Academbee

Privacy policy

Document type: Customer-facing privacy notice
Version: 0.4 Controller: Converging Realities Ltd trading as Academbee Last updated: October 2026

1. Who we are

Converging Realities Ltd (“Academbee”, “we”, “us”, “our”) is a company registered in Cyprus.

We operate the Academbee online platform for teachers, schools, education providers, and users interested in educational services, including our websites, dashboards, public profiles, messaging tools, subscription features, verification processes, and related services (the “Platform”).

For most processing described in this Privacy policy, Converging Realities Ltd is the data controller. This means that we decide why and how personal data is processed.

Company: Converging Realities Ltd
Trading name: Academbee
Address: Panagias Kikkou 38, 2331, Lakatamia, Nicosia, Cyprus
VAT: CY-60016510L
General contact: support@academbee.com
Data protection contact: Savvas Iedidis — privacy@academbee.com

Supervisory authority in Cyprus:
Commissioner for Personal Data Protection
Website: https://www.dataprotection.gov.cy

2. Scope of this Privacy policy

This Privacy policy explains how we collect, use, disclose, retain, and protect personal data when you use Academbee as:

  • a teacher, tutor, school, education provider, administrator, or customer account holder;
  • a person creating or managing a public profile or listing;
  • a person using subscriptions, billing, verification, support, or messaging features;
  • a website visitor or prospective customer.

This policy primarily covers customer-side use of Academbee. Where end-user, student, parent, or learner processing differs materially, we may provide a separate privacy notice or additional privacy information.

This policy applies to personal data processed through:

  • Academbee websites;
  • Academbee web applications;
  • customer dashboards;
  • public profile and listing pages;
  • account registration and login;
  • subscription and billing flows;
  • verification and moderation flows;
  • support communications;
  • security, logging, and analytics systems;
  • email and transactional communications.

3. Important summary

Academbee processes personal data to provide, secure, improve, and administer the Platform.

In practice:

  • we collect account, profile, subscription, billing, verification, support, communication, usage, and security data;
  • some profile information may be made public when you publish a teacher or school profile;
  • payment card processing is handled by Stripe, and we do not store full card numbers on our servers;
  • we use trusted service providers such as hosting, database, email, payment, analytics, security, and support providers;
  • we keep data only for as long as needed for the purposes described in this policy, including legal, tax, accounting, security, and dispute-resolution purposes;
  • you have GDPR rights, including access, rectification, erasure, restriction, portability, objection, and the right to complain to a supervisory authority;
  • we do not sell personal data;
  • we do not use customer personal data to train public AI models unless we clearly tell you and have an appropriate legal basis.

4. Personal data we collect

“Personal data” means any information relating to an identified or identifiable natural person.

The personal data we collect depends on how you use the Platform.

4.1 Account data

We may collect:

  • name;
  • email address;
  • password hash;
  • account type;
  • role;
  • organisation or school name;
  • user ID;
  • authentication data;
  • login method;
  • account status;
  • email verification status;
  • subscription status;
  • accepted Terms version;
  • accepted Privacy policy version;
  • accepted billing terms version;
  • communication preferences.

We do not store your plain-text password.

4.2 Profile and listing data

If you create a teacher, school, or education provider profile, we may collect:

  • display name;
  • public title or tagline;
  • biography;
  • profile description;
  • teaching experience;
  • languages;
  • subjects;
  • specialties;
  • lesson information;
  • teaching modes;
  • session types;
  • prices;
  • availability-related information;
  • school or business details;
  • public contact preferences;
  • profile photos;
  • cover images;
  • gallery images;
  • website links;
  • social media links;
  • public address or area;
  • location data used for maps;
  • profile status, such as draft, pending review, published, unpublished, verified, or suspended.

When you publish a profile, certain profile and listing data may become visible to other users and website visitors.

4.3 Location data

If you add a location to your profile, we may collect:

  • address;
  • city;
  • district;
  • country;
  • postcode;
  • latitude and longitude;
  • formatted address;
  • map visibility preference;
  • location precision level, such as exact, approximate, area-only, or hidden;
  • whether the location is visible on public maps.

For privacy and safety reasons, we may reduce the precision of public location data, especially for individual teachers or tutors.

4.4 Verification data

Where verification is required or requested, we may collect:

  • identity or business verification details;
  • documents submitted for verification;
  • school registration or business documentation;
  • professional information;
  • supporting evidence;
  • verification status;
  • review notes;
  • rejection or approval reason;
  • audit trail of verification actions.

Verification documents are used for trust, safety, fraud prevention, platform integrity, and compliance purposes. They are not intended to be displayed publicly unless we expressly tell you otherwise.

4.5 Billing, subscription, and payment data

When you subscribe to a paid plan or use paid services, we may collect:

  • subscription plan;
  • billing name;
  • billing email;
  • billing address;
  • VAT or tax information;
  • invoice details;
  • payment status;
  • subscription renewal status;
  • transaction reference;
  • Stripe customer ID;
  • Stripe subscription ID;
  • payment method type;
  • last four digits of the payment card, where provided by Stripe;
  • card expiry month and year, where provided by Stripe;
  • invoice history;
  • payment failure events;
  • refund records;
  • cancellation records;
  • checkout acceptance records.

We use Stripe to process payments. Full card numbers and card security codes are processed by Stripe and are not stored on Academbee servers.

More billing-specific detail is provided in Personal data in billing (GDPR).

4.6 Messaging and inquiry data

If the Platform includes messaging, contact forms, inquiries, or lead features, we may process:

  • sender name;
  • sender email;
  • sender phone number, where provided;
  • message content;
  • inquiry subject;
  • recipient profile or school;
  • message timestamps;
  • message status;
  • moderation signals;
  • abuse-prevention data;
  • related account IDs;
  • reply history.

Message contents may include personal data provided by the sender. Users should avoid including unnecessary sensitive information in messages.

Phone numbers provided in inquiries are used for the inquiry process and are not displayed publicly unless the user expressly chooses to publish them through a supported public profile feature.

4.7 Communications and support data

When you contact us or we contact you, we may process:

  • support messages;
  • emails;
  • contact details;
  • issue descriptions;
  • screenshots or attachments you provide;
  • internal support notes;
  • ticket status;
  • feedback;
  • complaint information;
  • transactional email delivery logs.

4.8 Usage, device, log, and security data

When you use the Platform, we may automatically collect technical and usage data, including:

  • IP address;
  • browser type and version;
  • device type;
  • operating system;
  • referring URL;
  • pages viewed;
  • features used;
  • session information;
  • approximate location based on IP address;
  • timestamps;
  • error logs;
  • security logs;
  • authentication logs;
  • suspicious activity signals;
  • rate-limit events;
  • cookie identifiers;
  • analytics events, where enabled.

We use this data to operate, secure, debug, monitor, and improve the Platform.

4.9 Cookies and similar technologies

We may use cookies, local storage, pixels, SDKs, and similar technologies to:

  • keep you logged in;
  • remember preferences;
  • secure the Platform;
  • prevent fraud and abuse;
  • understand Platform usage;
  • improve performance;
  • measure marketing campaigns, where applicable;
  • manage cookie consent.

More information is provided in section 15 and in our Cookie policy.

4.10 Marketing and preference data

If we offer marketing communications, newsletters, promotions, or product updates, we may process:

  • email address;
  • name;
  • company or school name;
  • consent status;
  • opt-in source;
  • unsubscribe status;
  • email engagement data;
  • communication preferences.

Transactional emails, such as account activation, security notices, billing notices, renewal reminders, and service updates, are not marketing emails.

4.11 Legal, compliance, and audit data

We may process:

  • terms acceptance records;
  • privacy acceptance records;
  • consent records;
  • contract records;
  • billing records;
  • audit logs;
  • complaints;
  • dispute correspondence;
  • legal notices;
  • regulatory correspondence;
  • records required for tax, accounting, or legal compliance.

4.12 Special category data

We do not intentionally request special category personal data unless a specific feature clearly requires it and we have an appropriate legal basis.

Special category data includes information about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data, sex life, or sexual orientation.

You should not include special category data in your profile, listing, messages, support requests, or uploaded materials unless we specifically ask for it and explain why it is needed.

If special category data is submitted unnecessarily, we may delete it, restrict it, or ask you to remove it.

5. Sources of personal data

We collect personal data from:

  • you directly;
  • users who contact you through the Platform;
  • your organisation or school administrator;
  • payment providers, such as Stripe;
  • authentication providers, where applicable;
  • technical systems such as hosting, database, logging, analytics, and security tools;
  • publicly available sources, where necessary for verification or fraud prevention;
  • third parties you authorise to connect to the Platform.

6. How we use personal data

We use personal data for the following purposes.

6.1 To provide the Platform

We process data to:

  • create and manage accounts;
  • authenticate users;
  • provide dashboards;
  • create, edit, publish, and manage profiles;
  • display public listings;
  • manage lessons or service listings;
  • enable search and discovery;
  • provide messaging or inquiry features;
  • provide customer support;
  • maintain service availability.

6.2 To manage subscriptions, billing, and payments

We process data to:

  • create checkout sessions;
  • manage subscriptions;
  • process payments through Stripe;
  • issue invoices;
  • send renewal reminders;
  • send payment failure notices;
  • process cancellations and refunds;
  • maintain accounting and tax records;
  • prevent payment fraud;
  • comply with financial, tax, and legal obligations.

6.3 To verify users and maintain trust

We process data to:

  • verify teacher, school, or business profiles;
  • review submitted verification documents;
  • assess whether a profile may display a verification badge;
  • detect misleading or fraudulent listings;
  • prevent impersonation;
  • protect users and the integrity of the Platform.

6.4 To moderate content and enforce rules

We process data to:

  • review reported content;
  • detect prohibited content;
  • investigate abuse;
  • enforce our Terms of service;
  • suspend or remove profiles where needed;
  • protect users from fraud, spam, harassment, or misuse;
  • maintain records of enforcement decisions.

6.5 To communicate with you

We process data to send:

  • account activation emails;
  • email verification emails;
  • password reset emails;
  • billing notices;
  • renewal reminders;
  • payment failure notifications;
  • subscription updates;
  • security alerts;
  • service notices;
  • support replies;
  • legal notices;
  • policy update notices.

Where we send marketing communications, we will do so only where we have a valid legal basis and will provide an unsubscribe option.

6.6 To secure and improve the Platform

We process data to:

  • monitor performance;
  • debug errors;
  • detect unauthorised access;
  • investigate suspicious activity;
  • prevent spam and abuse;
  • apply rate limits;
  • maintain logs;
  • improve user experience;
  • test and develop features;
  • generate aggregate analytics.

Where possible, we use aggregated or de-identified data for analytics and product improvement.

6.7 To comply with law and protect legal rights

We process data to:

  • comply with tax and accounting obligations;
  • respond to lawful requests;
  • cooperate with regulators;
  • manage legal claims;
  • preserve evidence;
  • enforce contracts;
  • protect our rights, users, and the public.

7. Legal bases under GDPR

We rely on different legal bases depending on the processing activity.

Processing activity Main legal basis
Account registration and login Contract — GDPR Art. 6(1)(b)
Providing the Platform and customer dashboard Contract — GDPR Art. 6(1)(b)
Creating and managing profiles Contract — GDPR Art. 6(1)(b)
Publishing public profile/listing information Contract — GDPR Art. 6(1)(b); legitimate interests — GDPR Art. 6(1)(f)
Search and discovery features Contract; legitimate interests
Messaging and inquiries Contract; legitimate interests
Subscription management Contract — GDPR Art. 6(1)(b)
Payment processing Contract; legal obligation where accounting/tax records apply
Invoices, accounting, and tax records Legal obligation — GDPR Art. 6(1)(c)
Verification and fraud prevention Legitimate interests — GDPR Art. 6(1)(f); contract where verification is part of the service
Moderation and enforcement Legitimate interests; contract
Security logs and abuse prevention Legitimate interests — GDPR Art. 6(1)(f)
Support communications Contract; legitimate interests
Transactional emails Contract; legal obligation; legitimate interests, depending on the notice
Marketing emails Consent — GDPR Art. 6(1)(a), or legitimate interests where permitted by law
Cookies strictly necessary for the service Legitimate interests; contract
Non-essential cookies or similar tracking Consent, where required
End-users product analytics (Google Analytics 4) Consent — GDPR Art. 6(1)(a), where required for analytics cookies and equivalent tracking
Legal claims and dispute management Legitimate interests; legal obligation
Compliance with lawful requests Legal obligation

Where we rely on legitimate interests, our interests include operating a safe, reliable, commercially sustainable, and trusted education platform. We balance those interests against your rights and freedoms.

Where we rely on consent, you may withdraw consent at any time. Withdrawal does not affect processing already carried out before withdrawal.

8. Public profiles and published information

Academbee allows teachers, tutors, schools, and education providers to create public profiles or listings.

If you choose to publish a profile, the following information may be visible publicly:

  • display name;
  • school or business name;
  • profile photo or logo;
  • cover image;
  • biography;
  • profile description;
  • subjects or services offered;
  • lesson information;
  • prices, where provided;
  • teaching modes;
  • languages;
  • experience information;
  • website links;
  • social media links;
  • public location or approximate area;
  • verification badge or profile status;
  • public contact or inquiry options.

You are responsible for ensuring that the information you choose to publish is accurate and appropriate for public display.

We may limit, hide, approximate, or remove public information where needed for safety, privacy, compliance, moderation, or platform integrity.

If you schedule account deletion through the Platform, we may unpublish or remove your public profile from search, map, listing, and discovery features immediately during the deletion grace period. If the deletion completes, public profile data is deleted or anonymised according to the account-deletion manifest, subject to lawful retention exceptions. Messages or historic interactions may show a neutral label such as “Deleted user” where needed to preserve another user’s conversation history.

9. Verification documents

Verification documents are used to assess whether a teacher, school, or education provider may be marked as verified or trusted on the Platform.

Verification documents may include identity, business, school, professional, or supporting documents.

We apply access controls to verification documents and restrict access to authorised personnel or service providers who need access for verification, security, legal, or compliance purposes.

We do not publish verification documents unless you expressly request publication and we agree, or unless required by law.

We may retain verification records for a limited period after verification, rejection, suspension, or account closure where necessary for fraud prevention, platform integrity, legal claims, or compliance.

If account deletion completes, verification documents are deleted unless a legal hold, dispute, fraud-prevention need, or mandatory legal obligation requires temporary retention. Where a record must be retained, we restrict or minimise it where possible.

10. Messaging and inquiries

Where the Platform allows users to contact teachers, tutors, schools, or education providers, we may process message and inquiry data to:

  • deliver the message;
  • show the message in the relevant dashboard;
  • prevent spam and abuse;
  • investigate reports;
  • protect users;
  • comply with legal obligations;
  • enforce our Terms of service.

Messages are not intended for emergency communications, highly confidential information, or unnecessary sensitive personal data.

We may apply automated or manual checks to detect spam, abuse, fraud, or prohibited content. We do not guarantee that all harmful or inappropriate content will be detected.

11. Billing and payments

Payments are processed by Stripe or another payment provider we may appoint.

Academbee does not store full card numbers or card security codes on its servers.

We may store payment-related metadata, including Stripe customer ID, subscription ID, invoice ID, payment status, payment method type, card brand, and last four digits, where provided by Stripe.

Billing records may be retained for tax, accounting, audit, legal, and dispute-resolution purposes.

For more information, see Personal data in billing (GDPR).

12. Transactional emails and service communications

We may send transactional and service-related communications, including:

  • account verification emails;
  • password reset emails;
  • login or security alerts;
  • subscription confirmation emails;
  • renewal reminders;
  • payment failure notices;
  • invoice emails;
  • cancellation confirmations;
  • important service updates;
  • policy update notices.

These communications are necessary for the Platform and are not marketing communications.

You may not be able to opt out of essential service, security, billing, or legal emails while you maintain an account or subscription.

13. Marketing communications

If we send marketing communications, we will do so in accordance with applicable law.

Marketing communications may include:

  • product updates;
  • newsletters;
  • promotional offers;
  • launch announcements;
  • surveys;
  • educational content.

Where consent is required, we will ask for consent before sending marketing emails.

You can unsubscribe from marketing communications using the unsubscribe link in the email or by contacting us.

Unsubscribing from marketing emails does not stop transactional, billing, security, or legal communications.

14. Analytics, product improvement, and aggregated data

We may use analytics to understand how the Platform is used and to improve performance, reliability, usability, and product features.

Analytics may include:

  • pages visited;
  • features used;
  • session duration;
  • device and browser information;
  • errors and performance events;
  • general usage patterns.

Where possible, we use aggregated, anonymised, or de-identified data.

Aggregated or anonymised data that no longer identifies a person is not personal data under GDPR. However, if we combine it with other data in a way that can identify a person, we treat it as personal data.

14.1 Google Analytics 4 (end-users marketplace)

On the public end-users Academbee site (the marketplace), we use Google Analytics 4 (GA4) when you consent to analytics in our cookie tool. We do not load Google’s analytics script before that consent where consent is required.

Purposes: understand how visitors and signed-in users navigate and use the marketplace (for example pages viewed, searches, profile views, favourites, sign-up, messaging, and teacher/school signup flows) so we can improve performance, reliability, and product design.

Categories of data: online identifiers (including GA cookie IDs), device and browser technical data, coarse location derived from IP address (as processed by Google), sanitised page URLs and referrers, event names and parameters, and when you are signed in a pseudonymous internal user ID (UUID) — not your email address or display name.

What we do not use this GA4 property for (current configuration): personalised advertising, Google Signals, or sharing GA data with Google Ads for cross-context behavioural advertising. Advertising storage flags in Google Consent Mode are denied in our implementation.

Retention: in our Google Analytics property settings we use a 14-month event data retention period (subject to Google’s systems). Cookie durations are described in the Cookie policy.

Processors: Google Ireland Limited and Google LLC (and subprocessors per Google’s terms). See section 19 and 20.

Your choices: deny or withdraw consent via the cookie banner, Consent settings, or footer Cookie settings on the end-users site; clear browser cookies; and exercise rights in sections 24 and 24A.

15. Cookies and similar technologies

We use cookies and similar technologies to operate and improve the Platform.

Cookies may be grouped into the following categories:

15.1 Strictly necessary cookies

These are required for the Platform to work.

They may be used for:

  • authentication;
  • session management;
  • security;
  • fraud prevention;
  • load balancing;
  • remembering privacy choices.

These cookies cannot usually be disabled through our cookie banner because they are necessary for the service.

15.2 Preference cookies

These remember choices such as:

  • language;
  • region;
  • display preferences;
  • cookie settings.

15.3 Analytics cookies

These help us understand how users use the Platform so we can improve it.

Where required by law, analytics cookies are used only with consent.

15.4 Marketing cookies

These may be used to measure campaigns or show relevant advertising.

Academbee should not use marketing cookies unless a compliant cookie banner and consent mechanism is in place.

15.5 Managing cookies

You can manage cookies through:

  • our cookie banner or consent tool, where available;
  • browser settings;
  • device settings;
  • third-party opt-out tools, where applicable.

Rejecting or disabling certain cookies may affect Platform functionality.

A separate Cookie policy should describe the specific cookies used, their providers, purposes, duration, and consent requirements.

16. Automated decision-making and profiling

We do not make decisions based solely on automated processing that produce legal effects or similarly significant effects on users, unless we clearly tell you and have a lawful basis.

We may use automated tools to support:

  • spam detection;
  • abuse prevention;
  • security monitoring;
  • rate limiting;
  • fraud detection;
  • moderation prioritisation;
  • email delivery monitoring;
  • analytics.

Where automated tools flag content or behaviour, we may conduct manual review where appropriate.

17. Artificial intelligence and machine learning

Academbee may use AI-assisted tools internally or within the Platform to improve productivity, support, moderation, content quality, search, or user experience.

Unless we clearly state otherwise:

  • we do not use customer personal data to train public AI models;
  • we do not sell customer personal data for AI training;
  • we do not allow third-party AI providers to use customer personal data for their own model training where we have contractually restricted this;
  • we apply access controls and data minimisation where AI tools are used.

If we introduce AI features that materially change how personal data is processed, we will update this Privacy policy or provide additional notice.

Users should not enter unnecessary sensitive personal data into AI-enabled features.

18. When we share personal data

We may share personal data with the following categories of recipients.

18.1 Service providers and processors

We use trusted providers to help operate the Platform, including providers for:

  • hosting;
  • cloud infrastructure;
  • database services;
  • authentication;
  • payments;
  • email delivery;
  • analytics;
  • monitoring;
  • security;
  • customer support;
  • file storage;
  • error tracking;
  • backups;
  • development and deployment.

These providers process personal data under contracts and may only process data according to our instructions, unless they are independent controllers for specific activities.

18.2 Payment providers

Payment providers such as Stripe process payment data to complete transactions, manage subscriptions, prevent fraud, and comply with financial regulations.

Stripe may act as an independent controller for some payment-related processing.

18.3 Email providers

Email providers such as SendGrid may process email addresses, message content, delivery status, and related metadata to send transactional and service emails.

18.4 Hosting and database providers

Hosting and database providers such as Vercel and Supabase may process personal data as part of hosting, storage, database, security, and infrastructure services.

18.5 Professional advisers

We may share data with lawyers, accountants, auditors, insurers, consultants, or other professional advisers where necessary.

18.6 Public authorities

We may disclose data where required by law, court order, regulator, tax authority, law enforcement, or other competent public authority.

18.7 Business transfers

If Academbee is involved in a merger, acquisition, financing, restructuring, sale of assets, or transfer of business, personal data may be transferred as part of that transaction, subject to appropriate safeguards.

18.8 Other users and the public

If you publish a profile or listing, public profile information may be visible to other users, website visitors, and search engines.

If you communicate through the Platform, your message data may be visible to the intended recipient and authorised Academbee personnel where needed for support, security, moderation, or compliance.

19. Processor register

Academbee should maintain an internal processor register before production and keep it updated.

The processor register should include, at minimum:

Provider Purpose Data processed Location / transfer safeguards DPA status
Stripe Payments and subscriptions Billing and payment metadata To be confirmed Required
SendGrid Transactional emails Email addresses, email content, delivery metadata To be confirmed Required
Supabase Database and authentication services Account, profile, usage, and application data To be confirmed Required
Vercel Hosting and deployment Hosted application data, logs, technical data To be confirmed Required
Sentry or similar Error tracking and monitoring Error logs, technical metadata To be confirmed Required
Google (Analytics 4) Product analytics — end-users marketplace only Online identifiers, usage events, pseudonymous user ID (UUID), device/browser data, sanitised URLs United States and other locations per Google; EU establishment: Google Ireland Limited; safeguards per §20.1 Google Measurement / Ads data protection terms (accepted in GA admin where applicable)
Support provider Customer support Support messages and contact data To be confirmed Required

This public policy may refer to categories of processors. A more detailed public subprocessor list may be published separately.

20. International transfers

Academbee is based in Cyprus, within the European Economic Area.

Some service providers may process personal data outside the EEA, the United Kingdom, or Switzerland.

Where personal data is transferred internationally, we use appropriate safeguards as required by law, such as:

  • adequacy decisions;
  • Standard Contractual Clauses;
  • UK International Data Transfer Agreement or UK Addendum, where applicable;
  • transfer impact assessments;
  • supplementary technical, organisational, or contractual measures where required.

You may contact us for more information about international transfer safeguards, subject to confidentiality and security limitations.

20.1 Google Analytics (end-users)

When you consent to analytics on the end-users marketplace, usage data is processed by Google as our analytics provider. Google may process data in the United States and other countries outside your country of residence.

For transfers subject to GDPR or UK GDPR, we rely on appropriate safeguards, which may include:

  • the EU–US Data Privacy Framework where Google participates and the transfer qualifies;
  • Standard Contractual Clauses (and the UK International Data Transfer Agreement or Addendum, where applicable) incorporated in Google’s data protection terms;
  • transfer impact assessments and supplementary technical or organisational measures where our assessment requires them.

Google’s role, subprocessors, and security measures are described in Google’s privacy policy and data processing terms for Google Analytics / Google Ads (as applicable to our configuration). We configure GA4 to minimise data use (for example advertising features off, URL sanitisation, pseudonymous user_id only).

21. Security

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure.

These measures may include:

  • access controls;
  • role-based permissions;
  • authentication controls;
  • encryption in transit;
  • encryption at rest where supported;
  • secure hosting providers;
  • private storage for sensitive documents;
  • logging and monitoring;
  • rate limiting;
  • backup procedures;
  • least-privilege access;
  • environment separation;
  • vulnerability management;
  • internal security procedures;
  • review of sensitive access;
  • incident response procedures.

No system is completely secure. Users are responsible for keeping login credentials confidential and for notifying us promptly if they suspect unauthorised access.

22. Data breach notification

If we become aware of a personal data breach, we will assess it and take appropriate steps.

Where required by GDPR, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of the breach.

Where a breach is likely to result in a high risk to individuals, we will notify affected individuals as required by law.

23. Retention

We keep personal data only for as long as necessary for the purposes described in this Privacy policy, unless a longer retention period is required or permitted by law.

Retention periods may depend on:

  • whether your account is active;
  • whether your profile is published;
  • whether you have an active subscription;
  • legal, tax, and accounting obligations;
  • security needs;
  • fraud prevention;
  • dispute resolution;
  • regulatory obligations;
  • backup cycles;
  • limitation periods for legal claims.

Indicative retention periods are below.

Data category Indicative retention period
Account data While account is active, then deleted or anonymised after account closure unless retention is required
Public profile data While profile is active or published; removed or unpublished after account closure or request, subject to legal exceptions
Verification documents Kept only as long as needed for verification, fraud prevention, legal claims, or compliance
Billing and invoice records Normally retained for at least the legally required tax/accounting period; currently set as 7 years in billing documentation, subject to legal/accounting confirmation
Payment metadata Retained as needed for subscription management, accounting, fraud prevention, disputes, and legal obligations
Support messages Retained for as long as needed to handle support, improve service, and keep records of issues
Messaging and inquiries Retained while needed to provide messaging, manage disputes, prevent abuse, and maintain security
Security logs Retained for a limited period based on security needs, unless needed for investigation or legal claims
Consent records Retained while needed to demonstrate compliance
Marketing preferences Retained until you unsubscribe or object, and thereafter as needed to maintain suppression records
Account deletion requests Retained as needed to operate the grace period, audit the request, and prove completion or lawful retention exceptions
Encrypted deletion email Retained only until the completion email is sent or permanently undeliverable, then purged from the deletion request
Erasure ledger Retained as a pseudonymous audit record using an HMAC user identifier, manifest version, completion timestamp, and non-PII receipt metadata
Backups Retained for a limited backup cycle and then overwritten or deleted
End-users GA4 analytics events Retained in Google Analytics for up to 14 months per our property configuration, then subject to Google’s deletion cycles; cookie lifetimes per Cookie policy

When deletion is not immediately possible, we may restrict, archive, or securely retain data until deletion is technically and legally possible.

24. Your GDPR rights

Subject to legal conditions and limitations, you may have the following rights.

24.1 Right of access

You may request confirmation of whether we process your personal data and a copy of that data.

24.2 Right to rectification

You may ask us to correct inaccurate or incomplete personal data.

24.3 Right to erasure

You may ask us to delete your personal data.

We may not be able to delete data immediately where we need to retain it for legal, tax, accounting, security, fraud prevention, dispute, or legal-claims purposes.

24.4 Right to restriction

You may ask us to restrict processing in certain circumstances.

24.5 Right to data portability

You may request a copy of certain personal data in a structured, commonly used, machine-readable format where the right applies.

24.6 Right to object

You may object to processing based on legitimate interests.

You may also object to direct marketing at any time.

24.7 Right to withdraw consent

Where processing is based on consent, you may withdraw consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

24.8 Right to complain

You have the right to complain to a supervisory authority.

If you are in Cyprus, you may contact the Commissioner for Personal Data Protection.

24A. United States state privacy notices

This section provides additional information for residents of US states with comprehensive privacy laws (including California, Colorado, Connecticut, Virginia, Utah, Texas, and others as laws evolve). It supplements section 24 and does not limit rights that apply under other laws.

24A.1 Categories of personal information (analytics)

When you use the end-users marketplace and consent to analytics, we and Google Analytics may collect or process categories such as:

  • Identifiers (for example cookie IDs, pseudonymous user ID, device identifiers);
  • Internet or other electronic network activity (for example pages viewed, interactions, referring URLs);
  • Geolocation data (coarse, derived from IP address by Google).

We use these for business purposes described in section 14.1 (product analytics and improvement), not for selling your personal information for money.

24A.2 Sale, share, and targeted advertising

Our position: Our end-users GA4 implementation is configured without Google Signals, without ads personalisation, and without sharing GA data with Google advertising products for cross-context behavioural advertising. We intend Google to act as a service provider / processor for analytics, not as a third party buying or receiving data for its own independent advertising purposes.

If you are a California resident and our processing is deemed a “sale” or “share” despite this configuration, you may have the right to opt out. Contact privacy@academbee.com or use the cookie controls on the end-users site. We are evaluating whether a dedicated “Do Not Sell or Share My Personal Information” page is required for Academbee’s scale and activities.

24A.3 Your US rights

Depending on your state, you may have rights to:

  • know what personal information we collect and how we use it;
  • access and obtain a copy of certain personal information;
  • delete personal information we hold (subject to exceptions);
  • correct inaccurate personal information;
  • opt out of sale, share, or targeted advertising where applicable;
  • limit use of sensitive personal information where applicable;
  • non-discrimination for exercising privacy rights.

To exercise rights, contact privacy@academbee.com. We may verify your request. Authorised agents may submit requests where permitted by law.

24A.4 Global Privacy Control and similar signals

Some browsers or extensions send Global Privacy Control (GPC) or similar opt-out preference signals. We are reviewing whether and how Academbee must honour GPC for analytics on the end-users site under California and other state laws. Until implemented, use our cookie Deny or Consent settings controls and contact us at privacy@academbee.com.

25. How to exercise your rights

To exercise your rights, contact us at:

privacy@academbee.com

You may also contact:

support@academbee.com

We may need to verify your identity before responding to a request.

We will respond within one month, unless the request is complex or we receive multiple requests, in which case we may extend the response period as permitted by law.

We will not discriminate against you for exercising your privacy rights.

26. Account deletion and profile removal

You may request deletion of your account or removal of your public profile. Where self-service deletion is enabled, customers use Profile settings → Danger zone and end users use Account settings → Danger zone. Support or super-admin initiated deletion may be used where you cannot access the app or where a legal, safety, or fraud process requires staff handling.

Self-service account deletion normally uses a 14-day grace period. During that period, your account is placed into a restricted pending-deletion state. You may be able to view deletion status, cancel the request, sign out, and request a data export using the available Platform controls. If you cancel during the grace period, the account returns to active status, subject to subscription and moderation rules.

After account deletion:

  • your login access may be removed;
  • your public profile may be unpublished or deleted;
  • active subscriptions are cancelled or stopped as part of the deletion flow where applicable, while billing and invoice records may still be retained where required by law;
  • billing records may be retained where required by law;
  • support, security, dispute, and audit records may be retained where necessary;
  • backup copies may remain for a limited period before deletion through normal backup cycles;
  • a pseudonymous erasure ledger may be retained to prove that deletion completed and to detect any PII restored from backup.

Deleting your account removes or anonymises the canonical identity across customer and end-user roles linked to that identity. It does not automatically rewrite free-text message bodies that another user may need for their conversation history, but sender attribution and account references are anonymised where the erasure manifest requires it.

For completion emails, Academbee stores an encrypted notification email address on the deletion request only for the short period needed to send lifecycle emails. The decrypted address is used only by the transactional email worker at send time and must not be written to logs, analytics, receipts, or the erasure ledger. You may register again with the same email address as a new account after erasure completes.

Google Analytics: Account deletion in Academbee systems does not automatically erase data already stored in Google’s analytics systems. Where technically supported, we will submit deletion requests to Google for the pseudonymous analytics user identifier associated with your account. Until that automation is live, you may also clear analytics cookies via our cookie tool or your browser. See the Cookie policy.

Where possible, we will delete, anonymise, or restrict personal data that is no longer needed.

27. Children and minors

The Platform is intended for adults, teachers, tutors, schools, education providers, and users who are legally able to use the service.

The Platform is not directed at children below the age at which they may lawfully consent to information society services under applicable data protection law.

For Cyprus and many EU contexts, the default GDPR age for child consent is 16 unless national law provides otherwise. The applicable age threshold may vary by target market.

We do not knowingly collect personal data from children without appropriate consent or another valid legal basis.

If we learn that a child has provided personal data without appropriate consent or legal basis, we may delete or restrict the data.

Schools, teachers, and education providers are responsible for ensuring that any personal data they provide about minors is processed lawfully and with appropriate notices, permissions, and safeguards.

28. Customer responsibilities

If you are a teacher, school, tutor, education provider, or organisation using Academbee, you are responsible for:

  • ensuring that the information you provide is accurate;
  • ensuring that you have the right to upload or publish profile content;
  • avoiding unnecessary personal data in public profiles;
  • avoiding unnecessary sensitive data in messages or support requests;
  • complying with applicable privacy, education, safeguarding, consumer, and advertising laws;
  • providing privacy notices to your own students, parents, staff, or contacts where required;
  • using Platform messaging and inquiry data only for lawful education-related purposes;
  • not exporting or misusing personal data from the Platform.

Where you act as an independent controller, you are responsible for your own privacy compliance.

Where we process personal data on your behalf as a processor, a separate Data processing agreement may apply.

29. Third-party links and services

The Platform may contain links to third-party websites, social media pages, payment pages, map providers, or external services.

We are not responsible for the privacy practices of third parties.

You should review the privacy policies of third-party services before using them.

30. Third-party integrations

If we offer integrations with third-party services, such as calendars, email tools, payment tools, analytics tools, or communication tools, personal data may be exchanged with those services when you enable or use the integration.

The data shared will depend on the integration and your settings.

We will provide additional information where required.

31. Data accuracy

We rely on users to provide accurate and up-to-date information.

You can update certain account and profile information through your dashboard.

We may ask you to update or verify information where necessary for billing, verification, compliance, or platform integrity.

32. Data minimisation

We aim to collect only the personal data that is necessary for the purposes described in this policy.

You should avoid submitting unnecessary personal data, especially in:

  • public profiles;
  • biographies;
  • lesson descriptions;
  • messages;
  • support requests;
  • uploaded documents;
  • verification materials.

33. Do Not Track and browser signals

Some browsers may send “Do Not Track” (DNT) or similar signals.

Because there is no consistent industry standard for DNT, the Platform may not respond to all such signals.

Where legally required and technically supported, we will respect:

  • choices made through our cookie consent tool on the end-users marketplace (Deny, Accept all, Consent settings, and footer Cookie settings);
  • Global Privacy Control (GPC) and other legally recognised opt-out preference signals as described in section 24A.4 (implementation in progress where required).

Analytics on the end-users site is off by default until you opt in where consent is required.

34. Changes to this Privacy policy

We may update this Privacy policy from time to time.

If changes are material, we will notify users as required by law, which may include email notice, in-app notice, or prominent website notice.

The “Last updated” date shows when this policy was last revised.

Continued use of the Platform after an updated Privacy policy becomes effective may be subject to the updated policy, where permitted by law.

35. Contact us

For questions about this Privacy policy or your personal data, contact:

Data protection contact:
Savvas Iedidis
privacy@academbee.com

General support:
support@academbee.com

Postal address:
Converging Realities Ltd
Panagias Kikkou 38
2331, Lakatamia
Nicosia, Cyprus

36. Supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority.

For Cyprus:

Commissioner for Personal Data Protection
Website: https://www.dataprotection.gov.cy

We encourage you to contact us first so we can try to resolve your concern.