Last updated: 24 September 2026
This privacy policy explains how the Serka app handles personal data: the app for Android (package com.serkalaw.app), for iPhone and iPad (bundle com.serkalaw.app), and the same app in a web browser at app.serkalaw.com. The app is published by Serkan Kara, attorney at law, under the name Serka Law Firm.
Who we are
Serka Law Firm, Atty. Av. Serkan KARA, registered with the Istanbul Bar Association under no. 53770.
Gayrettepe Mah., Cemil Aslan Güder Sk., Modül Apt. No:26 D:2, 34349 Beşiktaş / İstanbul, Türkiye.
Privacy contact: info@serkalaw.com
Serkan Kara is the data controller of the personal data described here under the Turkish Personal Data Protection Law No. 6698 (KVKK).
The two parts of the app
Opening a file, for anyone
The app shows the matters we take and our fee for each, and lets anyone open a file with us: choose the matter, give their details and the facts, add documents and, after paying, the bank’s transfer receipt. No account is created and no sign-in is needed.
The office desk, for our lawyers
Our lawyers pair the app with the office’s desk computer by a QR code shown on that computer. A paired phone shows the office’s hearings, deadlines, messages and matters. Without a pairing this part opens nothing.
Opening a file
What you give us
- your name, e-mail address, phone number and country, and the language you want us to write to you in;
- the facts of your matter in your own words, and your answers to the questions the matter asks (for example your nationality, dates, who is in an application, an amount in dispute);
- the documents you add: the photo page of your passport and the other documents the matter asks for or you choose to add (PDF, JPEG, PNG, HEIC or Word files, photographed with the camera or chosen on your device);
- after you pay, the bank’s receipt for your transfer, which shows the payment and the account it came from;
- your consent, with its date and time.
With your file we also keep the matter you chose and the fee the app showed you, so that the figure you saw is the figure we hold ourselves to.
A file can name other people: the person concerned if it is not you, the family members in an application, the other side of a dispute. Please give their details only where you are entitled to. A file can also hold sensitive details, for example about a criminal case or a person’s health. We ask only for what the matter needs.
Why we use it, and on what grounds
We use your file to review your matter, to tell you what we can do for you and what it costs, to take your instructions and act for you, and to keep the records our profession requires. The grounds under KVKK are: the conclusion or performance of our engagement with you (Article 5(2)(c)); establishing, exercising or protecting a right (Article 5(2)(e), and Article 6(3)(d) for sensitive data); our legal obligations (Article 5(2)(ç)); and your explicit consent, which the app asks for before a file is opened (Articles 5(1) and 6(3)(a)).
How your file travels and where it is kept
The app sends your file over an encrypted connection (HTTPS) to our intake service at intake.serkalaw.com, which runs on Cloudflare. There, before anything is stored, your details, your facts and each document are encrypted with a key of their own (AES-256-GCM), and that key is encrypted with our office’s public key (RSA-OAEP). The private key that opens them exists only on our office computer: neither Cloudflare nor anyone with access to our Cloudflare account can read your file.
The encrypted file is held in Cloudflare’s storage in the European Union until our office computer collects it. The office computer asks for new files every two minutes while it is running. It checks every document against the fingerprint (SHA-256) taken when the document arrived, writes the file into your matter’s folder and reads it back, and only then deletes it from Cloudflare.
The intake service also deletes files by itself: a file opened but not sent within 24 hours, and a sent file that has not been collected within 29 days. Cloudflare’s storage deletes anything older than 30 days in any case, and its database keeps a recovery history of up to 30 days, which holds only the encrypted form. The intake service keeps no log of what it receives.
From then on your file is kept on our office computer as the file of your matter, under the lawyer’s duty of professional secrecy (Avukatlık Kanunu 1136, Article 36) and KVKK.
What stays on your phone or in your browser
The app keeps on your device a copy of the details you entered, your file code, the upload key that lets you add your transfer receipt to the same file for up to 90 days, and the names and sizes of the documents you sent. It also keeps the list of matters and fees. “Remove from this phone”, on the app’s “Your file” tab, deletes a file’s copy from the device; in a browser, clearing the site’s data does the same.
Checking that a person opens the file
Before a file is opened, Cloudflare Turnstile checks that the request comes from a person and not from a program. It runs in the app and in the browser, processes signals such as your IP address, your connection’s TLS fingerprint and your browser’s user agent, and may keep its own cookies or storage for the check; it does not read what you type into the form. Cloudflare processes these signals for us to block automated abuse, and also, as a data controller under its Turnstile Privacy Addendum (https://www.cloudflare.com/turnstile-privacy-policy/), to improve its detection of automated traffic. Our intake service uses your IP address only while it answers a request, to limit repeated requests and for this check, and does not store it.
Other connections the app makes
The list of matters and fees is read from our intake service; that request carries nothing about you. In the Android and iPhone app, the payment screen reads the day’s exchange rates from the Central Bank of the Republic of Türkiye (www.tcmb.gov.tr); that request carries nothing about you beyond what every internet request carries, such as your IP address. The privacy and support pages open in your own browser.
The office desk
A paired phone talks to one address, the office’s desk (desk.serkalaw.com), over HTTPS through Cloudflare Tunnel and Cloudflare Access. With each request it sends:
- the device’s pairing identifier and access token, and the Cloudflare Access service token, to prove that the request comes from a paired device;
- the request itself: which hearings, deadlines, messages, matters or documents to show;
- text the lawyer types into the app: search terms, reply drafts and questions to the office’s desk session.
The desk logs the time, the device, the kind of request, its result and how long it took; it does not log what was asked. Search terms are used to answer the request and are not stored. Reply drafts and questions are processed by the office’s desk session on the office computer, which uses Anthropic’s Claude; a reply is placed into the office’s WhatsApp or e-mail program on that computer for the lawyer to send. The app itself sends no message to anyone.
The hearings, deadlines, messages, client names and documents the desk shows are our office’s own records. They reach only the phone of a paired lawyer, under the lawyer’s duty of professional secrecy and KVKK.
On Android, the pairing QR code is read with Google’s ML Kit barcode library. The camera image is decoded on the phone and is not sent. ML Kit sends Google diagnostic and usage information: device information (manufacturer, model, operating system version), the app’s package name and version, an identifier per installation that is not intended to identify a user or a physical device, performance metrics and error codes. Google encrypts this data in transit and states that it does not transfer it to third parties.
On Android, the pairing is stored in the Android Keystore. The language, the theme and the lock setting are stored in the app’s own storage. Reminders of hearings and deadlines are scheduled on the phone by the phone. Fingerprint and face recognition are performed by Android; the app receives only whether the check succeeded, and no biometric data leaves the phone.
On iPhone and iPad
The App Store version of Serka (bundle com.serkalaw.app) is the same app and handles data the same way, with these differences. The pairing is stored in the iOS Keychain. Face ID, or the device passcode, is checked by iOS; the app receives only whether the check succeeded. The pairing QR code is read on the phone with Apple’s own camera and Vision frameworks: that image never leaves the phone, and nothing is sent to Google or anyone else for it. The iPhone and iPad version contains no advertising, analytics or crash-reporting code. A document shared from the desk is written to the app’s own cache on the phone for the share sheet.
Who works on your file, and who else sees it
- Our lawyers read and work on your file.
- Anthropic. Our lawyers may use Claude, a machine-learning model made by Anthropic, on the office computer to help prepare the work on a file, for example to read its documents or to draft our reply. When they do, the parts of the file that the task needs are sent to Anthropic and handled under Anthropic’s published terms. A lawyer decides every reply and every step; no decision about you is made by a program alone.
- Microsoft and Meta. We write to you by e-mail from our office, and our office e-mail runs on Microsoft 365. We may also reach you on the phone number you gave, by a call or on WhatsApp, which Meta runs, where you use it.
- Cloudflare carries the app’s connections and holds your encrypted file until our office computer collects it; Turnstile works as described above.
- Courts, authorities and the other side of a matter receive what your matter requires, on your instructions, or where the law obliges us.
We do not sell personal data and we do not use it for advertising. The app contains no advertising, analytics or tracking code of its own. We use only providers that keep the data they handle for us secure, and we give each of them only what its part of the work needs.
Using these providers means that your data is processed outside Türkiye: your encrypted file is held in the European Union, Cloudflare’s network handles connections in data centres around the world, and Anthropic and Microsoft may process data in other countries.
Security
Every connection is encrypted in transit (HTTPS; the intake service requires it). A file is encrypted before it is stored, only our office computer can open it, and every document’s fingerprint is checked when the office collects it. The desk answers only a request that carries both a valid Cloudflare Access token and the token of a paired device, and keeps only a hash of each device’s token. The app asks for the fingerprint, face or passcode before it shows the desk, and again after a minute away; a lost phone is revoked on the desk and its token no longer opens anything.
Retention and deletion
- In the cloud: until our office computer collects the file, usually within minutes, and never longer than the limits above: 24 hours for a file not sent, 29 days for a file not collected, 30 days for Cloudflare’s storage and for its encrypted recovery history.
- On our office computer: for as long as your matter needs, and then for as long as the law requires a lawyer to keep records. If you open a file and do not instruct us, we keep it so that we can answer you if you come back, and we delete it when you ask, unless the law requires us to keep it.
- On your device: until you remove the file from it (“Remove from this phone”); for the desk, until the phone is unpaired in the app’s Settings or revoked on the desk.
- The desk’s records: the desk’s request log and the desk session’s records stay on the office computer under the office’s record-keeping duties.
To withdraw your consent, to have your data deleted, or to use your other rights, write to info@serkalaw.com. Under KVKK Article 11 you may ask whether your data is processed and for information about it; learn why it is processed and whether it is used for that purpose; know the third parties in Türkiye or abroad to whom it is transferred; have it corrected, erased or destroyed and have those third parties told; object to a result against you that comes solely from automated analysis; and claim compensation for damage caused by unlawful processing. We answer free of charge within 30 days (Article 13). If we refuse or do not answer, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within the periods of Article 14. Where the GDPR (Regulation (EU) 2016/679) applies, you have its rights as well.
Children
The app is not directed to children, and a file is opened by an adult. A file can contain a child’s details, for example in a family’s residence or citizenship application; a parent or guardian gives them.
Changes
We update this page when the app’s handling of data changes, and change the date above. The consent the app asks for before a file is opened refers to this page.