Privacy policy

1. Who we are

EDUFY (biruni.pro) is run by Maxel Digital Solutions, Sweden. Maxel Digital Solutions is the data controller for the personal data described here, under the EU General Data Protection Regulation (GDPR).

Questions about privacy: maximilianbahrami@gmail.com.

2. What we collect

When you create an account

• Your name, email address and whether you're a student or a tutor.
• Your password, stored only as a one-way hash we can't read.
• Things you choose to add: profile photo, gender, phone number, website, street address, city and country.

If you sign in with Google, Microsoft or a passkey

• Google or Microsoft shares your name, email address and an account ID. We never get your Google or Microsoft password.
• A passkey stays on your device. We store only its public key, a name you can change, and when you added it. Your fingerprint or face never leaves your device.
• Email sign-in codes are stored only as a one-way hash and stop working after 10 minutes.

If you teach on EDUFY

• Your public tutor profile: introduction, subjects, prices, education, photos and videos, availability, books you recommend, ratings and reviews.
• Your lesson plans, private notes about your students and your worksheet library. Only you see them.

When you use EDUFY

• Lessons you book or teach: times, prices, status, packages and free trials.
• Payments: amount, status and Stripe's reference. Stripe handles the card itself.
• Messages between students and tutors, and reviews you write.
• In the lesson room: the chat, shared files, notes, whiteboard, worksheets and code, quick questions and answers, the tutor's lesson summary and homework (and which tasks you've ticked off), and whether the lesson was held.
• Corrections your tutor marks in a lesson or in chat (what you said, the right way, the kind of mistake and a hint), and whether you added them to your practice. Your tutor sees how you did on them only while you allow it, and your weak spots and forgotten cards only if you turn that on (Daily review → Settings). You can switch both off at any time. They're deleted with your account.
• What you write in Languages → Writing (journal entries and writing tasks), which you send to one of your tutors to correct: only that tutor sees it. Their changes, your own tries at fixing them and what you put in your mistake notebook are kept with it. An AI first pass runs only if you tick it when you send a piece; then the text goes to our AI provider without your name, and your tutor checks every suggestion before you see it. A draft can be removed at any time, and everything is deleted with your account.
• Your grammar path in Languages → Grammar: which topics you are learning or know, your order, how your exercises went and which of your notes you linked to a topic. If you are a tutor, the checks and first-language comparisons you write for the grammar maps are kept with your name and shown to learners. All of it is deleted with your account.
• If you're a student and choose to write one: your note "About me for my tutors" (for example your level, goals and how you like to learn), and when you last changed it.
• Tutors you save, free-time alerts you set, your reading list on Books, and notes, library items, quiz and game progress in the Student Hub.
• If you ask for the free EDUFY guide by email (without an account): your email address, the language and page you asked on, and when you confirmed, got the emails or unsubscribed. We email you only after you click the link in the confirmation email.
• If you write to us from the contact page: your name, email, whether you are a student, parent, tutor or organisation, the topic, any receipt or booking number you add, your message, and our answers.
• If our support team helps you, they may keep short notes on your account, for example what was agreed about a refund. You get them when you download your data.

Technical data

• Your IP address. We use it to stop abuse (for example, too many sign-in attempts), to suggest your language and time zone, and in short-lived server logs. Your language is guessed from your IP address with a country list stored on our own server, so your IP address isn't sent anywhere for that.
• Your browser type and the pages you open, in server logs used to fix errors.
• Our own visitor statistics: each page you open on EDUFY (its address, without anything after "?"), when, the site or link you came from, your country (from your IP address, looked up on our own server), whether you use a phone, tablet or computer, your browser and system, and the page's language. We don't keep your IP address and use no cookies for this. If you aren't signed in, your visit gets a code that changes every day, so we can see the pages of one visit but can't recognise you on another day. If you are signed in, the pages you open are linked to your account.
• A log of the emails we send you: the address, the subject, when, and whether our mail server accepted it. Not the email itself. It helps us answer “I never got it”.
• A short history of your sign-ins: when, how (for example password or passkey), the browser and system ("Chrome on macOS") and the country. We don't keep the IP address with it. You can see it in Privacy & Account, and we email you when a new browser or country signs in to your account.

3. Why we use it (and our legal basis)

We don't use your data for advertising, and we don't make automated decisions with legal or similarly significant effects about you. When EDUFY suggests tutors that match your goals, that's only a ranking. You can always browse every tutor.

4. Who we share it with

Other EDUFY users see only what's needed. Students see tutors' public profiles. A tutor sees the name, photo and lesson details of the students who book them, plus the messages you send each other. If you wrote "About me for my tutors", a tutor sees it once you have booked a paid lesson with them or written to them. It's never shown in public.

People who work for EDUFY (our support helpers) see what they need to help you, such as your account, lessons and what you wrote to support, and the pages you opened on EDUFY while signed in. To plan which subjects and tutors EDUFY needs, they also read students' "About me for my tutors" notes together on a page that doesn't show who wrote them. Each signs in with two-step sign-in, and what they do is logged.

Service providers who process data for us under data processing agreements:

We share data with authorities only when the law requires it. We never sell your personal data.

5. Transfers outside the EU

Some providers above may process data in the USA or other countries outside the EU. When they do, the transfer is protected by the EU–US Data Privacy Framework or by the European Commission's Standard Contractual Clauses.

6. How long we keep it

• Your account and profile: as long as you have an account. When you delete it in Privacy & Account (students) or Account & security (tutors), it's deleted straight away. A tutor's account can be deleted once their upcoming lessons, students' unused package lessons and last payouts are settled. If you ask us by email instead, we delete it within 30 days.
• Payment and booking records: 7 years, as Swedish accounting law requires, even after your account is deleted.
• Messages and reviews: until you delete your account. Then the messages you sent and your reviews are deleted. Messages others sent you stay with them.
• Questions to support and our answers: until you delete your account; if you wrote without an account, 2 years after the last message. Support notes: until your account is deleted. Email log: 90 days.
• Sign-in codes: 10 minutes. Password reset links: 1 hour. Sign-in history: 90 days. Lesson rooms (whiteboard and worksheets, chat, shared files, notes and code): 90 days. Lesson summaries and homework: until the student's account is deleted. A tutor's lesson plans, notes about students and worksheet library: until the tutor removes them or either account is deleted. Server logs: up to 30 days. Visitor statistics (pages opened): 90 days. The guide by email: until you unsubscribe; requests you never confirmed, and addresses that unsubscribed, are deleted after 30 days. Anonymous counts on Books: 13 months.
• AI help: we keep a record of each AI request (which tool, which model, the cost, and whether it worked), not the text. Answers that are the same for everyone, such as a translation or a word's meanings, are kept for up to 90 days without saying who asked. When you delete your account, your AI records are no longer linked to you and your "This is wrong" reports are deleted. Both are in your data download.
• Edufy AI: what you ask is matched on our own server, and isn't saved or sent to anyone. Only if you tap to send it ("Not what I meant") is your question saved, without your name, for 90 days so we can improve the answers. Don't include private details there. Only if you tap "Ask AI to find the page" does your question go to Anthropic's Claude, like other AI help.

7. Cookies and storage in your browser

EDUFY uses only cookies that are needed for the site to work, so we don't ask for cookie consent:

• Sign-in cookie: keeps you signed in.
• Security cookie: protects forms against cross-site attacks.
• Language and design: remembers the language you picked and whether you chose the classic home page.
• Sign-in with Google or Microsoft: a short-lived cookie while you sign in.

The Student Hub also saves some preferences in your browser's own storage (for example your theme). You can clear it from your browser at any time. We use no analytics or advertising cookies: our visitor statistics work without cookies.

On Books, EDUFY counts page views, saves, clicks out to shops and resources, visits to tutors' profiles, lessons booked on a profile you reached from Books, and the words of a Books search that matched no EDUFY book, in its own database. To know a booking started on Books, the profile's address gets ?from=books; nothing is stored in your browser. This uses no cookies and stores nothing that points to you: no account, IP address or visitor ID. If your browser sends Global Privacy Control or Do Not Track, nothing is counted. The counts are deleted after 13 months.

8. Your rights

Under the GDPR you can:

• get a copy of your personal data, and receive it in a machine-readable format;
• have wrong data corrected (most of it you can change yourself in your profile);
• have your data deleted, and your account with it;
• restrict or object to how we use your data;
• withdraw consent at any time, for example by removing optional profile details.

You can do most of this yourself: in your profile, open Privacy & Account to download your data (PDF or JSON), change your email, choose which emails you get, or delete your account. For anything else, email maximilianbahrami@gmail.com from the address on your account. We answer within one month.

If you're unhappy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se, or to the data protection authority where you live.

9. Children

Children under 13 may use EDUFY only through an account created and managed by a parent or guardian. If you believe a child under 13 has given us personal data without a parent's consent, contact us and we'll delete it.

AI help and age. A member younger than the age of digital consent in their country (for example 13 in Sweden, 15 in France, 16 in Luxembourg and Germany; 16 when no country is set on the account) can use AI help only after a parent or guardian says yes. The member gives their parent's email address, and the parent answers from a link in the email and can take the yes back from the same link at any time. We keep the parent's email address and the dates of their answer until the account is deleted. For every member under 18, the AI follows stricter rules so that its answers suit a child. The age comes from the birth date on the account. Students give their date of birth when they first use EDUFY; it stays private (tutors and other members never see it). Members under 18 also only get new conversations from people they know: tutors they booked or saved, people they already talked to and members of their groups.

10. Security

EDUFY is served only over HTTPS. Passwords are hashed, and admin accounts need a second step to sign in. Sign-in pages are protected against bots and repeated guessing, and access to our servers is limited to the people who run EDUFY. No system is perfectly secure, but if a breach puts your data at risk, we'll tell you and IMY as the law requires.

11. Changes to this policy

If we change this policy, we'll update the date at the top. For important changes, we'll tell you by email or on EDUFY before they take effect.