Privacy notice

Last updated 2 November 2026

Who runs EdTechCore

EdTechCore is an independent, non-commercial project. It is not run by a registered company: it is built and paid for privately while it is being tested, and it charges nothing for access. If that ever changes and the project becomes a commercial service, a company will be formed, this notice will name it with its registration details, and it will say so before anything is charged. Until then the data controller under the GDPR is Denys Hrynko, the private individual who operates EdTechCore, and requests about personal data go to admin@edtechcore.com.

What this notice covers

The public site and the workspaces you sign in to. What is stored on your own device has a page of its own, the cookie policy, and the two are meant to be read together.

What is collected, and why

Only what the service needs in order to work, and nothing kept in case it might be useful later:

• Your account: the name you give, your email address, the language you choose, the school or workspace you belong to and your role in it. Without these there is no way to sign you in or to show you the right workspace.
• The work itself: courses, lessons, tasks, the answers a student submits, the marks a teacher gives, messages and the files anyone uploads. This is the product - it is kept because the people using it need it kept.
• Where a school bills its own students through EdTechCore: invoices, payments and the ledger entries behind them. Card details are entered on the payment provider's own page and never reach us.
• If you send the request form on this site: your name if you give it, your email address, whether you teach on your own or run a school, the page the form was sent from (its address without anything after a question mark), your answer to how you heard about us if you give one, whether this browser holds a conversation of the site's chat (a yes or no), when you agreed, and when the link we send you was first opened. They are used to answer that request, and the page, the answer and the chat's yes or no also to see, in totals, which pages and channels bring requests (our legitimate interest; the question is optional), and for nothing else: a letter with the link to your workspace and, if that link has not been opened about a day later, one reminder with the same link. Nothing more is sent about the request.
• If the request opens a workspace for you, then while it is new the service writes to you about it at most six times, each letter once and only while it still applies: an hour in, if no lesson has been taught on the course it was given; on the second day, if no student has joined; on the fourth day, if no lesson has had a student in it, with an offer to show you how it works; on the eighth day, if you have not made a lesson of your own; on the fifteenth day, if there has still been no lesson with a student, a short question from a person on the team about what is in the way; and a few days before the trial ends. Every one of these letters has a “No more of these letters” link that stops the rest at once, without signing in. The service keeps a note of which of these letters went to you and whether you stopped them, so that none goes twice; the note is deleted with your account. These are letters about your own workspace, not advertising.
• If you write in the chat on this site: your messages and the answers to them, the page and the language you wrote from, and when. The answers are written by an AI assistant from the site's own text. For each answer the conversation is received by Anthropic, PBC (USA), the model's provider; the transfer outside the EEA rests on the European Commission's standard contractual clauses. Every conversation is also copied to the team's Telegram, so that a person reads it and can answer; Telegram also processes data outside the EEA. If you leave an email address to get the answer by email, it is used for that answer only and is deleted with the conversation. Nothing else about you is collected: the chat asks for no name, and for an email address only when you choose to get the answer by email. Your browser keeps the key that opens the conversation and sends it with each message, so the service can find the conversation; the service keeps only a fingerprint of the key. A conversation is deleted from the service 30 days after its last message, or at once when you press Delete conversation; copies in Telegram younger than 48 hours go with it, and older ones the team deletes on request at admin@edtechcore.com.
• If you use Help inside the teachers' or the schools' panels: your questions and the answers to them, the screen you asked from, your role (a teacher, or a school's staff), your organization and your account's email address, and when. Before a question is kept, every phone number, card number and IBAN in it, and anything written after a word that says a password follows, is struck out; an email address you write in it stays, so that the team can write back to you. The answers are written by an AI assistant from the guide and the panels' menus; for each answer the conversation - without your name, any email address or your organization - is received by Anthropic, PBC (USA), the model's provider, on the European Commission's standard contractual clauses. Every conversation is also copied to the team's Telegram, marked with your role, your organization's short name and your account's email address, so that a person reads it and can answer you there or by email; Telegram also processes data outside the EEA. Help is never offered to students or parents. If an account misuses Help - trying to get other people's data or access, or to deceive the team - the team can block it: Help is then not offered to that account for up to 30 days, and the record of the block is kept as long. A conversation is deleted 30 days after its last message, at once when you press Delete conversation, or with your account; its copies in the team's Telegram are deleted by the team, and those younger than 48 hours go at once with Delete conversation.
• If you apply to become a partner: your name, your email address, what you write about who you would bring, the language you applied in and when you agreed. They are kept so the application can be answered. If you become a partner, the workspaces you brought and the bonuses owed to you are kept as the record of what the platform owes you; the bank details a transfer needs are sent by email and are not stored in the service.
• Technical records: the time you sign in and the last time you did, IP addresses, server logs, and a trail of who did what inside a workspace - who created an account, who changed a role, who posted a payment - kept so the service can be run, abuse investigated, and the money and the marks explained.

The legal bases are the agreement under which the service is provided to you or to your school, our legitimate interest in keeping it running and secure for the technical records, and a legal obligation where accounting rules require a record to be kept.

Consent, and where you give it

These forms ask for it in as many words: the request form on the site's pages, the partner application on the partner site, and the form that creates an account from an invitation. The box is never ticked for you and the form does not send without it, and what you agree to is written beside it - that what you type is processed for that purpose and no other. The server refuses a request without it too, and records the moment you agreed with the request, the application or the account, so that the agreement can be shown if it is ever questioned. Consent is not the basis for everything here: your account and the work inside it are processed to provide the service, as set out above. A consent you gave can be withdrawn at any time, and withdrawing it does not make unlawful what was done while it stood.

Nothing until you agree

Until you agree to something, nothing about you is collected beyond the technical records every visit to a website leaves, described above, and nothing you do here sends your data anywhere. The site's forms do not send without their consent box ticked; nothing on this site measures your visit until you allow it; nothing is stored on your device except what you choose; and a workspace cannot be entered at all without an account, which is itself created only with your consent.

What teachers and schools put here

Most of what lives in EdTechCore is put there by teachers and schools, not by us. A school decides who has an account, what its courses contain and what it records about its students; for that material the school is the controller and EdTechCore processes it on the school's instructions. If you are a student, a question about your own record is usually answered fastest by your school or your teacher - write to us anyway if you prefer, and we will pass it to the right place and tell you that we have.

Advertising, analytics and tracking

The panels you sign in to carry no advertising and no analytics, and nobody who uses them is profiled. The public site can measure its own advertising with Google Ads and Google Analytics, services of Google Ireland Limited, to see which of our ads and pages bring people to EdTechCore. EdTechCore switches that measurement on and off, and the site shows which state is in force. While it is off, the cookie notice only informs, there is no Cookie settings button at the bottom of the page, and the site loads nothing from Google and stores nothing on your device for these purposes. While it is on, the notice asks first, and until you allow it nothing is loaded from Google or stored for these purposes; refusing costs you nothing on the site.

If you allow it, Google's tag sets cookies on this site and receives the pages you open, the page you came from, your IP address, information about your device and browser, and the ad you clicked, if any. It also learns which of the site's buttons you press - Try it free, Telegram, the phone number - that you start filling in the request form, with whether you teach on your own or run a school, and that you start a conversation in the chat; never what you type or write. When you send the request form, Google is told that a request was sent, with its reference number and whether you teach on your own or run a school; neither your name nor your email address goes to Google. We keep the click identifier (gclid, gbraid, wbraid) and the campaign tags (utm) with your request, together with a record of your allowance: when it reached us and which version of the question you answered. That is how we know which ad brought the request; all of it is deleted with the request, 90 days after it was sent. Google may also use what it receives to show you our ads on other sites, and for that it acts under its own privacy policy (how Google uses information from sites that use its services: policies.google.com/technologies/partner-sites). The same allowance can be given with the optional box in the request form: it is the same answer, recorded the same way and withdrawn the same way, under Cookie settings. The legal basis is your consent (Article 6(1)(a) GDPR and Article 11 of the Law of Ukraine "On Personal Data Protection"). You can withdraw it at any time under Cookie settings at the bottom of every page: the tag goes quiet at once in every open tab, our cookies and Google's on this site are deleted, and so is the click kept with a request sent from this browser. From another device, or once this browser's data has been cleared, write to admin@edtechcore.com and we delete it. Cookies Google keeps on its own domains are not ours to delete: they are managed in Google's ad settings (myadcenter.google.com). The level test never loads the tag.

If you allowed it and then create an account from the link we email you, we tell Google Ads that the ad click ended in a registration, so that we see which of our ads bring people who start working in EdTechCore, not only people who send a request. Once a day Google collects from our server the list of such registrations. For yours it holds the click identifier, the time the account was created, whether you teach on your own or run a school, the number of your workspace, and that you allowed this; your name, your email address and anything else in your account are never in it. The basis is the same consent. Once you withdraw it, the click is deleted and later lists no longer carry it; what Google received before stays with Google under its own policy.

What we do not do with it

EdTechCore processes personal data to provide the service to you and to your school, and for nothing of its own beyond the measurement of its own ads that the section above describes, which runs only where you allow it. It does not sell it, rent it or hand it to anyone for their own purposes, other than what Google receives under that allowance, from its tag and from us; it does not use it for advertising or profiling beyond that measurement; it does not train models on it; and nobody reads the work in a workspace except to run the service, to answer a request you make, or to act on a report. AI help sees only what its job needs. When a teacher drafts material with it, that is the material the teacher hands it. When a teacher sets a task answered in the student's own words to be checked by AI, and the platform has that check switched on, it is the student's answer to that task, from which the AI drafts a score and a line of feedback that wait for the teacher. The request runs on a key the teacher has lent from their own account with the provider, or otherwise on the provider the service is configured with.

Who else is involved

A few other companies are needed to run the service. Some of them are based outside the European Union, mainly in the United States; data reaches them under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. Each one sees only what its job requires:

• The servers are rented inside the European Union, and the data centre operating them can technically reach the machines.
• Cloudflare delivers and protects the panels you sign in to, the API behind them and the www. address, which only forwards to this site, so it sees every request made to them, including the IP address it came from. The public site itself, at edtechcore.com, does not pass through Cloudflare: it is served directly from the service's own server.
• YouTube, a Google service, plays a lesson video a teacher has embedded, under Google's own policy.
• Google runs its advertising and statistics tags on the public site while EdTechCore has that measurement switched on, and only for a visitor who allows them, and it receives from us the registrations its ads led to, for those visitors alone, as described above.
• An AI provider receives what AI help is given, as described above, whenever that help is in use, and the conversations in the site's chat while the assistant answers them.
• Telegram, a messaging service, carries a copy of every conversation in the site's chat and in Help inside the panels to the team and the team's answers back to it, under Telegram's own policy.
• A teacher's public page shows a portrait, and that picture is hosted wherever its owner chose to put it. Opening such a page asks that host for the picture, which tells it your IP address and your browser - the same as any picture on any website. It is not chosen by us and it is not a company we have an agreement with; it is named here because, apart from Google's tags where you allow them, it is the one thing on this site that reaches outside it.
• A payment provider runs the payment page and handles card details on its own systems.
• Your browser's own push service delivers notifications, if you have turned them on.

How long it is kept

Account and course data stays while the account and the workspace exist. When you ask to be forgotten, the account is deleted outright if nothing else refers to it; where a record must be kept by law - an invoice, a payment, a mark - the record stays, and everything in the account that identifies you is removed, so the record explains itself without naming you (Article 17(3)(b) GDPR). A request from the site's form is deleted 90 days after it was sent, with the ad click kept beside it, and a partner application and an invitation that expired or was withdrawn are deleted after the same 90 days. A conversation in the site's chat or in Help is deleted 30 days after its last message; its copies in the team's Telegram are deleted by the team. A school's waiting list asks about an entry left untouched for 180 days, removes it after 365 days, and deletes an entry 30 days after it was closed - at once when the family asks. A file attached to a message or handed in outside a marked answer is deleted after a set period; a marked answer keeps its file as the record of the work. The trail of who did what is kept for at least twelve months and then pruned. Accounting records are kept for as long as the law requires. Server and access logs are kept for a short period and then discarded. Backups are rotated, so something deleted from the live service can survive briefly in a backup before it goes with it.

Keeping it safe, and the limits of that

Traffic is encrypted in transit, passwords are stored only as hashes, the most sensitive fields are encrypted at rest, every account reaches only what its role opens, sensitive actions in the console need a second sign-in, and backups are taken regularly. None of that is a guarantee. Hardware fails, software has defects and a determined attacker sometimes succeeds; no service can honestly promise that data will never be lost or never reached by someone who should not have it, and to the maximum extent permitted by applicable law EdTechCore gives no such warranty. Keep your own copy of anything you cannot afford to lose. What the law does require of us we do: if a breach happens that puts people at risk, we will say so - to those affected and to the supervisory authority - within the time the GDPR sets, and your right to compensation for damage caused by processing in breach of the GDPR (Article 82) is not affected by anything on this page. If, despite these measures, someone reaches data unlawfully, through an attack, a defect or a failure at a provider, the unlawful act is theirs. Ours is to have taken appropriate measures and to act as the law requires: to contain it, to tell you and the authority, and to help bring it to account.

Your rights

You can ask what personal data is held about you, have it corrected or erased, restrict or object to how it is used, receive a copy in a portable form, and withdraw any consent you gave. Write to admin@edtechcore.com and we answer within one month. Erasure works as the section on retention describes: the account goes, and a record the law requires us to keep stays without your name on it. If the data belongs to a school's workspace we may have to pass the request to the school, and we will tell you when we do. You also have the right to complain to a data protection authority.

Children

Schools and teachers use EdTechCore to teach people of any age, children included. A child's account is created by their school or their teacher, and it is the school that must have the standing to do so under the rules that apply to it. We do not seek children out. The panels carry no advertising and no profiling for anyone; any ads EdTechCore runs are addressed to teachers and schools, and their measurement on the public site runs only with the visitor's consent.

Automated decisions

None that affect anyone legally. Marking is deterministic: the same answer scores the same way every time. AI never decides a mark. It helps a teacher draft material, and where a task answered in the student's own words is checked by AI, it drafts a score that counts for nothing until the teacher confirms or changes it.

Changes to this notice

The service changes as it is built. If a new feature needs personal data this notice does not describe, the notice is updated before the feature starts and the date at the top moves; anything that needs your agreement is asked for separately and never assumed. If you do not accept a change, you can stop using the service and ask for your data to be deleted, and refusing an optional feature never costs you access to the rest.

The limits of this page

This is a plain description of how the service works, written to be understood rather than to sound impressive. It is not legal advice and it takes away no right the law gives you. The companies named above run their own services under their own terms.

Read the terms of use Read the cookie policy Back to the home page