interests on grounds relating to your particular situation. Identify the processing you object to in your request; we will provide a reasoned response.

The GDPR for the European Economic Area, the UK GDPR for the United Kingdom, and relevant local laws in other regions apply to processing within their respective scope. Your rights and response periods follow the applicable law. You retain the right to complain to a competent data-protection authority in your region; this request channel serves all countries.

9. Children's data and changes

Course is not a consumer service designed for children to create their own accounts. An organization entering information about a child for an education application is responsible for providing required notices and establishing a lawful basis.

We may update this policy as the service or law changes. The current version and its effective date will remain available at this URL.

Regional addenda

The following notices supplement this global policy for processing subject to the relevant country's law.