KIDEVO – INFORMATION NOTICE

Last Updated: 10 August 2026

This Information Notice explains the processing of personal data collected during the use of the mobile application named Kidevo (“App”) developed by STEPSANDSTARS YAZILIM LİMİTED ŞİRKETİ (Steps&Stars LTD.) (“Company”) in compliance with KVKK (Law on the Protection of Personal Data No. 6698), GDPR (General Data Protection Regulation), COPPA (Children’s Online Privacy Protection Act), CCPA (California Consumer Privacy Act), and other applicable data protection legislation.

1. Identity of the Data Controller

  • Title: STEPSANDSTARS YAZILIM LİMİTED ŞİRKETİ (Steps&Stars LTD.)
  • Address: Yeşil Mahalle, 56/1 Sokak, Gülpembe, No:18/8, Gaziemir/İZMİR, Türkiye
  • Email: contact@stepsandstars.com
  • Data Protection Officer (DPO): contact@stepsandstars.com

As the data controller, the Company is responsible under KVKK, GDPR, COPPA, CCPA, and other applicable data protection legislation for the collection, storage, and processing of personal data belonging to App users and children aged 0-6.

2. Types of Personal Data Processed

Depending on the use of the App, the following data categories may be processed:

  1. Contact Data: Email address, contact messages, etc.
  2. Profile and Account Data: Username or nickname, password (salted hash — stored with bcrypt/Argon2), account activities.
  3. Child Information:
    • Child’s name or nickname
    • Date of birth/age information
    • Height–weight information, development notes, photos, milestones.
    • If the user shares data regarding a child aged 0-6, parental/legal guardian consent is required for processing such data.
    • Under COPPA and GDPR Article 8, children’s data are afforded special protection and are processed only with the explicit consent of the parent or legal guardian.
    • In EU Member States, the age of parental consent may vary between 13–16; the relevant country’s age threshold applies (GDPR Art. 8).
  5. Content Data: Notes within the App, uploaded photos (protected with token-based encryption), blog comments, etc.
  6. Device Information: Device model, operating system version, device language, last login time (collected only when the user has granted notification permission).
  7. Technical Data: Log records automatically collected during use, IP address, app version, etc. (Processed, where possible, using anonymization or pseudonymization.)
  8. AI Assistant Chat Data: user messages, assistant responses, timestamps, language/session information, security-moderation labels.
  9. Subscription and Transaction Records: Subscription status, plan type (monthly/yearly), period start/end, free trial and cancellation information, App Store/Google Play transaction identifiers; records relating to conversion from the former points system.
  10. Child Mode Game Data: Game type, level number, completion status, stars earned (0-3), play duration, move count, and time played; associated with the child profile, does not include the child’s name or free-text.
  11. Story/Content Usage Events: viewing/reading duration and content IDs; processed anonymously/pseudonymously where possible.
  12. CDN and Security Logs: IP, user agent, request timestamp, and error codes; solely for security and performance purposes.

3. Purposes of Data Processing

Collected personal data are processed for the following purposes:

  1. Service Delivery: To perform the core functions of the App (child development tracking, milestones, etc.).
  2. Personalization: To provide content, activities, and recommendations suitable to age and developmental data.
  3. Account Management and Security: To provide user registration, password recovery, authentication, and additional security measures.
  4. Content Management: To securely store user-uploaded photos and notes and make them accessible only to the user.
  5. Communication and Support: To send announcements, app updates, and emails for technical support and information purposes.
  6. Analytics and Improvement: To enhance app performance, improve user experience, and conduct statistical analyses (primarily using anonymized or aggregated data).
  7. Legal Obligations: To respond to requests from official authorities and manage dispute resolution and legal processes under KVKK, GDPR, COPPA, CCPA, and other applicable data protection legislation.
  8. Operation of the UI assistant, abuse prevention, and quality improvement.
  9. If device notification permission is granted, notification delivery/compliance checking.
  10. Fraud/misuse detection and security.
  11. Subscription management: purchase verification, determining Premium access entitlement, and synchronizing subscription status with the store.
  12. Showing Child Mode game progress to the parent as developmental statistics (with no profiling or advertising purpose).

4. Methods of Data Collection

  • Via the Mobile App: User interactions such as registration/sign-up forms, profile settings, photo uploads, adding notes.
  • Automated Tools: Device information, IP address, app usage statistics (with user consent).
  • Support Communications: Information provided via email, live support, or contact forms.

5. Legal Bases

Special categories of data are processed only with explicit consent (GDPR Art. 9/KVKK provisions on special categories of data).

For the UI assistant: performance of the contract and legitimate interests (security/improvement); explicit consent where necessary.

  1. Explicit Consent: Particularly for the processing of children’s data aged 0-6, user notification permissions, etc.
  2. Performance of a Contract: To provide the core services of the App and to fulfill the user agreement.
  3. Legal Obligation: To respond to requests from official authorities and to fulfill retention processes prescribed by law (e.g., under KVKK, GDPR, COPPA, CCPA, or other applicable legislation).
  4. Legitimate Interests: App security and development, statistical analysis, fraud prevention, etc.

6. Data Transfers and Sharing

Your personal data may be shared with third parties under the following circumstances:

1. Service Providers

  • Amazon Web Services (AWS): Server and database hosting services.
  • Google Firebase (Google LLC): App usage analytics and performance measurement. (These providers process data under the necessary agreements within the scope of KVKK, GDPR, COPPA, CCPA, and other applicable data protection legislation.)
  • Apple App Store / Google Play: Subscription billing, payments, and refunds; these platforms act as independent data controllers under their own privacy policies.

2. Official Authorities

  • In accordance with KVKK, GDPR, COPPA, CCPA, and other applicable data protection legislation, in response to lawful requests from competent authorities or court orders.

3. International Transfers

  • Transfers of data outside the European Union (e.g., Türkiye, the USA, etc.) are carried out under GDPR using Standard Contractual Clauses (SCC) or similar legal mechanisms.
  • Where transfer is required under KVKK, appropriate safeguards and legal processes—such as explicit consent—are followed.
  • Within the scope of COPPA, international transfers of data relating to children under 13 are carried out with parental/legal guardian consent and with data protection measures in place.
  • In the context of CCPA, an explicit opt-out right is reserved for processing activities that may be deemed a “sale” of data for California residents.

4. Processors (AI and CDN)

  • AI provider: acts solely as a processor; use of data for model training is prohibited.
  • CDN/delivery infrastructure: processes limited log data for visual/media delivery and security.
  • SCC and relevant KVKK mechanisms are applied in international transfers; explicit consent is obtained where necessary.
  • The current subprocessor categories are listed in this Section; material changes are announced by updating this Privacy Notice.

7. Data Retention Periods

Chat logs: up to 12 months or until the account is deleted (whichever occurs first).

Subscription and transaction records: up to 24 months from the end of the subscription (statutory retention obligations remain reserved).

Child Mode game data: until the relevant child profile is deleted; deleted together with it.

Content usage events: aggregate/anonymous statistics only.

In the event of a legal dispute or statutory requirement, retention periods may be extended only until the relevant process is concluded.

7.1. While the Account Is Active

Your data are retained as long as your user account remains active and service provision continues. In addition, data that must be retained to fulfill legal or administrative obligations are stored for the periods specified in the relevant legislation.

7.2. Account Deletion Request

You may request deletion of your data via Profile > Settings > “Delete My Account”. Your data will be deleted or anonymized within 15 days at the latest from receipt of your request (without prejudice to legal retention obligations under KVKK, GDPR, COPPA, CCPA, or other applicable data protection legislation).

8. Data Subject Rights

At least one child profile is required to use the App; in practice, withdrawal of parental consent necessitates deletion of the account (Profile > Settings > Delete My Account).

Within the scope of KVKK, GDPR, COPPA, CCPA, and other applicable data protection legislation, you have the following rights:

  1. Right of Access: To learn whether your personal data are processed and to request information about the data processed.
  2. Right to Rectification: To request correction of inaccurate or incomplete data.
  3. Right to Erasure (Right to be Forgotten): To request deletion or destruction of data under the conditions stipulated in the relevant legislation.
  4. Right to Restrict Processing: To request that your data be processed only for specific purposes (e.g., in legal proceedings).
  5. Right to Data Portability: Where possible, to obtain your data in a structured, commonly used, and machine-readable format.
  6. Right to Object: To object to data processing activities based on legitimate interests.
  7. Withdrawal of Consent: To withdraw your consent at any time for processing activities based on explicit consent.
  8. Right to Lodge a Complaint: To file a complaint with national or international data protection authorities (in Türkiye, the Personal Data Protection Authority; in the EU, the supervisory authority of the relevant country; in the USA, the FTC under COPPA/CCPA or the California Attorney General; in other countries, the competent authorities).
  9. Right to Opt Out of “Sale/Sharing” (CCPA/CPRA): You may opt out of preferences relating to the “sale” or “sharing” of your personal data.
  10. Right to Limit the Use of Sensitive Personal Information (CCPA/CPRA): You may request that sensitive data be processed only for necessary purposes.

To exercise your rights, you can contact us at contact@stepsandstars.com. Depending on the content and nature of your request, a response will be provided no later than 30 days. Your applications are free of charge; however, if processing entails additional costs, a fee may be applied in accordance with the fee policy specified under KVKK, GDPR, COPPA, CCPA, or other applicable data protection legislation, and you will be informed in advance.

9. Contact and Applications

For any questions, requests, or complaints regarding the processing of your personal data, you may use the following contact information:

  • Data Controller: STEPSANDSTARS YAZILIM LİMİTED ŞİRKETİ (Steps&Stars LTD.)
  • Address: Yeşil Mahalle, 56/1 Sokak, Gülpembe, No:18/8, Gaziemir/İZMİR, Türkiye
  • Email: contact@stepsandstars.com
  • Data Protection Officer DPO: contact@stepsandstars.com

10. Updates and Changes

This Information Notice may be updated as necessary in line with changes in KVKK, GDPR, COPPA, CCPA, or other applicable legislation. The current version becomes effective as of the date it is published within the App or at www.stepsandstars.com.

For detailed information on how your personal data are processed, you may also review our Privacy Policy. This notice supplements said Privacy Policy and refers to it where necessary.

11. Data Breach Notification

If a personal data breach is detected, notification will be made to the relevant authority and affected users without undue delay under KVKK/GDPR and, for GDPR, within 72 hours at the latest.

Information will be provided regarding the nature of the breach, its possible consequences, and the measures taken.

STEPSANDSTARS YAZILIM LİMİTED ŞİRKETİ (Steps&Stars LTD.)

Kidevo Mobile Application