Last updated: 11 October 2026

1. Data Controller

Under Turkish Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed by the following company as data controller:

AE Telekom Bilgi Teknolojileri Yazılım ve Ticaret A.Ş. ("Company", "we")
Mecidiye Kuyu Sok. Kuyu Ap. No:26/2 Mecidiyeköy, Şişli / Istanbul, Türkiye
MERSİS: 0008132591900001  ·  Tax office / no: Zincirlikuyu / 0081325919
E-mail: This email address is being protected from spambots. You need JavaScript enabled to view it.  ·  Phone: +90 850 303 98 47
Registered electronic mail (KEP): This email address is being protected from spambots. You need JavaScript enabled to view it.

2. Scope

This policy covers all of our services (the "Service"): the www.numistr.org website, the AnatolianCoins mobile app, and the AI assistant on the site. For contractual terms, see the Terms of Use.

3. Personal Data We Process

3.1. Identity and contact data

Name, surname, e-mail address, provided by you when you create an account or use a contact form. If you sign in with Google, Google passes your name, e-mail address and profile picture to us through our identity provider.

3.2. Membership and subscription data

Membership type (Standard / PRO), subscription start and end dates, payment status and subscription events (purchase, renewal, cancellation). We never see or store your card details; payments are taken within the payment provider's own infrastructure (§7).

3.3. Coin photographs

The coin photos you take or choose from your gallery when you use recognition. How these are processed — and why they are not stored — is set out in §6.

3.4. Recognition request records

For each recognition request we record: not the image itself but an irreversible digest of it (SHA-256), the time and duration of the request, the matches found with their confidence scores, your IP address and your browser/device string (user-agent). These records let us show your scan history, apply fair-use limits and investigate abuse. For trial scans made without an account (up to 3), we also store an irreversible digest (SHA-256) of a random identifier the app generates for this installation, together with the number of trial scans used; this identifier contains no device hardware information and is used only to apply the trial allowance and abuse limits.

3.5. AI assistant conversations

The messages you send to the assistant, its replies and the conversation title are stored against your account so that you can return to past conversations. Your messages are sent to language-model providers to generate the reply (§7).

3.6. Student / academic application data

If you apply for student membership: name, surname, e-mail, university, department, areas of interest, the student status document you upload, the time of application and your IP address. The document is stored in a directory that is not directly reachable from the web and is viewed only to verify student status.

3.7. Security and usage data

IP address, device and browser information, server access logs, on-site navigation data and cookies (§9).

4. Purposes of Processing

• Creating your membership, verifying your identity and managing your account.
• Operating subscriptions and payments and meeting invoicing obligations.
• Providing photo-based coin recognition and returning the result to you.
• Providing personalised features such as scan history, collections and favourites.
• Enabling the AI assistant to answer your questions.
• Assessing student membership applications.
• Keeping the Service secure, enforcing fair-use limits, detecting account sharing and automated (bot) use.
• Measuring and improving performance through aggregated, de-identified usage statistics.
• Handling your requests and complaints and communicating with you.
• Meeting legal obligations and responding to competent authorities.

5. Legal Bases

• Performance of a contract (KVKK art. 5/2-c): membership and subscription, providing recognition, scan history and collection features.
• Legal obligation (art. 5/2-ç): invoicing, tax and commercial record-keeping, requests from competent authorities.
• Legitimate interest (art. 5/2-f): security, fraud and abuse detection, enforcement of fair-use limits, service improvement.
• Explicit consent (art. 5/1): non-essential cookies and analytics; and, should training of AI models ever apply, only with separately obtained explicit consent (§6).

6. How Your Coin Photographs Are Handled

• What they are used for: only to compute the visual similarity between your coin and the records in our catalogue and to show you the list of matches.
• How they travel: over an encrypted connection (HTTPS) to our servers and from there to our own recognition server. They are not sent to any third-party image-processing service.
• 🔒 They are not stored: the image is never written to disk; it is held in memory only and discarded as soon as processing finishes. We keep no archive of the photos you upload.
• What remains: an irreversible digest (SHA-256) together with the recognition result (§3.4). Your photograph cannot be reconstructed from that digest.
• AI training: the photos you upload are not currently used to train AI models; since they are not stored, such use is not technically possible. If this ever changes, we will ask for your separate, explicit consent, and declining will not prevent you from using the Service.
• Device permissions: the mobile app requests camera and photo-library access solely for recognitions you start yourself. You can withdraw these permissions at any time in your device settings.

7. Transfers of Personal Data

As a rule we do not sell your personal data or share it for marketing without your explicit consent. To deliver the Service we share it, only to the extent necessary, with the recipients below. Some of these providers are located outside Türkiye; such transfers are made under KVKK art. 9.

Your coin photographs are not transferred to any party in this table; recognition runs on the Company's own server.

8. Retention Periods

Where legislation prescribes a longer period, that period applies. Data whose retention period has expired is deleted, destroyed or anonymised.

9. Cookies and Measurement

• Essential cookies: required to maintain your session, keep you signed in and keep the site secure. The site cannot work without them; the legal basis is legitimate interest.
• Measurement and advertising cookies: used through Google Analytics, Google Tag Manager and Google Ads to understand how the site is used and to measure advertising performance. These are subject to your explicit consent.

You can manage cookie preferences and delete existing cookies in your browser settings, and you may send a "Do Not Track" signal.

10. Data Security

We take appropriate technical and administrative measures to prevent unlawful processing of and access to personal data and to ensure its safekeeping. These include carrying all traffic over an encrypted connection (HTTPS), not storing passwords ourselves (authentication runs through a separate provider), role-based access, rate limiting and abuse detection, never collecting payment card data, and keeping access logs.

No internet service can guarantee absolute security. In the event of a personal data breach we notify the Turkish Personal Data Protection Board and the affected individuals within the periods prescribed by law.

11. Children's Data

The Service is not designed for anyone under 18 and we do not knowingly collect personal data from that age group. If we become aware that we hold data belonging to a user under 18, that data is deleted. Parents or guardians who notice such a case are asked to contact This email address is being protected from spambots. You need JavaScript enabled to view it..

12. Your Rights (KVKK art. 11)

You have the right to: learn whether your personal data is processed; request information if it has been; learn the purpose of processing and whether it is used accordingly; know the third parties to whom it is transferred in Türkiye or abroad; request correction of incomplete or incorrect data; request erasure or destruction under the conditions in art. 7; request that such actions be notified to the third parties concerned; object to a result reached against you solely through automated analysis; and claim compensation for damage arising from unlawful processing.

How to apply: send your request, together with information establishing your identity, to This email address is being protected from spambots. You need JavaScript enabled to view it., to our KEP address (This email address is being protected from spambots. You need JavaScript enabled to view it.) or in writing to the postal address above. Applications are concluded free of charge within 30 days at the latest, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller; where the action entails an additional cost, the fee set by the Board may be charged.

If your application is refused, the response is insufficient or no reply is given in time, you may lodge a complaint with the Turkish Personal Data Protection Board.

Account deletion: you may request deletion of your account and associated data through the channels above. Records that must be kept by law (e.g. invoice data) continue to be held for their statutory period.

13. Users Resident Outside Türkiye

The rights of users resident in the European Union under the General Data Protection Regulation (GDPR), and the mandatory rights of users resident elsewhere under their own national law, are reserved. Nothing in this policy may be read as removing them.

14. Changes

This policy may be updated in line with changes in legislation or in our services. We will notify you through the Service of material changes; in any case the current text is published on this page together with its update date.

15. Contact

AE Telekom Bilgi Teknolojileri Yazılım ve Ticaret A.Ş.
Mecidiye Kuyu Sok. Kuyu Ap. No:26/2 Mecidiyeköy, Şişli / Istanbul, Türkiye
E-mail: This email address is being protected from spambots. You need JavaScript enabled to view it.  ·  Phone: +90 850 303 98 47
Registered electronic mail (KEP): This email address is being protected from spambots. You need JavaScript enabled to view it.