Privacy Policy

1. Policy Scope & Brand Identity

Pabli is a brand for digital educational content creation, transformation, and interactive learning tools. This policy applies to all active Pabli products and services:

• Pabli Website: pabli.co domain and associated web pages,
• Pabli Studio: Content conversion, module authoring, and interactive content tools,
• Pabli Board: Interactive display and classroom software,
• Pabli Learn: Student and learner web and mobile experiences,
• Pabli Campus: LMS and infrastructure solutions for educational institutions,
• Communication & Support: Forms, email communications, and support ticketing,
• Subscriptions & AI Services: Plan purchases, add-ons, and AI credit utilization.

2. User Groups

Different access levels and data processing rules apply based on user roles:

• Website Visitors: Browsing pages or requesting product demos.
• Individual Creators / Teachers: Independent account holders creating educational content.
• Institutional Customers & Publishers: Managing teams and students via Pabli Campus.
• Institutional Administrators: Provisioning users, permissions, and managing content.
• Teachers / Instructors: Creating lessons and assigning modules.
• Students: Accessing assigned content, solving activities, and recording learning progress.
• Parents / Legal Guardians: Notified based on institutional rules or legal requirements.

3. Information Collected

3.1. Direct User Inputs

• Account & Identity Data: Name, surname, email address, username, profile photo (if any), role.
• Institutional Info: School/publisher name, job title, and permissions.
• Billing Details: Billing address, tax ID/TCKN for invoicing.
• Support & Communications: Messages submitted via contact forms and emails.
• User Content: Uploaded PDFs, documents, text, images, audio, video, and teaching materials.
• AI Inputs: Prompts and files submitted to AI features.

3.2. Automatically Collected Usage Data

• Session Logs: Login timestamps, IP addresses, session tokens.
• Device Info: Browser type, version, operating system, display resolution.
• Usage Analytics: Projects created, modules used, AI credit consumption, error logs.
• Learning Progress: Responses in interactive activities, quiz scores, module completion status.

3.3. Payment Data

Payments in Türkiye may be processed through Sipay or PayTR. For eligible international transactions, Paddle may act as the authorized reseller and Merchant of Record.

• Credit Card Data: Credit card numbers, expiration dates, and CVVs are never stored, on Pabli servers. Full card numbers and security codes are processed in the relevant payment provider's secure environment.
• Payment Data That May Be Shared: Name, email, billing country and address, product, amount, currency, subscription status, transaction ID, payment result, refund, and chargeback information.
• Paddle's Role: When acting as Merchant of Record, Paddle may be an independent data controller for its own legal obligations and transaction purposes; it is not automatically characterized solely as Pabli's data processor.

3.4. Cookies & Google Analytics

We use essential cookies for session management, and Google Analytics (G-KRX4EZ1DSY) cookies for aggregate performance measurement. Google Analytics is enabled ONLY upon explicit user consent.

4. Purpose of Data Usage

Collected data is used strictly for defined operational purposes:

• Account creation, authentication, and permission management,
• Delivering Pabli Studio, Board, Learn, and Campus services,
• Converting uploaded materials into interactive learning modules,
• Executing AI features and tracking credit usage,
• Processing subscription/add-on orders and issuing invoices,
• Providing customer support and resolving technical issues,
• Ensuring platform security and preventing unauthorized access,
• Fulfilling legal obligations (tax compliance, security logs),
• Sending product updates or newsletters if explicitly opted in.

5. Institutional Accounts

When an educational institution or publisher uses Pabli:

• Administrator Control: Institutional admins manage accounts, permissions, and view progress reports.
• Data Processor Role: For student/teacher data uploaded by institutions, the institution acts as Data Controller, while Pabli acts as Data Processor under documented instructions and a Data Processing Agreement (DPA).
• Institutional Responsibility: Institutions are responsible for providing proper notice and obtaining necessary permissions before uploading student data.
• No Marketing to Students: Institutional student/teacher data is never used for Pabli's independent marketing campaigns.

6. Student & Child Privacy

Pabli enforces dedicated privacy protections for students and minors:

• Purchase Restriction: Minors cannot directly purchase paid subscriptions or AI credits. Purchases must be made by adults (institutions, teachers, parents).
• Account Provisioning: Student accounts are created via schools, teachers, or parents, and remain governed by institutional policies.
• No Ads or Automated Profiling: Student data is never used for commercial ad targeting or automated profiling with legal effects. Learning analytics serve purely educational evaluation.
• AI Usage Guidance: Users are advised not to input sensitive or unnecessary personal data into AI prompts.

7. AI Features & User Content

7.1. Processing: AI module generation processes prompts, uploaded files, and generated outputs over TLS-encrypted connections.

7.2. Model Training Policy: User content and AI inputs are NOT used to train foundation AI models belonging to Pabli or its model providers.

7.3. Sensitive Data Warning: Users must not upload special categories of personal data, unapproved student records, or confidential enterprise documents into AI prompts.

8. Data Sharing

Pabli does not sell personal data. Data is shared strictly with the following categories for operational purposes:

• Institutional Administrators: To view activity logs and usage reports of affiliated users,
• Sipay, PayTR, Paddle & Financial Institutions: For payments, tax, invoicing, subscriptions, fraud prevention, refunds, and chargebacks. Paddle may act as an independent data controller for the relevant transaction.
• Cloud & Hosting Providers: For secure server infrastructure and backups,
• AI Model Providers: To execute requested AI tasks,
• Google Analytics (G-KRX4EZ1DSY): Only if the user explicitly consents,
• Email Service Providers: For system notifications and support emails,
• Legal & Financial Advisors: For compliance, accounting, and auditing,
• Authorized Public Authorities: When required by mandatory legal process.

9. Cross-Border Data Transfers

Where infrastructure providers (cloud servers, AI APIs, analytical services) process data on servers located abroad, transfers are conducted under applicable technical and organizational safeguards. Analytical data transfer via Google Analytics occurs only upon user consent.

Where Paddle acts as Merchant of Record for an international transaction, limited data such as name, email, billing country/address, product, amount, subscription status, transaction ID, refund, and chargeback information may be transferred internationally using safeguards required by Article 9 of the Turkish Personal Data Protection Law.

10. Data Protection

Pabli maintains technical and organizational measures including TLS encryption in transit, role-based access control, and strict data minimization.

11. Retention & Erasure

Personal data is retained for active service periods and statutory limitation periods:

• Tax & Accounting Records: 5 years under tax law; up to 10 years for commercial records where applicable,
• Contractual & Account Records: 10 years following account closure under statutory limitation periods,
• Payment Result References: 10 years,
• Support Tickets: 3 years after ticket closure,
• AI Inputs & Outputs: Until deleted by user or upon account closure,
• Security & Access Logs: Proportional security retention (1-2 years).

Upon expiration, data is securely erased, destroyed, or anonymized.

12. User Controls & Preferences

Users have full control to update profiles, opt-out of marketing emails, manage cookie consent via our preference panel, or request account closure via info@pabli.co.

13. Cookie Management & Analytics Consent

Google Analytics is enabled ONLY upon explicit user consent. Manage your preferences anytime via our Cookie Preference Panel or our Cookie Policy page.

Manage Cookie Preferences

14. Third-Party Links

External links on Pabli are governed by their respective third-party privacy policies.

15. Security Incidents

In the event of a verified data breach, affected users and supervisory authorities will be notified in accordance with legal timelines.

16. Policy Changes

Updates will be published with new effective dates and version information.

17. Contact Us

For privacy questions, contact us at:

• Address: Ayazağa Mah. Kemerburgaz Cad. Vadi İstanbul Park 7A Blok No: 7 B İç Kapı No: 4 Sarıyer Istanbul Turkey
• Email: info@pabli.co