Privacy policy

This policy explains what personal data Skorway collects, why, who processes it, how long we keep it and what rights you have. We follow Türkiye's Personal Data Protection Law No. 6698 (KVKK) and, where it applies to you, the EU General Data Protection Regulation (GDPR). If you live in Türkiye, please also read our KVKK information notice.

Who we are

Skorway is run by [Company legal name], [Company address] (registration number [Registration number], tax office [Tax office and number]). We are the data controller for the personal data described here.

• Privacy questions and requests: privacy@skorway.com
• Registered e-mail (KEP), for formal KVKK applications: [KEP address]
• General help: help@skorway.com

What we collect

Account details. Your email address and name. If you sign in with Google or Apple, we also receive the name, email address and, if available, profile photo that the provider shares with us. We never store a password: you sign in with a 6-digit code sent by email, or with Google or Apple.

Settings. Your interface language, explanation language and email choices. Optionally, your test date and target band.

Your test and practice work. Your answers, essays and emails you write, your Speaking recordings and their written transcripts, your scores, bands and feedback, and your practice and mock history. This includes requests you make for a person to re-score an answer.

Payment records. Order details, the pass or mock you bought, amount, currency, date and receipt number. Card details are entered directly with the payment provider (Paddle or iyzico). Skorway never sees or stores your card number.

Official score reports and reviews. Only if you choose to send them.

Referral and partner codes. Invitations and teacher or coupon codes you used, and the weeks or discounts they gave. For teachers: your partner code, passes bought with it and commission owed.

Support messages. Emails you send us and our replies.

Technical data. Logs (such as IP address, browser, device type, pages requested and times), error reports and your cookie choices.

Analytics. Only if you accept analytics cookies: how you use the site, such as pages visited and features used. See our cookie policy.

We do not use your voice recordings to identify you, and we do not create voiceprints. We do not ask for health, religious or other special categories of data. Please do not include such information in your answers.

Why we use your data and our legal bases

• Creating your account, signing you in, running tests and practice, building your study plan, and account and receipt emails. Basis: performing our contract with you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• Transcribing and scoring your answers with AI, writing feedback and re-scoring on request. Basis: performing our contract with you.
• Taking payments, issuing receipts, handling refunds and keeping tax and accounting records. Basis: our contract with you, and our legal obligations (GDPR Art. 6(1)(b) and (c); KVKK Art. 5(2)(c) and (ç)).
• Reminders, weekly plan emails and score-request emails. Basis: our legitimate interest in helping you prepare (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)). You can switch them off at any time.
• Newsletter and analytics. Basis: your consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)), which you can withdraw at any time.
• Checking scoring quality, re-scoring old answers when our rubric improves, and the anonymised public accuracy chart. Basis: our legitimate interest in accurate scoring.
• Referral weeks, coupon and teacher codes, and teacher commission. Basis: performing our contract with you and with the teacher.
• Keeping the site secure, fixing errors and preventing abuse. Basis: our legitimate interest in a safe, working service, and our legal obligations.
• Answering support messages. Basis: our contract with you, or our legitimate interest in answering you.
• Dealing with legal claims. Basis: establishing, exercising or defending legal rights (GDPR Art. 6(1)(f); KVKK Art. 5(2)(e)).

Where we rely on legitimate interests, you can object (see "Your rights").

AI scoring

Reading, Listening and Build a Sentence are marked automatically. Speaking answers are transcribed by a speech-to-text service. Take an Interview, Write an Email and Academic Discussion answers are scored by Claude, an AI model from Anthropic, against Skorway's rubric, twice independently (with a third pass if the two differ by more than half a band).

The result is a practice estimate. It is not an official score and has no legal or similarly significant effect on you. If you disagree with a Speaking or Writing score, choose "Ask for a re-score" on the feedback page and a person will review it and reply by email within three working days.

Who we share data with

We do not sell your personal data. We share it only with service providers that process it for us under written agreements, and only as far as they need:

• Anthropic (Claude): AI scoring of your written answers and Speaking transcripts. Under Anthropic's commercial API terms, your answers are not used to train its models.
• Deepgram: transcription of Speaking recordings.
• Resend: sending emails.
• Paddle: payments in US dollars. Paddle is the merchant of record for these purchases, so it is the seller to you and handles your payment and tax details under its own privacy policy.
• iyzico: payments in Turkish lira with Turkish cards, including installments. iyzico handles your card details under its own privacy policy.
• Vercel: hosting of the application.
• Neon: our database, in the EU (Frankfurt).
• Cloudflare R2: storage of Speaking recordings, in the EU.
• PostHog (EU cloud): analytics, only if you consent.
• Sentry: error reports, so we can find and fix bugs.

We also share data in these cases:

• Teachers. If you used a teacher's partner code and agreed to share your reports, that teacher can see your mock reports on their dashboard. If you want to stop sharing, contact privacy@skorway.com.
• Friends who invited you. When you finish your free mock, the friend who invited you receives their free week, so they may learn that you finished it.
• Report verification. Every mock report has a number (SK-R-2026-…). Anyone who has that number can check it at skorway.com/verify and will see only your initials, the date and your bands. Share it only with people you choose.
• Public accuracy chart. If you report your official score, it is added to the chart without your name.
• Authorities. When the law requires it, such as tax authorities or courts.
• Business transfer. If Skorway is sold or merged, your data may pass to the new owner, who must keep protecting it as this policy describes. We will tell you first.

Transfers outside Türkiye and the EU

Several of our providers are based, or process data, outside Türkiye, and some outside the European Economic Area, for example in the United States. Our database and recordings are stored in the EU.

For transfers from Türkiye, we follow KVKK Article 9: we transfer data on the basis of an adequacy decision where one exists, or with appropriate safeguards such as the standard contracts published by the Personal Data Protection Board (notified to the Authority as required). Only where none of these is available, and only for occasional transfers, do we ask for your explicit consent.

For transfers from the EU, we rely on an adequacy decision of the European Commission where one exists, or otherwise on the European Commission's standard contractual clauses.

You can ask us about the safeguards for any transfer.

How long we keep data

• Account data, answers, recordings, transcripts, feedback and history: while your account exists. We keep them so your answers can be re-scored and so we can check scoring quality.
• After you delete your account: everything above is deleted within 30 days. Backups rotate out within a further 35 days at most.
• A fingerprint of your email address: when you delete your account, we keep a one-way, keyed code made from your email address, together with which free allowances you used (the free mock, free AI evaluations and vouchers). It cannot be turned back into your address. We use it only so that signing up again with the same address does not give the free allowances twice, which is our legitimate interest in preventing misuse. For the same reason, addresses that reach the same inbox, such as Gmail addresses with dots or a "+" tag, count as one.
• Receipts and payment records: as long as tax and commercial law requires, which in Türkiye can be up to 10 years. Nothing else is kept with them.
• Anonymised statistics, such as the public accuracy chart, may be kept because they no longer identify you.
• Support messages, technical logs and error reports: only as long as needed to deal with your request or to run and secure the service.

Your rights

Depending on where you live, you have the right to:

• Access your data and learn how we use it.
• Correct wrong data. You can change your details on the Account page.
• Delete your data, for example by deleting your account on the Account page.
• Export your data. Choose "Download my data" on the Account page to get everything in one JSON file.
• Object to processing based on our legitimate interests, and to a result reached only by automated processing.
• Restrict processing in certain cases (GDPR).
• Withdraw consent at any time, for example for analytics or the newsletter.
• Know which third parties received your data, and have them told of corrections or deletions.
• Claim compensation if you suffer damage from unlawful processing (KVKK Art. 11).

To use a right not covered by the Account page, email privacy@skorway.com from the address on your account. Formal KVKK applications can also be sent to [KEP address]; see the KVKK information notice for details. We reply within 30 days and free of charge. We may ask you to confirm your identity.

You can also complain to the Turkish Personal Data Protection Authority (KVKK Kurumu, www.kvkk.gov.tr) or, if you live in the EU, to the data protection supervisory authority in your country. We would be glad to try to put things right first.

Emails

• Always sent: sign-in codes, account emails and receipts. These are needed to run your account.
• You can switch off in Account: reminders, weekly plan emails and emails asking for your official score.
• Only if you opt in: the newsletter.

Every marketing email has an unsubscribe link.

Children

Skorway is not intended for anyone under 16. If you are under 18, you need a parent's or guardian's consent where the law requires it. If we learn that we hold a child's data without the consent required, we will delete it.

Security

We limit access to personal data to people and providers who need it and use security measures appropriate to the risk. We do not store passwords or card numbers. If a data breach is likely to put you at risk, we will tell you and the authorities as the law requires.

Changes to this policy

If we change this policy, we will update the date at the top. If a change is significant, we will tell you by email or on the site before it takes effect. If a change needs your consent, we will ask for it.