Security and data
In short: we teach people not to give AI personal data, store data in the EU and publish the list of everyone who processes it.
Where data is stored
EU and other countries
Infrastructure in the EU (the exact region will be set once the provider is chosen).
What goes to AI
Only assignment texts go to the AI coach. We teach anonymisation, and a filter in the app blocks phone numbers and e-mails. We check providers’ contract terms on whether customer data may be used to train their models.
What managers see
Team statuses, progress and metrics. Managers don’t see the text of employees’ practice.
Laws and documents
We work under the GDPR, Belarus Law No. 99-Z and Kazakhstan’s personal data law. Compliance confirmations and a DPA template are published after legal review.
Who processes data (subprocessors)
Candidate list as of 2026-11-13: provider contracts are not signed yet; the final list will be approved by the owner.
| Company | Purpose | Location | Contour |
|---|---|---|---|
| Cloudflare, Inc. | hosting (Workers), CDN, DNS, bot protection, object storage (R2/KV) | global network; US company | global |
| Postgres hosting (EU) [decision pending] | primary database (Global contour) | EU — Frankfurt or Warsaw [decision pending] | global |
| RU hosting: Yandex Cloud or Selectel [decision pending] | RU contour: database, storage, backups, logs (152-FZ localisation) | Russia | ru |
| Anthropic PBC (Claude) | AI tutor answers and task review — users outside Russia and Belarus, only with ai_processing consent; text after PII filter | US | global |
| Yandex (Yandex AI Studio) [verify legal entity] | AI tutor answers and task review — users in Russia and Belarus, only with ai_processing consent; text after PII filter | Russia [verify inference and logging location in writing] | both |
| Cloud.ru [verify legal entity] | reserve AI provider for users in Russia and Belarus, only with ai_processing consent; text after PII filter | Russia | both |
| Alibaba Cloud (Qwen) [verify legal entity] | reserve AI provider for users in Russia and Belarus, only with ai_processing consent; no identifying data (for Russia — after Roskomnadzor notification) | Singapore | both |
| SMS provider [decision pending] | login codes and invitations by SMS | [decision pending] | both |
| E-mail provider [decision pending] | login codes, invitations, service e-mails | [decision pending] | both |
| Apple Inc. (App Store, APNs) | in-app purchases and refunds (independent controller), push notifications | US | both |
| Google LLC / Google Ireland Ltd (Google Play, FCM) | in-app purchases and refunds (independent controller), push notifications | US / EU | both |
| RuStore (VK) [verify legal entity] | in-app purchases in Russia (independent controller) — after the Russia launch | Russia | ru |
| RevenueCat, Inc. | store subscription receipts (only if connected; the app currently uses store APIs directly) | US | global |
| Google Analytics 4 | website analytics, only with cookie consent; not used on the Russian mirror | US / EU | global |
| Yandex Metrica | website analytics, only with cookie consent | Russia | both |