Privacy Policy

For the data of your own account, Evolet is the controller of the personal data.

For the student data a teacher enters on the Platform (names, contact details, notes, lesson history, payments), the teacher is the controller. We process that data on the teacher's instruction and to the extent the service requires, and we do not use it for our own purposes.

The teacher is responsible for having a lawful basis for entering their students' data and, for minors, for the consent of a parent or other legal guardian.

Account data:

• name and email address;
• a password hash (we do not store the password itself), or the Google account identifier where you sign in through Google;
• role (teacher, student) and account settings;
• security-event records — sign-ins and password changes.

Data you enter as you work:

• student cards: names, contact details, level, goals, notes;
• the lesson timetable, lesson status and history;
• teaching material, tasks, boards and students' answers;
• payment records and lesson balances;
• files you upload to the material library.

Technical data:

• session cookies needed to sign in;
• server logs recording that a request was made, and any errors.

We do not collect payment card data. Card details are entered on the payment provider's side and never reach us.

• Giving access to the Platform and performing our contract with you — basis: performance of the contract.
• Authentication and protecting your account — basis: performance of the contract and our legitimate interest in the security of the service.
• Sending service messages: email confirmation, password recovery, lesson and homework reminders — basis: performance of the contract.
• Taking subscription payments and keeping accounts — basis: performance of the contract and compliance with statutory requirements.
• Handling support enquiries — basis: your consent, given when you send the enquiry.
• Keeping the service running and investigating failures — basis: our legitimate interest.

We do not sell personal data and do not pass it to third parties for advertising. Data is shared only with the service providers the service cannot run without, and only to the extent needed:

• Resend — sending service email (the recipient's address and the content of the message);
• monobank (JSC Universal Bank) — taking subscription payments (amount, payment identifier; card details are handled by the payment provider and are never visible to us);
• Google — authentication through a Google account and two-way synchronisation with Google Calendar where you have connected it (lesson data);
• Telegram — sending reminders to the messenger where you have connected that channel;
• hosting and database providers — storing data on servers.

Data may also be disclosed to state authorities where the law expressly requires it.

Account data and working data are kept for as long as your account exists.

After an account is deleted we delete or anonymise the data within a reasonable period, except where we are required by law to keep it — payment records in particular.

Security-event records and technical logs are kept for a limited time, as needed to investigate incidents.

An authentication session lasts up to 30 days and is extended while you keep using the service.

You have the right to:

• know what of your data is being processed, and to obtain access to it;
• require inaccurate data to be corrected;
• require data to be deleted where there is no lawful basis for keeping it;
• withdraw consent where processing is based on consent;
• object to processing and require it to be restricted, in the cases the law provides for;
• lodge a complaint with the authority responsible for personal data protection.

To exercise these rights, write to evoleteducation@gmail.com. We reply within the period the law sets. If your request concerns student data entered by a teacher, please contact that teacher — they are the controller of it.

Access to data is restricted and granted strictly by role: a teacher sees only their own students, a student only their own data. Permissions are checked on the server on every request.

Passwords are stored as a cryptographic hash. Data travels between the browser and the server over a secure connection.

Access tokens for third-party services, Google Calendar in particular, are stored encrypted.

No system is perfectly secure, so we ask you to use a strong, unique password and not to share access with third parties.

We use only the technically necessary cookies required to sign in and maintain a session. There are currently no advertising or analytics cookies. The detail is in the Cookie Policy.

We may update this Policy. The current version is always published on this page with its date.

We will notify you of significant changes by email to the address on your account.

For questions about the processing of personal data, contact us at:

• Email: evoleteducation@gmail.com
• Telegram: @evolet_support_bot