Privacy Policy & KVKK

1. Data Controller and Scope

This notice informs users of the Lexote mobile application (the “App”) and lexote.com.tr about the processing of their personal data under Türkiye’s Personal Data Protection Law No. 6698 (“KVKK”).

Data controller: Eyup Zarifoğlu
Location: Onikişubat / Kahramanmaraş, Türkiye
Contact: info@lexote.com.tr

The data controller’s full postal address is available on request for applications under the KVKK. Please contact info@lexote.com.tr to obtain it.

In this notice, “Lexote” refers to the mobile application and website provided by the data controller identified above.

By using the App, you are informed about the data processing activities described in this notice.

2. Personal Data We Process

Account data: your full name, email address, password (stored in an irreversible form solely by Firebase Authentication and not visible to us), account creation and update timestamps, and notification preferences.

Guest use: when you use the App without registering, only an anonymous, randomly generated user ID is created. No first name, surname or email address is collected.

Your app content: notes, descriptions, court or institution details, case numbers, time limits and dates, voice notes (audio recordings), and their creation and update timestamps.

Support correspondence: when you send a support email from within the App, your email address and message, together with the app version and device model/operating system information automatically added to the message.

Technical data: connection logs (including server logs containing IP addresses) and error logs generated by our infrastructure providers to deliver and secure the service.

Crash and diagnostic data: if the App closes unexpectedly, a crash report is generated automatically to help resolve the problem. It contains a technical stack trace, the app version, device model and operating system version. Your note content, client information, audio recordings and account ID are not included in the report — crash logs are not linked to your user account.

The App does not use an advertising ID, collect location data, request access to contacts or photos, or run analytics tools to track or profile users. The only measurement data collected is the crash reporting data described above.

3. Purposes and Legal Bases for Processing

Account creation, session management, note storage and access across devices — entering into and performing a contract (KVKK, Article 5/2-c).
Deadline calculations, reminders and notifications — performance of a contract; for notification permissions, your explicit consent and device permissions (KVKK, Article 5/1).
Password resets, abuse prevention, system security and troubleshooting — legitimate interests (KVKK, Article 5/2-f).
Responding to support requests — performance of a contract and legitimate interests.
Compliance with legal obligations and handling legal claims — KVKK, Articles 5/2-ç and 5/2-e.

Your personal data is not processed for marketing, sold, or shared with third parties for advertising.

4. Client Data and Professional Confidentiality

The notes you enter into the App may contain personal data belonging to your clients or third parties. For this data, you are the data controller; Lexote acts only as a data processor storing the data on your instructions. In this context:

You are responsible for informing your clients and obtaining their consent where required.
Your duty of confidentiality under Article 36 of the Turkish Attorneys’ Act remains in effect.
We recommend that you enter no more personal data than is necessary to use the service, and record special categories of personal data, such as health data or criminal convictions, only when essential.

Lexote does not read or analyse the content of your notes or use it for any purpose other than providing the service.

5. Guest Use Without Registration

When you use the App without registering, your data is stored on the server under an anonymous ID linked to your device. Therefore:

Your data can only be accessed from that device; access from another device is not possible.
If you uninstall the App or sign out of the guest session, you permanently lose access to those records.
If you register while using a guest session, your existing data is transferred to your new account.
If you want your data deleted, use the in-app account deletion option before signing out. After you sign out, we may be unable to match a deletion request to your records because the anonymous record ID is no longer known. In that case, the records are deleted within the retention periods below.

6. Data Sharing and International Transfers

We use the following service providers to deliver the service:

Google (Firebase / Google Cloud): authentication, the database (Cloud Firestore — Frankfurt, Germany), server functions (Belgium), file storage (audio recordings), app integrity verification (App Check) and crash reporting (Crashlytics). Google processes data on its infrastructure.
Resend: solely to deliver password reset codes by email.
Apple and Google (app stores): app distribution, notification infrastructure and in-store ratings.

International transfers that may occur through these providers are carried out under Article 9 of the KVKK, within the framework of the providers’ standard contractual clauses and data processing commitments.

7. Retention Periods

Active notes: kept until you delete them.
Completed notes: automatically moved to the trash after 3 days.
Trash: permanently deleted after 30 days. Before then, you can restore the records or permanently delete them immediately.
When an account is deleted: notes, audio recordings and notification records linked to the account are automatically deleted on the server.
Password reset codes: valid for 10 minutes; related records are retained briefly to prevent abuse.
Server logs: kept for the infrastructure provider’s default retention periods (typically up to 30 days).

After deletion, data may remain in the infrastructure provider’s backups for a short time before being removed completely.

8. Security

All communications are encrypted using TLS, and data is stored encrypted on the provider’s infrastructure.
Database and file storage access is restricted by security rules so each user can access only their own records. These rules are tested regularly.
Passwords are not visible to us. Password reset codes are protected by time limits and a limited number of attempts.
Audio recordings are stored in an area accessible only to the user who created them.

However, no transmission or storage over the internet is 100% secure. It is important to protect your own device and account.

9. Permissions and Notifications

The App requests microphone permission only to create voice notes, notification permission for reminders, and calendar permission only if you enable “Add notes to phone calendar” in Settings. You can decline these permissions or change them later in your device settings. Reminders are scheduled mainly on your device. Timely delivery cannot be guaranteed if operating system restrictions, battery-saving settings or missing permissions interfere.

Phone calendar: If you enable this option, the title, deadline, court or institution details, and case number of your active notes are added as events to your phone’s calendar. You choose how they appear: “As a regular event” adds them to your phone’s default calendar, while “With a Lexote label” adds them to a separate, gold-coloured “Lexote” calendar created on your phone. This information is not sent to us for this operation. The App reads calendar events only to identify the ones it added, and changes or deletes only those events; it does not modify your other events. If your calendar syncs with an account such as iCloud or Google, these events are also transferred to that account. People you share your calendar with and other apps you have granted calendar access may also see them. When you disable the option or sign out, the events added by Lexote are removed from your phone (or the “Lexote” calendar itself, if you chose the separate calendar).

10. Cookies

The mobile app does not use cookies. lexote.com.tr makes only the technical requests needed to display the page; no tracking or advertising cookies are used.

11. Children’s Data

The App is intended for professionals and is not suitable for anyone under 18. If we discover that data belonging to someone under 18 has been processed, we delete the record.

12. Automated Decision-Making

The App does not make automated decisions or carry out profiling that produces legal effects concerning you. The deadline calculator is solely a calculation tool based on the data you enter.

13. Your Rights

Under Article 11 of the KVKK, you have the right to learn whether your personal data is processed; request information about its processing and purpose; learn which third parties receive it in Türkiye or abroad; request correction of incomplete or inaccurate data; request its erasure or destruction where the relevant conditions are met; request that these actions be notified to third parties to whom the data was transferred; object to adverse results arising from analysis solely by automated systems; and claim compensation for damage suffered.

You can delete your notes and account from within the App at any time. For other requests, contact info@lexote.com.tr. Requests are resolved within 30 days at the latest. If your request is rejected, you retain the right to lodge a complaint with Türkiye’s Personal Data Protection Board.

Users accessing the service from the European Union may also exercise their GDPR rights of access, rectification, erasure, restriction of processing, data portability and objection through the same contact address.

14. Changes

This policy may be updated to reflect changes to the service or legislation. The current version is always published on this page, with the update date at the top. Significant changes are announced within the App.

15. Contact

Email: info@lexote.com.tr