Personal Data Processing Policy

This is an English translation provided for convenience. In case of any discrepancy, the Russian version of this document prevails and is the only legally binding one. Read the Russian version.

This personal data processing policy has been drawn up in accordance with the requirements of Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” and sets out the procedure for processing personal data and the measures taken by school-pi.online (hereinafter, the Operator) to ensure its security.

1. General provisions and information about the Operator

The Operator's most important goal is to respect human and civil rights and freedoms when processing personal data, including the protection of the right to privacy.

Personal data is processed using databases located in the Russian Federation, in accordance with Part 5 of Article 18 of Federal Law No. 152-FZ.

2. Personal data processed by the Operator

The Operator may process the following categories of personal data:

• Full name
• Email
• Phone number
• Password (in encrypted form)
• Gender, age, school grade
• Test results and data on completed lessons and courses
• History of interactions with the service (including learning materials and requests)
• Anonymized technical data: IP address, cookies, browser and device data, behavior on the site
• When buying a license key for the “SchoolPiBoard” program — the email address specified at payment and an anonymized identifier of the device on which the key is activated
• When starting the trial period of the “SchoolPiBoard” program — an email address and an anonymized device identifier. This information is needed only to prevent the trial period from being granted again
• When paying for a subscription to paid AI features — the amount and date of the payment, the selected plan and, if auto-renewal is enabled, the text of the consent to automatic charges and the date it was received

Files that the user creates in the “SchoolPiBoard” program are stored only on their own device: they are not transferred to or processed by the Operator. The purchase terms are set out in the license key offer. The terms of the AI features subscription, including auto-renewal and cancellation, are in the subscription offer.

3. Purposes of personal data processing

Data is processed for the purposes of:

• Providing access to the platform's functionality
• Tracking learning progress and personalizing content
• Feedback and user support
• Improving the quality of the services provided
• Providing license keys, keeping track of the number of devices and communicating with the buyer on matters of performing the license agreement
• Complying with legal requirements
• Protecting the rights and legitimate interests of users and the Operator, including handling complaints about correspondence and cases of dangerous content in it

4. Legal grounds for processing

The Operator processes personal data only with the user's consent, expressed by filling in forms on the site, and also in the course of performing the agreement on the use of the service.

The Operator keeps the correspondence of a user who has deleted their account in anonymised form until the end of the period specified in section 7, on the basis of clause 7 of part 1 of Article 6 and part 5 of Article 21 of Federal Law No. 152-FZ “On Personal Data”, in order to exercise the rights and legitimate interests of the other party to the correspondence and of the Operator (confirming lesson arrangements, handling complaints and cases of dangerous content). This does not infringe the user’s rights: the correspondence is not used for any other purpose and is deleted when the period expires.

5. Procedure for collecting, storing, transferring and otherwise processing data

• Personal data is stored in a protected database and used strictly for the stated purposes.
• Only authorized persons of the Operator have access to the data.
• Transfer to third parties is possible only when required by law or with the user's consent.

6. Cross-border data transfer

If data needs to be transferred outside the Russian Federation, the Operator guarantees an adequate level of its protection and obtains the user's consent.

7. Processing and storage periods

Personal data is processed until the purposes of processing are achieved or until consent is withdrawn. Specific periods:

• Account data (name, email, phone, gender, age, grade) — for as long as the account exists. When you delete your account in your personal area, all related data are deleted too: test results, notifications, requests. Correspondence with other users is kept under the rules of the next item.
• Learning data (test results, completed lessons and courses) — as long as the account exists; it is needed so that you and your tutor can see your progress.
• Chat correspondence — while lessons continue and for six months after they end, then deleted automatically. It is stored encrypted. When lessons have ended, the correspondence remains readable to both parties, but no new messages can be sent. If one of the parties deletes their account, the correspondence is not erased immediately: it is closed in the same way as when lessons end, the name of the person who deleted the account is replaced with “Deleted user”, and it is kept for six months from the deletion, after which it is deleted automatically. During this time only the other party to the correspondence can read it. Every new message is automatically checked for signs of dangerous content (threats, self-harm, extremism, exchanging contacts to bypass the platform, and the like) — without human involvement and without storing the text separately from the message itself. In addition, a participant in the correspondence can report it to a moderator. If the check is triggered or a complaint is filed, the Operator may read the correspondence of that specific dialogue, including a closed one or one kept after an account was deleted, to assess the situation and take action; in all other cases the correspondence is not viewed.
• Requests via the contact form — up to 1 year from the date of the request.
• Incomplete registration — if the email address is not confirmed via the link in the email within 24 hours (the link's validity period), the account is deleted automatically together with all the data entered. A tutor application sent back for revision and not corrected within 7 days is deleted automatically together with the account; a warning is sent 2 days before deletion.
• Support requests (the “Support” section in the personal area: subject, correspondence, attached images) — while the request is open and for 180 days after it is closed, then deleted automatically. A request is first answered by an AI consultant (see section 9) and then, if needed, by a moderator. Requests of a user who has deleted their account are kept in anonymised form until the end of the same period.
• Information about issued license keys (the buyer's email address, device identifiers, payment information) — for the duration of the license and thereafter within the periods established by tax legislation. The license is granted in perpetuity, so this information is kept while the key is valid.
• Cookies — the periods are listed in the table in Section 9.

When the purposes of processing are achieved or consent is withdrawn, the data is destroyed unless a different storage period is required by law.

8. Your rights and how to exercise them

In accordance with Articles 14–16 of Federal Law No. 152-FZ, you have the right to:

• obtain information about which of your data is processed, where it was obtained and to whom it is transferred;
• demand that the data be corrected if it is incomplete, outdated or inaccurate;
• demand that the data be blocked or destroyed if it is processed unlawfully;
• withdraw consent to processing;
• appeal against the Operator's actions to Roskomnadzor (the Russian data protection authority) or in court.

How to exercise them:

• View and change your data — the “Profile settings” section in your account.
• Delete your account with all data — the “Delete account” button in the same place. Deletion is confirmed with a code sent to your email; once the code is entered, deletion happens immediately and cannot be undone (correspondence with other users is kept for a limited period, see section 7). If a tutor has students assigned (or a student is assigned to a tutor), the lessons must be ended first — this protects the other party from lessons stopping abruptly. You can also have your data deleted by contacting the Operator (see below).
• Withdraw consent to cookies — the “Cookie settings” link at the bottom of any page.
• Submit a request — to the Operator's email address specified in Section 1. A reply is sent within 30 days. In the request, state your full name, the email address under which the account is registered and the substance of the request.

9. Third-party services and data transfer

To operate certain features, the site uses services of third-party organizations. Data is transferred to them only to the extent necessary for the relevant feature to work:

Personal data is not transferred to any other persons, except in cases expressly provided for by law (for example, at the request of authorized government bodies).

10. Users under 18

The platform is intended, among others, for schoolchildren. If a user is under 18, consent to the processing of their personal data is given by a parent or another legal representative. By registering an account for a minor, you confirm that you are their legal representative or are acting with their consent.

A legal representative may at any time request information about the child's data being processed and demand its correction or deletion by contacting the Operator at the address in Section 1.

11. Data protection measures

• The site works over the secure HTTPS protocol, and data is transmitted in encrypted form.
• Passwords are not stored in plain text — only an irreversible hash is saved.
• Chat messages are stored in encrypted form.
• Forms are protected against cross-site request forgery, and limits are set on password length and the size of uploaded files.
• Access to the database is restricted and granted only to authorized persons of the Operator.
• Session cookies are transmitted with the HttpOnly, Secure and SameSite attributes.

12. Cookies

Some cookies are strictly necessary — without them, logging in to your account and form protection don't work. Yandex Metrica cookies are also always used, without separate consent: the traffic statistics they collect are anonymized and needed for the operation and development of the site, so they are considered necessary technical statistics rather than marketing analytics. The banner shown on your first visit concerns only this: you confirm that you have seen this explanation, rather than turning statistics collection on or off — it works regardless of your choice in the banner.

Some pages contain embedded services of third-party organizations that may set their own cookies: the video conferencing service on the conference page and the visual editor in the news management section. These services are loaded only on the pages where they are needed for the relevant feature to work.

You can change or withdraw consent at any time using the “Cookie settings” link at the bottom of any page. Withdrawing consent does not affect your ability to use the site, except for features that require logging in.

13. Final provisions

For questions about the processing of personal data, contact the Operator using the details in Section 1.

Version of 7 October 2026.

The policy is valid indefinitely and may be updated. The current version is available at: https://school-pi.online/privacy