Privacy Policy

Data controller: Elvin Jahangirov (a private individual), Warsaw, Poland. For any privacy request: contact@edudash.net.

• As controller: we are responsible for data about user accounts, payments, support requests and website statistics.
• As processor: student and parent data that a teacher or course enters into the Service (attendance, grades, tasks, messages, files and so on) belongs to that teacher or course. We process it only on their instructions, under the Data Processing Agreement. For requests about such data, please contact your teacher or course first — we will help too.

• Account data: first and last name, email, password (stored hashed), phone, profile photo, role, city/district you live in, subject, gender, teaching place and course details (name, type, region).
• Teaching data: classes, schedules, student and parent contact details, attendance, tasks, answers, grades, exams, certificates, notes, reports.
• Communication: in-panel messages and chats, emails sent and received through the Service, attachments and uploaded files.
• Technical data: login times, IP address, browser and device type, error logs.
• Payment data (for paid packages): package, amount, payment date. Card details go directly to the payment provider and are never stored by us.
• Contacting us: what you write in the contact form and support tickets.
• Website statistics: visit data collected by Google Analytics on edudash.net and the signup and login pages (see the Cookie Policy).

• Providing the Service, managing your account, delivering messages and emails — performance of a contract (GDPR Art. 6(1)(b)).
• Security, abuse prevention, fixing errors and improving the Service — legitimate interests (Art. 6(1)(f)).
• Important service notices (for example changes to terms, payments) — performance of a contract.
• Marketing emails and analytics cookies — your consent (Art. 6(1)(a)), which you can withdraw at any time.
• Accounting and tax records — legal obligation (Art. 6(1)(c)).

We share data only with trusted providers who help us run the Service, under contract and only as much as needed:

• Supabase — database, sign-in and file storage (servers in Frankfurt, EU);
• Vercel — website hosting;
• Cloudflare — domain and network security;
• Resend — sending and receiving the Service’s emails;
• Google (Workspace, Analytics, Tag Manager) — our own email and website statistics;
• a payment provider — once paid packages are introduced.

Data is also visible in the Service to the people you choose (teacher, course, student, parent). We may disclose data to authorities where the law requires it. We never sell your data.

Some providers (for example Vercel, Resend, Google) are US companies. Such transfers are protected by the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses. Data of users in Azerbaijan is processed through the same providers.

• Account and teaching data — while the account is active. Deleted within 30 days after the account is closed, and fully removed from backups within 90 days.
• Chat files — 12 months, then deleted automatically.
• Login and technical logs — up to 24 months.
• Payment and accounting records — as long as the law requires (usually 5 years).
• Support and contact requests — 24 months after they are resolved.

A teacher or course can delete their students’ data at any time.

All connections are encrypted (HTTPS). Passwords are stored hashed. In the database each user can only see the data they are allowed to see (row-level access rules). Our staff look at data only when needed for support or security. If a data breach happens, we inform you and the relevant authority within the time the law requires.

Students may include children under 16. The teacher or course entering such a student’s data must obtain a parent’s consent. We do not use children’s data for marketing or profiling. If you believe your child’s data was entered without your consent, write to us.

You have the right to:

• access your data and get a copy;
• correct inaccurate data;
• ask for your data to be deleted;
• restrict or object to processing;
• receive your data in a machine-readable format to move it to another service;
• withdraw your consent at any time.

To make a request, write to contact@edudash.net; we reply within 30 days. You can complain to the Polish data protection authority (UODO, uodo.gov.pl), the authority of the EU country where you live, or the competent authority in Azerbaijan.

We may update this Policy. We announce significant changes by email or a notice in the Service. The date at the top of the page shows the latest update.