1. Who we are (Data Controller)
SeriaReader — Read-later with AI summaries. Package com.seriareader.app. For privacy purposes the controller is SeriaReader (individual developer, Istanbul, Türkiye), operating the website seriareader.com and the Android app distributed via Google Play.
| Controller | SeriaReader Contact: privacy@seriareader.com · support@seriareader.com |
|---|---|
| Address | Management office address on file + correspondence via bank statement address. Will be updated to virtual office upon incorporation — displayed here and in Play Console when assigned. (We do not publish residential address.) |
| Representative (EU) | As we target EU users, GDPR Art.27 representative details will be added upon appointment. Until then contact privacy@seriareader.com. |
Play Console → Store presence → Privacy policy URL: https://seriareader.com/privacy (this page, publicly accessible without login).
2. What we collect
A) Account & Contact
- Email, authentication identifiers (Supabase Auth, Google Sign-In if used), subscription status via RevenueCat / Google Play Billing.
- Support messages you send us.
B) Content you save
- URLs, titles, saved article excerpts, your notes, tags, folders, and sharing metadata (SEND intent).
- We do not collect sensitive categories (health, political, biometric, etc.) unless you actively save such content — then it is treated as user content.
C) Usage & Device
- Quota counters (e.g., 1/30 Free, 1/300 Pro), AI request timestamps, success/failure counts (failed/duplicate = 0), app version, OS version, device model, crash/ANR diagnostics, language (TR/EN).
- Payment-related receipts are handled by Google Play / RevenueCat — we store only entitlement status (Pro/Free) and quota, not full card data.
D) AI processing input
- Text you submit for summarization is sent to Mistral AI (
ministral-8b-2512) for inference. Single-attempt, no retry/fallback, no training on your data.
3. How we use it & Legal bases
| Purpose | Legal basis — GDPR Art.6 / KVKK Art.5-6 |
|---|---|
| Provide read-later sync, tags, notes, offline access | Contract (Art.6(1)(b) / KVKK m.5/2-c) — performance of service you requested |
| AI summaries & tagging | Contract + Legitimate interest (Art.6(1)(b,f) / KVKK m.5/2-c,f) — to deliver the core feature |
| Subscription & quota enforcement (30/300) | Contract + Legal obligation ( billing / tax for Mükerrer 20/B) |
| Support, bug fixes, security, fraud prevention | Legitimate interest (Art.6(1)(f) / KVKK m.5/2-f) |
| Analytics in aggregate (no ads) | Legitimate interest — minimal, pseudonymized |
| Marketing (only if you opt in to waitlist/newsletter) | Consent (Art.6(1)(a) / KVKK m.5/1) — withdraw anytime |
Türkiye KVKK'da açık rıza yanında kanunlarda öngörülme, sözleşme ifası ve meşru menfaat hukuki sebeplerine de dayanıyoruz. AB'de GDPR 6(1) kapsamındaki 6 sebepten uygun olanı uygulanır.
4. Processors & Sharing — we don't sell data
We share data only with processors needed to run the service, under DPAs:
- Supabase (EU-hosted project) — Auth, database, Edge Functions (
sync-subscriptionfor entitlement sync). - Mistral AI — AI inference for summaries. Zero Data Retention in production PAYG; content not used for training.
- RevenueCat + Google Play Billing — subscription purchase & entitlement. Google processes payments.
- Google Play / Firebase (if crash reporting enabled) — distribution & diagnostics.
- Email / support tooling — only for messages you send.
We do not sell or share personal information for cross-context behavioral advertising, and we do not use data for third-party ads. If this ever changes we will update this policy and, for US users, provide the required “Do Not Sell or Share” link.
5. International transfers
- Data is primarily stored in EU region (Supabase EU). Mistral inference is processed in EU-eligible endpoints.
- Where data leaves Türkiye / EEA (e.g., US-based subprocessors), we rely on GDPR Art.46 safeguards (SCCs) and KVKK Art.9 explicit-consent/adequacy mechanisms + the 2024 KVKK cross-border reform (adequacy + SCC + BCR).
- By using the app in a different country than your residence you understand your data may be transferred and processed as described.
6. Retention
- Saved content, notes, tags: until you delete your account or remove items.
- Quota & AI logs: detailed 14 days, aggregated 12 months for abuse prevention and billing reconciliation, then deleted/anonymized.
- Auth & subscription records: duration of account + as required by tax law (Türkiye 5-10 years for invoices under VUK / GVK Mükerrer 20/B where applicable).
- Support emails: 2 years.
7. Your rights
EEA / UK (GDPR / DSGVO)
Rights under Art.15-22: access, rectification, erasure, restriction, portability, objection (including to legitimate-interest processing), and not to be subject to automated decision-making with legal effect. Also the right to lodge a complaint with your local DPA (e.g., Germany: BfDI / Landes-DSAs).
Türkiye (KVKK m.11)
Learn whether data is processed, request information, learn purpose & recipients, request correction/deletion, object to automated analysis, request compensation for unlawful processing. Requests answered within 30 days via privacy@seriareader.com.
How to exercise
Email privacy@seriareader.com from your account email with subject “Privacy Request”. We may verify identity. App settings also provide in-app delete/export where available.
8. California & US States — Do Not Sell / GPC (CCPA/CPRA, CPA, VCDPA etc.)
As of 2026, 24 US states have comprehensive laws (effective examples: California CCPA/CPRA Jan 2020/2023, Virginia Jan 2023, Colorado Jul 2023, Texas Jul 2024, Oregon Jul 2024, etc.).
- We do not sell or share personal information. Therefore no “Do Not Sell or Share My Personal Information” toggle is currently required. If this changes we will add a clear link in the app Settings and on this page.
- Global Privacy Control (GPC): We honor GPC opt-out preference signals for US users as required (Cal. 11 CCR §7025, and required in CA, CO, CT, TX, OR, DE, MT, NE, NJ, NH, MN, MD as of Jan 2026). When GPC is detected we treat it as an opt-out of sale/share and targeted advertising (which we do not engage in).
- Categories collected (CCPA §1798.130): Identifiers (email), Internet activity (usage, quota), Geolocation (coarse, from device), Commercial information (subscription tier), User content. Sensitive personal information is not collected except as user content you save.
- Rights (CA/CO/CT/TX/OR etc.): Right to know, delete, correct, opt-out of sale/share/targeted ads, limit use of sensitive info, and non-discrimination. Submit via privacy@seriareader.com or in-app Settings → Privacy.
- Mobile app disclosure: Per Cal. Code §1798.130 and 2026 regs, this policy is linked on the Play Store listing and inside the app (Settings → Privacy).
- Minors: No sale/share of data of consumers under 16 without opt-in consent.
9. Cookies & Tracking
- Website (seriareader.com): Essential cookies only (no ad trackers). If analytics is added later, consent banner and opt-out will be provided for EEA/UK.
- Android app: No third-party advertising SDKs, no cross-app tracking. Local storage (AsyncStorage) for offline cache, auth tokens, and quota is used. No advertising ID collected.
10. Children
Not directed to children under 13 (US COPPA) / under 16 in EEA. Minimum usage age is 16. If you believe a child provided data, contact us for deletion.
11. Security & Breach
- Encryption in transit (TLS) and at rest (Supabase), least-privilege secrets (named apikey, no legacy service-role Bearer in client), access logging.
- Breach notification: GDPR 72h to DPA + without undue delay to affected users where risk is high; KVKK — notification to the Board and affected persons as soon as possible.
12. Changes & Contact & DPO
We may update this policy; material changes will be notified in-app or via email and the “Effective date” above will change. Continued use after notice means acceptance; if you disagree, delete your account.
| Privacy contact | privacy@seriareader.com (preferred) — response within 30 days (KVKK) / 1 month (GDPR) / 45 days (CCPA). |
|---|---|
| DPO / VERBIS | KVKK VERBIS registration will be completed upon controller registration thresholds. No GDPR DPO required at current scale, but privacy@ handles all requests. |
| Complaints | EEA: your national DPA. TR: KVK Kurulu (kvkk.gov.tr). US CA: Attorney General / CPPA (cppa.ca.gov). |
This policy does not create rights beyond applicable law. Where translations conflict, the English version governs for international interpretation; Turkish version governs for KVKK matters before Turkish authorities.