Privacy policy

What we collect

Name, phone number and, if you provide it, email. Tutors also add subjects and rates. Lesson schedules, payments and messages inside the platform.

Why

To run the schedule, charge and confirm payments, send lesson reminders and meet tax reporting requirements.

Who we share it with

Google (Calendar and Meet, if you connected an account), the payment provider when you pay, and the tax systems of Kazakhstan to the extent the law requires. We do not sell or share user data with advertisers or ad networks. The one exception: if you came to the site through our Google ad, we pass to Google only the technical click number and the time of registration.

Data from your Google account

If you sign in with Google, we receive your name, email address and Google account ID from Google and use them only to create your account and sign you in. If a tutor connects Google Calendar, we request one permission: to create and change events on calendars they own. Ustazym uses it only for lessons: it adds an event with a Google Meet link for every scheduled lesson, moves the event when the lesson is rescheduled and deletes it when the lesson is cancelled. We do not read, copy or store any other events from your calendar.

We store the calendar access key (encrypted, on our server in Kazakhstan) and, for each lesson, the calendar event ID and the Meet link. The Meet link is shown to the student and the parent of that lesson. We do not share or sell data received from Google, and we do not use it for advertising or to train artificial intelligence models. Our staff do not read it, except when you ask us for help, when it is needed for security, or when the law requires it.

You can disconnect the calendar at any time in Profile: we delete the stored key and revoke access at Google. You can also revoke access in your Google account settings: myaccount.google.com/permissions. Events that were already created stay in your calendar; you can delete them in Google Calendar itself. When a Ustazym account is deleted, the access key is deleted and revoked automatically.

Ustazym's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

How we protect your data

All connections to ustazym.kz are encrypted with HTTPS (TLS), and browsers are instructed never to open the site without encryption (HSTS). Our server talks to Google APIs over encrypted connections only.

The database with your account and lesson data is on our own server in Kazakhstan. It is not reachable from the internet: only the Ustazym application connects to it over an internal network. Files attached to lessons are kept in a private file storage and are given only to the participants of that lesson, after an access check on every download.

The most sensitive data is additionally encrypted inside the database with AES-256-GCM: Google Calendar access keys (access and refresh tokens) and, for tutor payouts, the IIN and the bank account number. The encryption key is kept separately from the database, so a copy of the database alone does not reveal these values. One-time sign-in codes are never stored: we keep only a keyed hash (HMAC) of each code, and the code expires within minutes.

Sessions use signed tokens in secure cookies that page scripts cannot read (httpOnly). Sign-in attempts and code requests are rate-limited, and the forms are protected from bots by Cloudflare Turnstile. Only the platform administrator has access to the server and the database, and uses it only to operate and protect the service. If a security incident affects your data, we will inform the affected users without undue delay and act as required by the law of Kazakhstan.

Our own visit statistics

We count visits to the public pages of the site ourselves, without any external services. The database on our server in Kazakhstan holds daily counters only: the date, the page, the referring domain and link tags, the device type and the page language. In the same way, as daily totals not linked to you, we count clicks on the main buttons of the home page and how far it is scrolled. The same way we count which sign-in method is chosen on the sign-up screen, how often the demo cabinet is opened and how often its create-your-cabinet button is pressed, with one mark: whether the visitor came from our Google ad. Your IP address, browser details and the full page address are not stored. To tell new visitors from returning ones, the browser is given a random number in a cookie for 90 days. It is not linked to your account and cannot identify you.

If you came to the site from a Google ad, we store the technical click number and pass to Google only that number and the time of registration, to measure how well the ads work. Your name, email and phone number are not passed on.

The demo cabinet runs entirely in your browser: the made-up data and your changes stay on this device and are never sent to our server. We only count how many times the demo is opened, and the browser gets a cookie that says "opened the demo" and nothing else; if you register later, your account keeps only the date of that mark.

Your rights

You can request a copy of your data or its deletion. We reply within 30 days.

Account deletion

You can request deletion in the «Ways to sign in» section. Within 30 days the deletion can be cancelled by signing in. After that personal data is anonymised; for a year the account can be restored by signing in with a saved method. The link between the account and the person is kept for 5 years in a closed archive used solely to answer official requests in the manner established by law, after which it is deleted permanently. The anonymised lesson history stays with the people you worked with. See the terms of use for details.

Contact

For questions about your data write to hello@ustazym.kz.