Privacy Policy

The Operator (a natural person who administers EduRol AI) acts as the controller of personal data for the Platform. This Policy explains how we process personal data when you use the Service. We process data under Law No. 133/2011 of the Republic of Moldova on the protection of personal data and, for users in the EU, under the GDPR. Contact: [email protected].

We collect account data (name, e-mail, role), school membership, pupil academic records entered by authorised staff, usage logs and technical data (e.g. device / browser, IP). Payment card data is not stored on our servers (see §4).

• Account & authentication — name, e-mail, role, school; purpose: access and security. • Catalogue / grades / absences / conduct — pupil school data; visible only to entitled roles (teacher, class master, linked parent, pupil, director). • Homework / exams — answers, scores, images (stored privately, served via short-lived signed URLs). • Analytics — server-side aggregates; no personal data of other pupils is exposed; percentile only at ≥3 pupils. • Meetings (Google Meet) — scheduling data; the meeting link is revealed only within the meeting's time window. • Notifications / Announcements / Telegram / E-mail — contact data and message content, to entitled recipients only. • AI features (homework, presentations, video, audio / TTS, images, assistant) — the text / prompts needed for generation are sent to the AI provider; anonymisation is applied where provided (without the pupil's name). • Billing — payment data is collected and processed by Lemon Squeezy (MoR); we do not store full card data.

Payment card and billing-address data are collected and stored by Lemon Squeezy, LLC (our Merchant of Record), not on EduRol servers. We receive subscription status and the limited transaction metadata needed to grant access and keep records.

We use third-party providers strictly to operate the Service, including: infrastructure and database (Supabase), AI model provider (via OpenRouter), payment processor / Merchant of Record (Lemon Squeezy), messaging (Telegram), transactional e-mail (Resend) and network / storage / hosting (Cloudflare / hosting provider). Each receives only the data necessary for its purpose. See the Sub-processors page for details.

Schools act as data controllers for pupil records; the Operator acts as processor for school-submitted content and as controller for account / billing data. We retain data while your account is active and as required by legal obligations; on termination, data is deleted or anonymised, except records required by law (e.g. billing).

We apply technical and organisational measures: role-based access control, tenant isolation (per-institution / row-level security), private storage of sensitive files, short-lived signed URLs, and time-gating of meeting links. No system is 100% secure; see the limitation of liability in the Terms.

Depending on your jurisdiction, you may request access, rectification, deletion, restriction, objection or portability of your data via your school director or [email protected]. You may also complain to the National Center for Personal Data Protection (CNPDCP) of the Republic of Moldova.

Pupil accounts for minors are managed under the authority of the institution and the parent / legal representative, exclusively for educational purposes.

We use strictly necessary cookies (session, language). Your language preference and session are managed via cookies; we do not use advertising profiling. See the Cookie Policy for details.

Data may be processed in the EU / EEA or by sub-processors outside the Republic of Moldova, bound by appropriate safeguards where required by law.

Privacy inquiries: [email protected]. You may also contact the CNPDCP (Republic of Moldova) for complaints.