EduNode — Privacy Policy

1. Who We Are (Controller) & Contacts

Viktor Oleksandrovych Tkachenko, a sole proprietor (FOP) registered in Ukraine, operating edunode.co ("EduNode", "we", "us"), is the data controller for the personal data described in this Policy.

• Controller: Viktor Oleksandrovych Tkachenko, FOP, Ukraine
• Taxpayer / registration code: 2982020657 (РНОКПП / individual taxpayer number)
• Registered address: Prospekt Myru 19, Rivne, Rivne Oblast, 33011, Ukraine
• Privacy / data-protection contact: privacy@edunode.co
• General contact: support@edunode.co

2. Categories of Personal Data We Collect

• Account & identity data — name, email, password (hashed), Account type (Tutor / School / Student), language preference.

• Profile & Listing data — profile text, photos, subjects, languages taught, availability, and other Content you publish.

• Payment-related metadata — Subscription plan, billing status, invoices, partial payment-method metadata, and tokens/identifiers returned by our billing processors. We do not store full card numbers. For Lesson Payments we hold no payment data — those are handled by the Tutor's/School's own provider (see Section 5 and the Terms, Section 7).

• Settlement & affiliation data — where your Account is affiliated with another Account on the Service (a School engaging a Tutor to deliver its Listings, or a Tutor delivering for a School): the affiliation and its status, the agreed commission or fulfilment-fee rate, the amounts and dates of the completed Bookings that rate is applied to, and the requisites that appear on the settlement documents the two Accounts exchange — legal or business name, taxpayer number (РНОКПП / ЄДРПОУ or the equivalent in your country), VAT number where held, and registered address.

• Booking & Session data — Bookings, time-slots, Session schedules, attendance, reminders, calendar entries.

• Online meeting metadata — where a meeting provider (Zoom) is used: meeting identifiers, links, scheduled times, and connection metadata. (We do not record Sessions unless separately disclosed and consented.)

• Content submitted for machine translation — text you submit that is sent to our translation processor (LibreTranslate) to produce translations.

• Geolocation data — Account location / address you provide and, where relevant, coordinates used for proximity search (we do not use IP-based geolocation for matching).

• Communications — messages sent through the Service, support requests, notices.

• Device, log & error data — IP address, device/browser type, timestamps, pages viewed, and diagnostic/error data.

• Page-view measurement data — collected by our own first-party, cookieless page-view counter, which runs on our own servers with no third party involved. Per page view it records: the page path (the query string is not stored as such); utm_source / utm_medium / utm_campaign where the link carried them; the host name only of the referring site, never the full referring address; the display language; a UTC date and time; and a visitor hash — a SHA-256 value computed from a random daily salt, your IP address and your user-agent string. Your IP address is used to compute that hash and is then discarded: it is never stored and never logged. The salt is random, kept only on our server, and deleted after two days — a day's salt is kept for that day and the two days that follow — after which nobody holding our database can work out which IP produced a past hash. Because the salt changes daily there is no identifier that spans days, so the counter measures daily unique visitors and cannot recognise a returning visitor or build a profile. Traffic identified as automated is discarded rather than recorded. This is described in full in Section 3.1 of the Cookie Policy, including why it sits outside the consent banner.

• Sign-up source data — how the browser session in which you registered FIRST reached the Service: any utm_source / utm_medium / utm_campaign parameters on the link you followed, the host name only of the site that linked to us (never a page within it, and never our own pages), and the path of the first page you opened. It is held in your session's server-side data from your first page until you register, copied to your Account at that moment, and discarded with the session if you never register. It contains no IP address, sets no cookie of its own, and records no page after the first.

• Cookie & similar data — see the Cookie Policy.

3. Purposes & Legal Bases

We process personal data for the following purposes, on the following GDPR Article 6 legal bases:

3.1 An affiliation between two Accounts is never based on consent. Rows 16 and 17 rest on the agreement you enter with the other Account and on our own invoicing and tax obligations, so there is no consent to withdraw: a settlement document that omitted a party's requisites would not be a valid invoice. What you can do instead is end the affiliation itself, which stops future disclosures — see Section 5.4.

3.2 Why audience measurement is a row of its own, and why it is not row 10. Row 10 covers security, abuse prevention and debugging. When you gave us device and log data, that is what it was for. Counting how many people visit is a different purpose, and re-using an answer given for one purpose to justify another is exactly what a legal basis is supposed to prevent — so measurement is disclosed separately, as row 18, with its own basis and its own retention period (Section 4).

Row 18 is also not row 13. Row 13 is consent for cookies — measurement here uses no cookie and no other storage on your device, so there is no storage or access for which the ePrivacy consent rule would require consent. Section 3.1.6 of the Cookie Policy sets out that reasoning, and Section 3.2 there explains why turning the banner's Analytics category off does not switch this counter off.

We rely on legitimate interest — Art. 6(1)(f), having weighed it as follows. Our interest: we cannot run or improve the Service without knowing whether anyone reads it. Necessity: the counter collects the minimum that answers that question, and no more — no cross-site tracking, no device fingerprint, no enrichment, no combination with your Account, no sharing with anyone. Your interests and reasonable expectations: the processing is pseudonymous by construction and irreversibly so within two days; it cannot follow you between days; it is never used to target you or to make any decision about you; and it is not shared. Your control: you may object under Art. 21 at any time (Section 7.1), and the count is not sent at all if your browser does not run the script that sends it.

4. Retention

We keep personal data only as long as necessary for the purposes above:

• Account & profile data — for the life of your Account, then deleted or anonymised within a reasonable period after closure.
• Booking & Session / meeting metadata — for the life of the Account plus a limited period for dispute/defence purposes.
• Communications & support — a limited period after resolution.
• Device / log / error data — short rolling retention.
• Page-view measurement data — a longer period than the line above, and stated separately for that reason: page-view rows are deleted automatically after a configurable retention period, 365 days by default, so that one year can be compared with the next. Two things shorten what those rows actually contain: your IP address is never written at all, and the daily salt is deleted after two days, after which the surviving row can no longer be linked back to an IP address.
• Sign-up source data — for the life of your Account, as part of your Account data; the session-held copy before registration lives only as long as that session.
• Financial, invoicing & tax records (Subscriptions) — retained for the period required by Ukrainian tax and accounting law (generally several years; commonly cited as up to 7 years), even after you ask us to erase other data.
• Settlement documents between Accounts — a commission invoice, fulfilment invoice or credit note issued between two affiliated Accounts is immutable by design: each party's requisites are copied onto the document at the moment it is issued, so that it keeps printing what was true then. These are retained for the statutory tax and accounting period on the same footing as our own invoices, and cannot be altered or erased on request while that period runs.

4.1 Erasure vs. legal retention. Where you exercise your right to erasure (Section 7), we will delete your data except records we are legally required to keep (e.g., financial/tax records), which we retain in restricted form until the legal retention period expires.

5. Sub-Processors, Recipients & Other Controllers

We use the following service providers ("sub-processors") who process personal data on our behalf or to whom data is disclosed to deliver the Service:

5.1 We share personal data with these providers only as needed for the purposes described, under data-processing terms. We may also disclose data to authorities where legally required, and to advisors/insurers, or to a successor in a business transfer, subject to law.

5.1.1 Audience measurement uses no sub-processor. The page-view counter described in Section 2 and row 18 of Section 3 runs on our own servers. No analytics provider, pixel, tag or SDK is involved, and no measurement data is disclosed to any of the providers listed above or to anyone else.

5.2 Other Accounts that receive your data as independent controllers

The recipients in this subsection are not sub-processors. They do not process your data on our behalf and we do not direct what they do with it — each is an independent controller in its own right, answerable to you directly under GDPR for its own use of what it receives. They are disclosed separately for that reason: listing them in the table above would describe the relationship wrongly.

5.3 What is not shared this way, and what the documents leave out. We do not disclose a Student's identity or contact details to an affiliated Account through the Service. Where a School sells a Booking that one of its Tutors delivers, the School holds the relationship with the Student and decides for itself what it tells the people who teach for it; the settlement records we generate for that Tutor carry amounts and dates only, and no Student identity. The settlement documents also carry no bank or payment details of either party — two affiliated Accounts pay each other outside the Service.

5.4 Ending an affiliation. Ending an affiliation stops further disclosures, but it does not withdraw documents already issued: see Section 4 on why a settlement document cannot be altered after issue.

6. International Transfers

6.1 EduNode is operated from Ukraine. Personal data of EU/UK data subjects will be transferred to and processed in Ukraine, for which the European Commission has not issued an adequacy decision. Such transfers are made under Standard Contractual Clauses (SCCs) together with a Transfer Impact Assessment and supplementary measures as appropriate.

6.2 Several sub-processors are established outside Ukraine and the EEA (including in the United States). Transfers to those providers are made under appropriate safeguards — Standard Contractual Clauses and, where the provider is certified, the EU–US / UK Data Privacy Framework (DPF) — together with supplementary measures.

6.3 You may request a copy of the relevant safeguards by contacting privacy@edunode.co.

7. Your Rights

Subject to applicable law, you have the right to:

• Access your personal data;
• Rectify inaccurate or incomplete data;
• Erase data ("right to be forgotten"), subject to legal-retention exceptions (Section 4.1);
• Restrict processing;
• Object to processing based on legitimate interests, and to direct marketing at any time;
• Data portability — receive certain data in a portable format;
• Withdraw consent at any time, where processing is based on consent (without affecting prior lawful processing);
• Not be subject to solely automated decisions with legal/significant effect (Section 10).

To exercise any right, contact privacy@edunode.co. We will respond within the timeframes required by law (generally one month under GDPR). We may need to verify your identity.

7.1 Objecting to audience measurement (row 18), and what we can honestly do about it. You may object under Art. 21 at any time on grounds relating to your particular situation. Two limits are worth stating plainly rather than leaving you to discover them:

• We cannot find your past page views. By design we hold no identifier that links a page view to you: your IP address was never stored, and after two days the daily salt that produced the visitor hash is gone. Where we genuinely cannot identify a person from the data we hold, GDPR Art. 11 applies and the access, rectification, erasure and portability rights cannot be exercised against those particular records — not because we decline, but because there is nothing we can point at as yours. We will say so rather than perform a search we know is meaningless.
• The reliable way to stop being counted is at your end. The count is sent by a script on the page; if your browser does not run it, no page view is recorded (see Cookie Policy, Section 3.1.7).

If you write to privacy@edunode.co we will explain what is and is not technically possible in your case, and consider any suppression measure that would not require us to start holding more data about you than the counter holds today.

8. Complaints to a Supervisory Authority

If you are in the EU/EEA, you may lodge a complaint with the supervisory authority of your country of residence, place of work, or place of the alleged infringement. UK users may complain to the Information Commissioner's Office (ICO). Ukrainian users may contact the relevant Ukrainian data-protection authority. We would, however, appreciate the chance to address your concern first via privacy@edunode.co.

9. Cookies and Cookieless Measurement

We use cookies and similar technologies as described in our Cookie Policy, under a prior-consent model for non-essential categories.

9.1 That policy also describes, in its Section 3.1, a first-party page-view counter that uses no cookie and no other storage on your device. It is not consent-based, because there is no storage on or access to your device for consent to attach to; it rests on legitimate interest instead (row 18 of Section 3 above). Section 3.2 of that policy explains what the banner's Analytics control does and does not govern, so that the two statements are not left to be reconciled by the reader.

10. Automated Decision-Making & Profiling

10.1 We use automated processing in limited ways, including: search ranking of Listings, promoted-placement display, machine translation of Content, fraud/abuse signals, reminder/notification scheduling, and aggregate audience measurement (row 18 of Section 3).

10.1.1 Audience measurement produces statistics, not decisions about you. It does not evaluate personal aspects of anyone, and so is not profiling within the meaning of GDPR Art. 4(4); it cannot follow a person between days at all.

10.2 These do not produce legal or similarly significant effects on you within the meaning of GDPR Article 22, and we do not make solely automated decisions of that kind without a lawful basis and applicable safeguards. If that ever changes, we will inform you and provide the required information and safeguards.

11. Children

The Service is for persons 18 and older (see Terms, Section 3). We do not knowingly collect personal data from anyone under 18. If we learn we have collected such data, we will delete it.

12. Changes to This Policy

We may update this Policy. For material changes, we will provide reasonable notice (e.g., email and/or in-Service notice) before they take effect. The "Effective date" above reflects the current version.