Privacy Policy

Effective date: 2 August 2026 | Version: v1.8

This Privacy Policy explains how the EduWorkAI platform (hereinafter "we", "the platform") collects, stores and uses users’ personal data. It is drawn up in accordance with the Law of the Republic of Uzbekistan "On Personal Data" (2 July 2019, No. ZRU-547).

1. Data we collect

1.1 Data you provide directly

Phone number — for registration and SMS-OTP authentication
Name — to display in your profile
Professional details — during onboarding (field, experience, goal)
CV and documents — optional upload for the job search feature
PDF files — study materials uploaded for the AI chat (answers are grounded in exactly that source)
Payment details — processed through payment providers; we do not store full card numbers
Feedback and complaints you write yourself — text sent through the "Send feedback" form or a comment at the end of a lesson/exam, the chosen type, the page, the lesson/exam and an optional "helpful / not helpful" rating. Before the text reaches our team, phone numbers, emails and similar data are masked automatically

1.2 Data collected automatically

Learning activity — lessons taken, exam results, progress
Platform usage — session time, pages visited, features used
Device information — browser type, operating system, screen size
IP address — for security and fraud protection
Error and diagnostic data — to improve platform quality
Ad source (UTM) — which ad campaign you came from (utm_source, utm_medium, utm_campaign, utm_content, utm_term and the ad click ID fbclid). It is kept in your browser for up to 30 days and, when you sign up, stored on our server with your account — only for our own reporting (which campaign led to a sign-up and a payment). This is first-party data and does not depend on your cookie consent

2. Purposes of data use

Providing services: courses, AI chat, exams, certificates, job search
Personalised learning recommendations and career guidance
Securing your account (SMS-OTP, session management)
Improving the platform and developing new features
Processing subscriptions and payments
Sending important service notifications
Measuring advertising effectiveness (which campaign led to a sign-up and a payment)
Meeting legal obligations

3. Third-party services

Our platform uses the following external services:

Service	Purpose	Data transferred
Eskiz.uz	Sending SMS-OTP	Phone number
OpenRouter	AI chat, course and exam generation, analysis (gateway to AI models)	Messages you write, documents you upload, your learning goal
OpenAI	Semantic indexing of text (search) and quality control of AI answers	Course and document text, AI answers
Anthropic (Claude API)	Backup AI provider (when the main one is unavailable)	Messages you write and documents you upload
Resend	Sending email (verification codes, notifications)	Email address, message text
Google Firebase	Push notifications	Device push token, notification text
Sentry	Tracking technical errors	Error details, browser/device type, user ID
Google Analytics (Google)	Usage statistics — ONLY with your cookie consent	Page visits, browser/device type, approximate location from IP. Name, phone and email are not sent
Meta Pixel (Meta Platforms — Instagram/Facebook)	Measuring advertising effectiveness — ONLY with your cookie consent	Events: page view, registration, trial start, payment amount; plus browser identifiers and IP (collected by the pixel itself). Name, phone and email are not sent
Telegram	Internal notifications for our team (technical errors, new feedback)	Error details, feedback text (phone numbers/emails/tokens masked), page, internal user ID
Paddle	Payment (subscription checkout)	Payment amount, transaction ID, email
Payme	Payment	Payment amount, transaction ID
Click	Payment	Payment amount, transaction ID

These providers have their own privacy policies. Your data is never sold to third parties. For advertising purposes only the events listed in the table above are sent, through Meta Pixel and with your cookie consent (without name, phone or email).

4. Data storage and security

All data is stored encrypted (TLS 1.2/1.3)
Passwords are protected with the Argon2id algorithm
Certificate keys are stored using Ed25519 asymmetric cryptography
Servers are located in Uzbekistan; we also serve global users and strive to follow the relevant international standards (including GDPR principles)
All API requests are authenticated (JWT, 15-minute TTL)
Every request is written to the audit log

5. Data retention periods

Active account: retained for as long as the account exists
Account deletion: personal data is deleted or anonymised within 30 days
Payment history: retained for 5 years under tax law
Certificates: retained and verifiable permanently through the cryptographic signature (Ed25519) — no blockchain is used
Audit logs: retained for 1 year for security purposes

6. Your rights

Under the legislation of the Republic of Uzbekistan you have the following rights:

Right of access: request the data we hold about you
Right to rectification: correct inaccurate data (on the Settings page)
Right to erasure: delete your account and your data
Right to portability: export your data in JSON format
Right to object: object to certain kinds of processing

To exercise these rights, write to privacy@eduworkai.com. We respond within 30 days.

7. Cookies and localStorage

The platform stores JWT tokens in the browser’s localStorage for session management. Google Analytics (statistics) and Meta Pixel (measuring advertising effectiveness) load only if you click "Accept" in the cookie banner, and they set their own cookies; if you decline, they do not load. Details: Cookie Policy. The ad source (UTM) is kept in localStorage as first-party data and linked to your account regardless of cookie consent (section 1.2).

8. Age information

We do not ask for separate age confirmation at registration — the platform is open to a general educational audience. Minors are advised to use the platform under the supervision of a parent or guardian, especially the job search and payment features. If the law of a particular region requires additional consent for a given age group, we introduce the corresponding process separately for users of that region.

9. Changes to this policy

If the policy changes, we will notify you by email (or SMS notification). Material changes are published at least 15 days before they take effect. Continuing to use the platform means you accept the new policy.

10. Contact

For privacy matters: privacy@eduworkai.com

You may also file a complaint with the Ministry for Development of Information Technologies and Communications of the Republic of Uzbekistan.

11. AI-generated content and how it is labelled

The educational content on the platform (courses, lessons, tests, flashcards, roadmap, AI chat answers, video and slides) is generated by the Teacher AI Agent and the Assessment AI Agent, adapted to your knowledge level, goal and learning pace.

All AI-generated content carries a visible mark ("EduWorkAI AI") and API responses include a machine-readable `aiGenerated` field. In video and slides the mark is drawn into the frame. This follows the transparency requirement of Article 50 of the EU AI Act.

Quality control: every generated course passes an automated QA gate — factual claims are checked against a verified knowledge corpus, and if coverage is below 95% the course is not published and goes to a human moderator queue. Even so, AI can be wrong: read the material critically and consult a professional for important decisions.

One moment…