Privacy Policy
Effective Date: September 18, 2026 • Last Updated: September 2026
Data Controller: Sole Proprietor Alauddin Zhamshitbekov • Contact: [email protected]
1. Commitment to Data Minimization
CSCA Space operates under a strict principle of Data Minimization (GDPR Article 5(1)(c)). We process personal information exclusively to authenticate scholars, record academic simulation progress, calculate cognitive difficulty spacing, and optimize examination simulator reliability. We do not sell student data, deploy third-party advertising pixels, or engage in cross-site behavioral profiling.
2. Personal Data We Collect
| Category | Specific Data Elements | Primary Purpose |
|---|---|---|
| Account & Identity | Full name, email address, profile picture (optional), encrypted user ID. | Account creation, authentication, password recovery. |
| Academic Telemetry | Question response choices, time-to-solve (dwell ms), formula mastery ratings, mock exam scores. | Generating weakness radar charts, SuperMemo SM-2 spaced repetition. |
| Study Configuration | Target exam date, target score goals, chosen disciplines (Math, Physics, Chemistry, Chinese). | Customizing countdown pacers and daily problem recommendations. |
| Technical Logs | IP address (anonymized after security verification), browser type, device category, client crash traces. | Rate limiting, session security, anti-bot abuse protection. |
3. Legal Bases for Processing (GDPR Article 6)
- Contractual Necessity (Art. 6(1)(b)): Processing necessary to deliver the simulation tests, track exam scores, and manage your account.
- Legitimate Interests (Art. 6(1)(f)): Preventing fraudulent multi-user account sharing, maintaining system uptime, and protecting platform cybersecurity.
- Explicit Consent (Art. 6(1)(a)): Optional academic hover tracking and non-essential analytics cookies, which you can accept or decline at any time.
4. Third-Party Sub-Processors
We partner with trusted cloud service providers bound by strict Data Processing Agreements (DPAs) ensuring equivalent data protection standards:
- Database & Storage: Supabase / PostgreSQL and Cloudflare R2 (asset storage).
- Authentication: Google Firebase Authentication (encrypted token management).
- AI Reasoning Engine: Google Cloud Gemini API (Enterprise tier; student answers are never used to train global public AI models).
- Transactional Communications: Resend Inc. (secure password reset and critical account notices).
- Payment Processing: Stripe, Paddle, or Lemon Squeezy (PCI-DSS compliant payment execution; CSCA Space never touches raw card details).
5. International Data Transfers
Our infrastructure utilizes globally distributed cloud servers located in the United States and the European Union. For transfers of personal data originating from the European Economic Area (EEA), we ensure appropriate safeguards through the implementation of European Commission-approved Standard Contractual Clauses (SCCs).
6. Data Retention Policy
We retain personal data only as long as necessary to fulfill educational preparation services:
- Active Accounts: Kept throughout the duration of your active study period.
- Inactivity Period: Accounts with zero activity for twenty-four (24) consecutive months are scheduled for automatic purge.
- Billing Records: Anonymized transaction metadata is retained for statutory accounting periods required by tax law.
7. Your Data Rights (GDPR & CCPA)
Depending on your jurisdiction, you have the following enforceable statutory rights:
Right to Access & Portability
Request a full machine-readable JSON export of your personal profile and exam attempts.
Right to Erasure ("Right to be Forgotten")
Permanently delete your account and all associated test scores from our database.
Right to Rectification
Update or correct inaccurate profile details directly inside your settings panel.
Right to Non-Discrimination
We will never alter pricing or deny educational access for exercising privacy rights.
8. How to Request Account & Data Deletion
You can exercise your right to deletion at any time through either of the following methods:
- Self-Service In-App: Log in to your Cockpit and navigate to Dashboard → Settings → Danger Zone → Delete Account. Deletion executes immediately and cascades across all database records.
- Direct Email Request: Send an email from your registered email address to [email protected] with the subject line "GDPR / CCPA Data Deletion Request". Requests are processed within thirty (30) calendar days.
9. Contact & Data Protection Inquiries
For privacy questions, data requests, or regulatory inquiries:
CSCA Space Privacy Office
Email: [email protected]
Operated by: Sole Proprietor Alauddin Zhamshitbekov