Coming soon

Privacy Notice (KVKK)

Last updated: October 27, 2026 Version 1.3

This is an English translation provided for convenience. If there is any discrepancy, the Turkish version prevails.

Changes in version 1.3 (October 27, 2026): The data controller’s company name was added. The AI intermediary was corrected to OpenRouter. Community and Market data, SMS, notification and payment-verification providers, and the photo safety scan were added. The basis for transfers abroad was rewritten to follow the current wording of KVKK Article 9.

Changes in version 1.2 (May 4, 2026): Separate explicit consent under KVKK Article 6 was added for relationship tracking (intimacy_data), activity/exercise (activity_data) and voice note transcription (voice_transcription). A post-response filter for prohibited medical wording on AI output and a new mandatory "data.legal" disclaimer payload were introduced.

This Privacy Notice has been prepared to inform you about the processing of your personal data by Inga Baby (the "App", "we") under Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.

1. Data Controller

Data controller: VeriSet A.Ş. (operator of the Inga Baby app) · Contact: [email protected]

2. Personal Data We Process

  • Identity data: first name, last name, date of birth
  • Contact data: phone number, email address
  • Health data (special category): pregnancy information, breastfeeding/sleep/feeding/vaccine tracking, menstrual cycle, baby development records, mood records, EPDS survey answers
  • Usage data: device ID, notification token, IP address, in-app interaction records
  • Community data: posts, comments, direct and room messages, stories, group memberships, follows, block and report records
  • Market data: listings and their photos, prices, offers, favorites, saved searches, ratings; location is district-level only and no coordinates are stored
  • Purchase data: the store transaction ID and amount of boost purchases (we do not receive card details)
  • Media data: baby photos and audio recordings you upload
  • AI chat history: the questions you ask the AI and the answers you receive (only if you have consented to the AI features, see §5.1)

3. Purposes of Processing

  • Creating and managing your App membership
  • Providing pregnancy and baby tracking features
  • Delivering notifications, reminders and personalized content; sending SMS codes for phone verification
  • Providing Community and Market features, moderation and safety (including the photo safety scan)
  • Producing AI-assisted health/development insights
  • Fulfilling legal obligations (audit and security records)
  • Improving service quality and analyzing errors

Your health data is processed on the basis of your explicit consent under KVKK Art. 6/3; your other personal data is processed under KVKK Art. 5/2-c (establishment and performance of a contract) and Art. 5/2-f (legitimate interest).

5. Transfers

Your personal data may be transferred only in the following cases:

  • Cloud service providers (for infrastructure, under a data processing agreement): Cloudflare R2, cloud database
  • SMS provider (Netgsm): phone number, for verification codes
  • Notification service (Firebase Cloud Messaging): device token, for push notifications
  • Payment verification (RevenueCat, Apple App Store, Google Play): to verify boost purchases
  • AI service providers (OpenRouter and the selected model host): under the conditions described in §5.1 below, with personal identifiers (name, phone, email, etc.) removed (pseudonymized)
  • Legal authorities: where required by applicable legislation

5.1 AI-Powered Features (Optional)

The App offers three optional AI features:

  • AI chat ("Ask AI"): informational answers on baby and pregnancy topics
  • Voice note transcription: dictation for tracking records
  • AI summaries of records: Plus/Pro subscription; analysis of tracking history

Using these features is entirely optional; if you do not consent, the other features of the App are not affected (in line with the prohibition on making a service conditional on consent introduced by the Personal Data Protection Board's decision No. 2023/692 of 02.05.2023).

5.1.1 Pseudonymization (Data Minimization). From the data sent to the AI provider, first name, last name, phone, email, national ID number, city, date of birth (sent as an age band, e.g. 0-3 months, 3-6 months) and child ID (anonymized with HMAC-SHA256) are removed. The AI provider cannot reach your identity or your baby's identity.

5.1.2 Voice Note Transcription. The voice note feature uses the operating system's own speech recognition infrastructure (Apple Speech or Android SpeechRecognizer). The audio stream is converted to text on your device; the raw audio recording is not uploaded to ingaBaby servers.

iOS: Apple's on-device speech recognition is enabled; the audio does not leave your device (per Apple's stated commitment).

Android: On-device recognition is a request; depending on your device's software version, Google's speech recognition services may in some cases be used as part of Android system services (in these cases the audio is processed under Google's own privacy policy). Native solutions (sherpa-onnx / whisper.cpp) will be evaluated in later versions for fully on-device recognition.

Speech recognition is stream-based; no raw audio file is created (neither on the ingaBaby side nor at third parties). Only the transcribed text is written to the tracking record.

5.1.3 AI Intermediary and Transfer Abroad. AI requests are sent through OpenRouter to the infrastructure of the selected model host. The host's region may vary and may be outside Türkiye and the EU/EEA, including the United States. Requests are routed only to hosts that apply zero data retention (ZDR) and do not use the data for training. Data may be transferred to countries for which the Personal Data Protection Board has issued no adequacy decision. Possible risks:

  • The possibility that US authorities request access to the data within the legal framework
  • The absence of a level of protection equivalent to the EU General Data Protection Regulation
  • Limited direct recourse before Turkish courts in the event of a data breach

This transfer is made under KVKK Art. 9, on the basis of the safeguards the Law provides for and, where required, your explicit consent. Thanks to pseudonymization (§5.1.1), the transferred data loses its character as personal data to a large extent; the safeguards we list (pseudonyms, minimization, purpose limitation) also apply. You can withdraw your consent at any time.

5.1.4 Not Medical Advice. Answers produced by the AI are for information only and do not replace medical advice. Consult your doctor for health decisions. Every AI answer is accompanied by the notice "This answer was generated by AI".

5.1.5 Crisis Situations: Emergency Referral. If your message contains expressions indicating a risk of harm to yourself or your baby, the AI is disabled and 112 Emergency Health and the 182 Mental Health Advice Line are shown as hardcoded content (independent of the AI). These triggers are kept in the audit_log table for 5 years (medico-legal traceability).

5.1.6 Withdrawing Consent and Auditing. You can withdraw your AI consents at any time under Settings → Privacy → AI and Data. Your consent history is kept immutably in the consent_log table; every AI call is recorded in audit_log (no content, metadata only) and kept for 5 years as required by KVKK G07.

5.1.7 Chat History. The content of your AI chats is stored in the ai_chat_messages table so that it can be shown back to you. This data is private to you and is not shared with third parties. You can permanently delete all of it at any time via Settings → Privacy → AI and Data → Delete my AI chat history. This data is also included when you request account deletion.

6. Retention Period

Your data is kept for as long as your account is active. It is deleted within 30 days of your account deletion request. Data subject to a legal retention obligation (audit records) is kept for 5 years.

7. Your Rights under KVKK Art. 11

Under Article 11 of the Law, you have the right to:

  • Learn whether your personal data is being processed
  • Request information if it has been processed
  • Learn the purpose of processing and whether it is used in line with that purpose
  • Know the third parties to whom it is transferred, in Türkiye or abroad
  • Request correction if it is incomplete or inaccurate
  • Request its deletion or destruction within the conditions set out in the Law
  • Download (portability) a copy of your data in a machine-readable format
  • Object if a result against you arises from the processing
  • Claim compensation if you suffer damage because the data was processed unlawfully

To exercise your rights, you can use Settings → Account → Download my data / Delete my account in the app or send a written request to [email protected].

8. Data Security

Your data is transmitted encrypted over HTTPS/TLS and stored encrypted on your device. On the server side, AES-256 storage, access control and regular auditing mechanisms are applied.

9. Changes

This notice may be updated when needed. The current version is always published at ingababy.net/en/legal/aydinlatma-metni.html.