1. Scope
This policy covers the cosmoverse.app website and the CosmoVerse mobile application. Data controller: ROOK AI Neuromarketing Teknoloji A.Ş. Address: Esentepe Mah. Büyükdere Cad. Levent 199 No: 199 İç Kapı No: 6, Şişli / İstanbul. Contact: cosmoverseofficialapp@gmail.com · +90 212 993 72 00.
2. Website: what data is processed?
- Access logs: The website is hosted on Vercel Inc. infrastructure. IP addresses, browser types and request times are retained for up to 30 days for security and error detection.
- Cart and order form: The cart stores only the package ID in your browser (localStorage); it contains no personal data. The name, email address and telephone number entered in the order form remain in your browser session (sessionStorage); when you confirm the order, your action sends them to the payment provider or WhatsApp.
- Website usage analytics (on, and you can switch it off): On this parent-facing website, we use Microsoft Clarity to analyse clicks, scrolling, page visits, browser/device information and masked session recordings to identify usability problems. Clarity loads when you open the page; if you select “Turn it off” in the notice card or through the cookie button in the bottom-left corner, it stops and never loads again. Its cookies stay on your device but are not read; you can clear them from your browser settings. Forms and order summaries are masked. Clarity is not added to the children's application. Microsoft advertising consent remains disabled for Clarity. The recipient is Microsoft; data may be processed abroad, including in the USA. You can change your choice through “Cookie preferences” at the bottom of the website. See the Cookie Policy and Microsoft Privacy Statement.
- Advertising measurement (on, and you can switch it off): Fonts load from our own server; some images and videos load from our content delivery network. Meta (Facebook) Pixel and Google Tag Manager measure advertising effectiveness and start when you open the page. Unless you have switched measurement off, Meta Platforms Ireland Ltd. receives your IP address, browser information, visited page address, the action you take (such as adding to cart or completing an order), and the package name and amount. No data belonging to children is sent. The legal basis is the legitimate interest ground in Article 5(2)(f) of the Turkish Personal Data Protection Law (KVKK): measuring the return on our advertising budget. Under Article 11 of the KVKK you may object to this processing at any time: select “Turn it off” in the notice card shown when the page opens, through the cookie button in the bottom-left corner, or through “Cookie preferences” at the bottom of the website. Once you do, the pixel never loads again, the decision is stored indefinitely and the website continues to work. Cookies already placed stay on your device but are no longer read; you can clear them from your browser settings. Meta may transfer data to the USA. Google Tag Manager loads at the same time and stops with the same click; this request shares your IP address and browser information with Google. Google may process data abroad. See the Cookie Policy.
- Payment: Card details are entered only on the secure payment provider's (iyzico) page; we do not receive them. Order and invoice records are retained for the statutory period.
3. Application: data we collect
- Account information: The parent's email address and a password hash. The account is opened in the name of a parent/guardian over 18.
- Child profile: A nickname and age range. We do not request the child's real name, date of birth, photograph or contact details.
- Usage data: Completed discoveries, discovery streaks and questions asked within the application. This is used only to display progress and provide content.
- Technical data: Device model, operating system version and error logs, solely for application stability.
4. Data we do not collect
- We do not collect location data.
- We do not access contacts, the photo gallery, microphone or camera.
- We do not use advertising identifiers; the application contains no advertising network or third-party tracking SDK.
- We do not process children's data for advertising or profiling, or sell it to third parties.
5. Children's data
Only a guardian may open an account; accounts are not opened for children under 8. Guardians can view, edit and delete their child's profile through their own account. Questions asked by the child in the application are visible only in the guardian's account and are not shared with third parties. Compliance with the App Store “Kids” and Google Play “Families” policies, store privacy labels and the Data Safety form are updated on the same date as this text.
6. Purposes and legal bases
Data is processed to provide the service, manage accounts, handle orders and subscriptions, issue invoices and technically improve the application. Processing relies on the establishment and performance of a contract, compliance with legal obligations and legitimate interests under Article 5 of the KVKK. Other processing, such as commercial electronic communications, requires your explicit consent, which may be withdrawn at any time.
7. Subprocessors and international transfers
| Provider | Purpose | Country | Basis for transfer |
|---|---|---|---|
| Vercel Inc. | Website hosting and access logs | USA | — |
| iyzico | Payment processing | Türkiye | Performance of a contract |
| Apple / Google | Application distribution and in-app payments | USA | Performance of a contract |
8. Retention periods
| Data | Period |
|---|---|
| Account and child profile | Until account deletion; no later than 30 days after deletion |
| Usage data (discoveries and questions) | Deleted with the account |
| Order, invoice and contract records | Statutory period: 5 years under the Turkish Tax Procedure Law (VUK) / 10 years under the Turkish Commercial Code (TTK) |
| Website access logs | Up to 30 days |
9. Data security
All data transfers are encrypted using TLS; passwords are stored using one-way hash functions. Access permissions are role-based and reviewed regularly. The website is served with Content Security Policy (CSP) and HTTP Strict Transport Security (HSTS) headers.
10. KVKK privacy notice and your rights
As data controller under Turkish Personal Data Protection Law No. 6698, ROOK AI Neuromarketing Teknoloji A.Ş. processes your personal data for the purposes and legal bases stated above, transferring it to the specified recipient groups. Under Article 11, you have the right to:
- Learn whether your personal data is processed and request information about such processing;
- Learn the purpose of processing and whether data is used in accordance with that purpose;
- Know the third parties to whom data is transferred in Türkiye or abroad;
- Request correction of incomplete or inaccurate data;
- Request deletion or destruction of data and notification of these actions to third parties to whom it was transferred;
- Object to an adverse outcome resulting from analysis through automated systems;
- Claim compensation for damage caused by unlawful processing.
How to apply: In accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller, you may send a written request to Esentepe Mah. Büyükdere Cad. Levent 199 No: 199 İç Kapı No: 6, Şişli / İstanbul, or email cosmoverseofficialapp@gmail.com from the email address registered in our system. Requests are resolved free of charge within 30 days.
11. Changes and contact
Changes to this policy are published on this page; significant changes are notified to the registered parent's email address. Questions: cosmoverseofficialapp@gmail.com · +90 212 993 72 00.