This policy explains what EduSpace knows about you, why, who else sees it, and what you can do about it. It covers the EduSpace website at edu-space.io and the EduSpace mobile application.
The controller of your data is EDU SPACE - FZCO, Dubai, United Arab Emirates. Privacy questions: [email protected].
We process personal data in accordance with applicable UAE data protection law, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL"), and, where they apply to you, the EU General Data Protection Regulation ("GDPR") and the UK GDPR.
1. The short version
- We collect what an education platform needs to work: who you are, what you publish, who you talk to, what you bought.
- We do not run advertising and we do not sell your data. The mobile app has no advertising identifier and no analytics SDK. The website uses analytics tools (Yandex Metrica and Google Analytics) to understand how it is used — see section 8 and the Cookie Policy.
- Your content belongs to you. We do not use it to train AI models.
- You can delete your account from inside the app, and we mean delete.
2. What we collect
2.1 What you give us
| Data | Why |
|---|---|
| Email address | To sign you in and to send account emails |
| Name, nickname, avatar, cover, date of birth, country, bio, role, portfolio | To make a profile other people can recognise |
| Posts, comments, notes, files, stories, courses, calendar entries | This is the Service |
| Chat messages, including attachments and voice messages | To deliver them to the people you wrote to |
| Photos, video and audio you attach, and session recordings | To show them where you attached them, and to keep recordings for the space that made them |
| Questions you ask the Cate assistant, including photos of tasks | To answer them |
| Reports and support requests | To act on them |
2.2 What we receive from others
| Data | From | Why |
|---|---|---|
| Name, email address and an account identifier | Google or Apple, if you sign in with them | To create your account and sign you in. With Apple you may choose to hide your real email address |
| The fact that a payment succeeded, what it was for, and its amount | Apple, Google, Stripe | To give you what you bought and to keep accounting records |
2.3 What your device tells us
| Data | Why |
|---|---|
| Push token (APNs on iOS, FCM on Android) | To deliver notifications to this device |
| Device model, OS version, app version | To diagnose crashes and to keep old versions working |
| IP address and approximate region derived from it | Security: rate limits, detecting break-in attempts |
| Interface language and time zone | To show the interface and reminders in the right language and at the right hour |
2.4 What happens as you use the Service
Who you follow, which spaces you joined, what you liked and viewed, when you were last online, how much storage you use, your coin balance and wallet statement, your purchases and subscription status.
On the website, our analytics tools also record how pages are used: pages visited, clicks, scrolling, the device and browser, approximate location from the IP address, and where you came from. Yandex Metrica's session replay feature (Webvisor) can record how you interact with a page. Details are in section 8.
2.5 What we never collect
Advertising identifiers (IDFA / GAID), precise location, contacts, health data, biometrics. Camera, microphone and photo library are used only while you are actively attaching something or taking part in a session — never in the background.
We never see your card number. Payments are handled by Apple, Google or Stripe; we receive only the fact that a payment succeeded and what it was for.
3. Why we are allowed to process it
| Purpose | Legal basis |
|---|---|
| Running your account, delivering messages, giving access to what you bought, hosting your content | Performance of our contract with you |
| Keeping the Service safe: anti-abuse, moderation, rate limiting, bot checks, fraud prevention | Our legitimate interest in a safe service, and, under the PDPL, the grounds the law allows for security and for protecting users |
| Tax and accounting records for purchases; responding to lawful requests from authorities | Legal obligation |
| Push notifications, and access to camera, microphone and photo library | Your consent, given in the system dialog and withdrawable in your device settings at any time |
| Website analytics (Yandex Metrica, Google Analytics) | Your consent where the law requires it; otherwise our legitimate interest in understanding and improving the website |
Under the PDPL, we process personal data with your consent or where another ground permitted by the law applies, such as performing a contract with you or complying with a legal obligation. Where we rely on consent, you can withdraw it at any time; withdrawal does not affect processing that already took place.
We process your data only for the purposes described in this policy. If we want to use it for a new purpose that is not compatible with these, we will tell you first and, where the law requires it, ask for your consent.
Automated decisions. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing, including profiling. Automated tools help us stop spam and bots (for example rate limits and Cloudflare Turnstile), and you can always ask for a person to review an action taken against your account.
4. Who else sees your data
Other users see what you choose to share: your profile, and what you post in public or in spaces you belong to. Private messages are seen by the people in the conversation. Space owners and moderators see the activity in their space. Authors of courses you buy see that you bought them.
Service providers process data on our behalf. Each one gets only what its job needs, is bound by a contract, and may not use your data for its own purposes except where the table says it acts under its own policy.
| Provider | What it does | What it sees |
|---|---|---|
| Cloudflare (R2, Turnstile) | Stores files, images and video; checks that sign-ins come from people, not bots | The files you upload; technical signals from your browser during the bot check |
| LiveKit | Carries live video and audio sessions | Media streams during a session |
| Groq | Runs the AI model behind Cate | The text, images and audio you send to Cate |
| Stripe | Payments on the website and payouts to authors | Payment data; card details go to Stripe, not to us |
| Apple, Google | In-app purchases; sign-in with Apple or Google | Purchase and subscription records; the sign-in request |
| Apple (APNs), Google (FCM) | Deliver push notifications | The push payload, which may include a message preview |
| Resend | Sends account emails | Your email address and the message |
| Yandex (Yandex Metrica) | Website analytics | Usage data and identifiers from analytics cookies on the website |
| Google (Google Tag Manager, Google Analytics) | Website analytics | Usage data and identifiers from analytics cookies on the website |
Stripe, Apple and Google also act as independent controllers for payments and sign-in, under their own privacy policies.
Beyond that, we disclose data only when the law requires it, to a competent authority that lawfully requests it, when it is needed to protect someone from harm, to establish or defend legal claims, or if EduSpace is ever sold or merged — in which case you will be told before your data moves.
Child sexual abuse material is reported to the authorities, always.
5. Where your data lives
Our servers and database are in Dubai, United Arab Emirates. The providers above may process data in other countries, including the European Union, the United States and, for Yandex Metrica, the Russian Federation.
We transfer personal data outside the UAE only as the PDPL allows: to countries with an adequate level of protection, or with appropriate safeguards such as contractual clauses that require the recipient to protect the data, or on another ground permitted by the law. Where data leaves the EEA or the UK, transfers rely on an adequacy decision, the standard contractual clauses, or an equivalent legal mechanism. You can ask us for more information about the safeguards used.
6. How long we keep it
| Data | Retention |
|---|---|
| Account and content | While your account exists |
| Deleted account | Hidden immediately, erased 14 days after the request |
| Chat messages | While the conversation exists; a message you sent stays in the other person's copy |
| Push tokens | Until the app is removed or the token stops working |
| Reports and moderation records | 12 months after the case is closed |
| Payment and tax records | As long as accounting and tax law requires, usually 5 years |
| Server logs | 30 days |
| Backups | Up to 30 days, then overwritten |
| Website analytics data | Kept by the analytics provider under its retention settings, and no longer than 14 months for Google Analytics; cookie lifetimes are in the Cookie Policy |
We may keep data longer where the law requires it, or where it is needed for a pending legal claim or an investigation by a competent authority.
7. Notifications
Push notifications may contain a preview of a message. If you would rather they did not, turn previews off in Settings → Notifications in the app, or hide them in your device settings.
On iOS, push notifications go through Apple's APNs directly — there is no Firebase in the iOS app, and no third party between the notification and your phone.
8. Cookies and similar technology
The website uses:
- Strictly necessary cookies that keep you signed in. They are httpOnly, so no script can read them, and they are required for the site to work at all.
- Preference storage remembering your interface language and theme.
- Security cookies: Cloudflare Turnstile, which checks that a sign-in request comes from a person rather than a bot, and Stripe's fraud-prevention cookies on the payment page.
- Analytics cookies set by Yandex Metrica and by Google Analytics (loaded through Google Tag Manager), which tell us how many people visit, which pages they use, and where the site breaks or confuses people.
We do not use advertising cookies. Analytics cookies are not needed for the site to work: you can refuse or delete them as described in the Cookie Policy, which lists every cookie, its purpose and its lifetime.
The mobile app uses no cookies for tracking and contains no analytics SDK. It stores the session in the system keychain and cookie store on your device, and a few preferences (theme, language, chosen tab) in the app's own storage. Everything it stores stays on your device.
9. Your rights
Subject to the conditions and exceptions set by the law that applies to you, you can:
- Be informed and get access — know what we hold about you, why, where it came from and who receives it, and get a copy;
- Correct it — most of it is editable in the app;
- Delete your account and data: Settings → Account → Delete account;
- Restrict processing — ask us to pause using your data while an accuracy question or an objection is being resolved;
- Object to processing based on legitimate interests, to direct marketing, and to decisions based solely on automated processing, including profiling;
- Take it with you — ask us for an export in a structured, machine-readable format, or for it to be sent to another controller where technically possible;
- Withdraw consent at any time — for notifications and device permissions in your device settings, for analytics cookies as described in the Cookie Policy, and otherwise by writing to us.
To exercise any of these rights, write to [email protected] from the email address on your account. We may ask you to confirm your identity before acting. Requests are free of charge, unless they are clearly unfounded or excessive. We answer within 30 days; if a request is complex we may extend this where the law allows, and we will tell you why.
If you are unhappy with our answer, you may complain to the data protection authority: in the UAE, the UAE Data Office; in the EEA or the UK, your national data protection authority.
10. Children
EduSpace is not for children under 13, and we do not knowingly collect data from them. In countries where the minimum age for consent without a parent is higher (16 in much of the EEA and in the UK), that higher age applies unless a parent or guardian has agreed. Where the law requires the consent of a parent or guardian to process a child's data, we rely on that consent, and the parent or guardian may exercise the child's rights on their behalf.
If you are a parent and believe your child has an account they should not have, write to [email protected] — we will delete the account and the data.
11. Security
We use technical and organisational measures appropriate to the risk to protect your data. Traffic is encrypted with TLS. Sessions are held in httpOnly cookies with short access tokens and revocable refresh tokens. Passwords, when used, are stored hashed. Files are served from signed URLs. Access to production data is limited to the people who need it, and our service providers are bound by confidentiality and security obligations.
No system is perfectly safe. If a breach affects your personal data, we will notify the competent authority — in the UAE, the UAE Data Office — and, where the breach may harm your privacy or the security of your data, you, without undue delay and within the deadlines the law sets (72 hours for the authority under GDPR). We will tell you what happened, what data was involved, and what we are doing about it.
12. Changes to this policy
We may update this policy. Material changes are announced in the app or by email at least 14 days before they take effect, and the date at the top always shows the current version.
This policy is written in English and may be translated. If a translation differs from the English version, the English version prevails, unless the law that applies to you requires otherwise.
13. Contact
EDU SPACE - FZCO IBP-S06-81736, Dubai Silicon Oasis, Dubai, United Arab Emirates Privacy and data protection requests: [email protected] Support: [email protected]
Questions about this document?
Write to us and a real person will answer.