This Privacy Policy explains how Soul Academy ("we", "us", "our") collects, uses, stores, and protects your personal data when you use our educational Platform. We process your data in accordance with the Law of Ukraine "On Personal Data Protection" No. 2297-VI of 01.06.2010 and, where applicable, the General Data Protection Regulation (EU) 2016/679 (GDPR), as our servers are located in the European Union.
What Data We Collect
- Identity data: first name, last name
- Contact data: email address; phone number (optional)
- Authentication data: encrypted password hash, or OAuth token from Google / Microsoft
- Profile photo: URL provided by Google OAuth (if you sign in via Google)
- Learning data: course progress, lesson completion, quiz scores
- Technical data: IP address, browser type, session cookie (sp.refresh)
How We Use Your Data
We use your personal data to: create and manage your account; provide access to courses and track learning progress; send service notifications (email confirmation, password reset, lesson reminders); send marketing communications if you have given explicit consent; ensure Platform security and prevent fraud; comply with legal obligations.
Legal Basis for Processing
We process your data on the following grounds: (a) Performance of a contract — to provide the services you requested upon registration; (b) Legitimate interest — to ensure Platform security and improve our services; (c) Your consent — for optional data and marketing communications, which you may withdraw at any time; (d) Legal obligation — where required by applicable law.
Cookies
We use a single technical cookie ("sp.refresh") to maintain your authenticated session. This cookie is strictly necessary for the Platform to function — it is not used for advertising or cross-site tracking. It is set as HttpOnly and Secure, meaning it cannot be read by JavaScript and is transmitted exclusively over HTTPS. The cookie expires automatically when your session ends or when you log out.
Third-Party Service Providers
We share your data only with trusted providers strictly necessary to operate the Platform, under data processing agreements:
- Google LLC (USA) — authentication via Google OAuth (scopes: openid, email, profile). Data transfer is based on Standard Contractual Clauses (SCCs).
- Bremo SMTP (EU) — email delivery for service notifications and confirmations.
- Telegram Messenger — only if you voluntarily connect your Telegram account; used to send lesson reminders. Data shared: your Telegram user ID.
International Data Transfers
Our servers are located in Germany (European Union). By using the Platform, your data is stored and processed in the EU. Where data is transferred outside the EU/EEA (e.g., to Google’s servers in the USA), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure an adequate level of protection.
Data Retention
We retain your personal data for as long as your account remains active. After account deletion: active session tokens are invalidated within 7 days; audit logs are anonymized within 30 days and fully deleted within 90 days; data export files are deleted after 30 days. We may retain certain data longer if required by applicable law.
Data Security
We implement appropriate technical and organizational measures to protect your personal data: passwords are stored as cryptographic hashes (never in plain text); session tokens use HttpOnly, Secure cookies; all data is transmitted over HTTPS; access to personal data is restricted to authorized personnel only. In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours, as required by law.
Your Rights
Under applicable law (Law of Ukraine No. 2297-VI and GDPR), you have the right to: access your personal data and receive a copy; correct inaccurate or incomplete data; request deletion of your data ("right to be forgotten"); restrict or object to processing; receive your data in a portable format; withdraw consent for marketing at any time without affecting prior processing; lodge a complaint with the Verkhovna Rada Commissioner for Human Rights (Ukraine) or a data protection authority in the EU.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 calendar days.
Minors
The Platform is designed for users aged 18 and over. Users under 18 may use the Platform only with the consent and supervision of a parent or legal guardian. We do not knowingly collect personal data from children under 14 without verifiable parental consent. If we discover that we have collected such data, we will delete it promptly.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by email or via a notice on the Platform at least 7 days before they take effect. Continued use of the Platform after the effective date constitutes acceptance of the updated Policy.
Contact
For privacy-related questions or to exercise your rights, contact our privacy team at [email protected].