This policy explains what personal data Zehnhoi Gunogun (“we”) collects, why, and how we protect it. Data controller: [legal name of the sole proprietor or organization, TIN, address and email].
What data we collect
- Contact requests: name, phone or Telegram, email (optional), the child's age (optional) and the text of your message.
- Account: email, name, client type, organization and phone (optional). Passwords are stored only as a hash — we never see your password.
- Child profile: a name or nickname, year of birth and optional notes. We do not collect full dates of birth, school names, photos or medical information.
- Test results: answers and scores — only when you save them to your account.
- Reports: files the consultant uploads for you.
- Bookings and payments: service, date, status, amount and payment reference. Card details never reach us: online payment takes place on the bank's page.
- Subscription: plan, period, number of children, amount and payment status.
- Weekly program: your marks for completed activities and your notes (encrypted).
- Written consultations: questions and answers (encrypted). Their text is never sent by email.
- Full test: answers from parents, the child and the teacher. A teacher answers through a single-use link without an account; we do not keep the teacher's name or contact details.
- Newsletter: your email (encrypted) and language — only after you confirm the subscription. You can unsubscribe with one click, and the address is then deleted completely.
- Technical data: for security, IP addresses are stored only as a cryptographic hash. After failed sign-in attempts, the IP address and the email entered are kept for up to 90 days to protect accounts.
How we use it
- to respond to requests and arrange meetings;
- to provide our services: assessments, reports and consultations;
- to send necessary messages: email, booking and subscription confirmations, reminders and the weekly program (you can turn it off under “Settings”);
- to send the newsletter — only to people who have subscribed to it separately and confirmed the subscription;
- to protect the site and accounts from unauthorized access.
How we protect it
- All connections are encrypted with HTTPS.
- Personal data (names, contact details, messages, children's data, results and reports) is encrypted in the database and on disk.
- Passwords are hashed with the Argon2 algorithm.
- Sign-in attempts are limited. Two-factor authentication is available to everyone and mandatory for staff.
- Backups are encrypted.
- Staff can access only the data they need for their work, and important actions are logged.
Cookies
The site uses only essential cookies: a session cookie (for signing in), a CSRF-protection cookie and a language cookie. We do not use analytics, advertising or third-party tracking.
Who we share it with
We do not sell data. Data reaches only the following service providers, and only to the extent necessary: server hosting, an email service for sending messages, and the bank or payment system (amount and order reference only). Notifications to the site owner in Telegram are sent without clients' personal data. We do not share data with a school, an employer or anyone else without your written consent, except where the law requires it.
How long we keep it
- Contact requests are kept for up to 24 months and then deleted automatically.
- Your account, profiles, results and reports are kept until you delete your account.
- Accounts whose email has not been confirmed are deleted after 7 days.
- Newsletter addresses that were never confirmed are deleted after 7 days.
- Bookings and payments are kept for the period required by accounting law, unlinked from a deleted account.
- Security logs are kept for up to 12 months.
Your rights
You can view and correct your data (under “Settings”), download all your data in a single file, delete your account with all its data, and withdraw your consent. For questions about personal data, write to us: [email].
Children
Our services are intended for parents and organizations. A child's data is entered only by a parent or legal guardian.
Changes
If this policy changes, we will publish the new version on this page and notify account holders of significant changes.
Version 1.0, updated 14.10.2026.