PRIVACY POLICY
Effective Date: May 16, 2026 (Last Updated: October 16, 2026)
1. INTRODUCTION, SCOPE & LAWFUL BASES FOR PROCESSING
Welcome to EudoSpace ("Platform", "We", "Us", or "Our"). We are dedicated to delivering an empowering, intelligent, and safe digital learning environment. We recognize that your privacy is a fundamental human right, and we hold ourselves to the highest ethical and technical standards when handling your personal data.
This comprehensive Privacy Policy transparently governs how we collect, store, utilize, analyze, share, and protect your information across all web applications, APIs, interactive study rooms, AI-assisted learning tools, and related services hosted at EudoSpace.
1.1. Voluntary & Affirmative Consent: By accessing the Platform, creating a user account, or engaging with any active, preview, or maintenance-gated features, you confirm that you have read, comprehended, and voluntarily provided your informed, explicit consent to the data processing activities outlined herein. If you do not agree with any provision of this Privacy Policy, you must immediately discontinue using our services.
1.2. Lawful Bases for Processing: We collect and process your personal data under recognized international legal frameworks (including the European Union General Data Protection Regulation - GDPR, the California Consumer Privacy Act / California Privacy Rights Act - CCPA/CPRA, and Vietnam's Personal Data Protection Decree No. 13/2023/ND-CP) pursuant to the following legal grounds:
- Contractual Necessity: Processing required to provide you with core platform functionality, authenticate your sessions, maintain your academic progress, and manage your virtual wallet.
- Explicit Consent: Where you provide voluntary, affirmative consent for specialized processing, such as analyzing microphone voice recordings for IELTS Speaking evaluation or opting in to study alert communications.
- Legitimate Interests: Necessary processing to safeguard our infrastructure, combat fraudulent account creation, optimize algorithm difficulty curves, and prevent resource abuse.
- Compliance with Legal Obligations: Processing required to satisfy applicable statutory regulations, tax obligations, or binding judicial directives.
2. CATEGORIES OF DATA COLLECTED
To deliver personalized educational workflows, simulate real-world examination standards, and administer our virtual ecosystem, EudoSpace collects and processes the following distinct categories of data:
2.1. Identity & Account Credentials
- Primary Identifiers: Your verified email address, chosen public display name, system-generated User ID (UUID), and avatar selection.
- Authentication Credentials: Passwords that are salted and cryptographically hashed using industry-standard hashing algorithms (e.g., bcrypt/Argon2) prior to storage. EudoSpace never views, logs, or stores your plaintext passwords.
- Optional Student Profile Attributes: Academic grade level, school or educational institution, target examination score (e.g., IELTS target band score, National High School Graduation target), and personal learning aspirations.
2.2. Academic Activity, Learning Telemetry & SRS Data
- Practice Tests & Quiz Submissions: Multiple-choice selections, reading and listening exam responses, time-on-task per question, completion timestamps, and total attempt counts.
- Error Autopsies & Weakness Analytics: Detailed records of incorrect answers, categorized error patterns, and review histories used to tailor individualized remediation advice.
- Spaced Repetition System (SRS) Metrics: Flashcard mastery levels, ease factors, repetition counts, historical recall intervals, and scheduled review due dates.
- Study Habits & Productivity Telemetry: Accumulated study time, Pomodoro focus session durations, completed work intervals, active study streak counters, and daily activity heatmaps.
2.3. Audio & Voice Data (IELTS Speaking Mock Tests)
- Voice Recordings: User-initiated microphone audio recordings captured exclusively during IELTS Speaking practice sessions (covering Part 1, Part 2, Part 3, or Full Simulation Tests).
- Speech Telemetry & Waveforms: Raw audio waveforms, speech-to-text transcripts, acoustic duration logs, fluency rates, lexical diversity scores, and pronunciation evaluation metrics.
2.4. User-Generated Content (UGC) & Community Contributions
- Study Files: User-uploaded study materials, digital notes, study guides, PDF documents, and image files.
- Community Interactions: Document upload requests, inline annotations on shared study materials, public discussion comments, peer question-and-answer exchanges, and customer support tickets.
2.5. Virtual Economy & Transaction Records
- Virtual Balances: Real-time balances of educational points (EuCoin) and operational energy units (EuFluz).
- Transaction Histories: Audit logs of EuCoin rewards earned from verified academic achievements, daily subsidy allocations (20,000 EuFluz granted daily at 00:00 UTC), conversions of EuCoin into Permanent EuFluz, flat-rate session debits (e.g., upfront IELTS Speaking session fees), and cosmetic shop inventory purchases.
2.6. Technical & Device Telemetry
- Network & Hardware Attributes: Internet Protocol (IP) address, User-Agent string, browser engine and version, operating system, device architecture, screen resolution, and preferred language headers (Accept-Language).
- System Diagnostics: Access timestamps, referring URLs, API endpoint latency logs, edge server routing paths, and client-side error telemetry.
3. COOKIES, LOCALSTORAGE & CLIENT-SIDE TECHNOLOGIES
EudoSpace uses browser cookies, LocalStorage, and SessionStorage to guarantee security, maintain session state, and deliver a seamless user experience. We classify these technologies as follows:
3.1. Strictly Necessary & Security Cookies
- Authentication Session Tokens: Secure, HttpOnly JWT cookies issued via Supabase Auth (e.g., sb-*-auth-token) that maintain your encrypted login session without exposing credentials.
- CSRF Mitigation: Cross-Site Request Forgery tokens embedded in headers to verify that outgoing requests originate strictly from your authorized browser session.
3.2. Personalization & Preference Storage
- Locale Cookie (NEXT_LOCALE): A persistent browser cookie storing your selected language preference (English or Vietnamese) across navigation and re-visits.
- LocalStorage Settings: Persistent client-side keys storing your visual theme mode (dark, light, or system default), audio playback volume, Pomodoro completion notification chimes, ambient background white noise sound preferences, and Zen/Distraction-Free Mode toggle states.
3.3. Temporary & Session State
- SessionStorage: Ephemeral storage for maintenance unlock passcodes or one-time verification tokens (OTP) granting preview access to gated beta features.
- Temporary Audio Blobs: In-memory browser Blob references generated during live voice recording prior to secure upload or transcription.
- Live Study Rooms: Transient nicknames, ephemeral room PINs, and WebRTC/WebSocket connection parameters required for real-time multiplayer study sessions.
Cookie Management: You can adjust your browser settings to restrict or block cookies. However, disabling strictly necessary cookies will prevent authentication and make it impossible to access your private dashboard or study progress.
4. THIRD-PARTY SERVICE PROVIDERS & SUB-PROCESSORS
To operate a globally resilient platform, EudoSpace collaborates with reputable third-party infrastructure and technology providers. We enforce rigorous Data Processing Agreements (DPAs) requiring sub-processors to maintain confidentiality and industry-standard security safeguards.
4.1. Cloud Infrastructure & Database Hosting
- Supabase Inc. (Hosted on AWS): Houses our primary PostgreSQL relational database, authentication engine, and encrypted object storage for avatars, user notes, and test recordings. All database access is governed by strict Row-Level Security (RLS) policies.
- Vercel Inc.: Powers our serverless compute runtime, edge network distribution, and global Content Delivery Network (CDN) to ensure ultra-low latency page rendering.
4.2. Artificial Intelligence Sub-processors (Google Gemini API)
EudoSpace leverages the Google Cloud / Google Gemini API ecosystem (including models such as Gemini Flash, Flash-Lite, Flash-Preview, and Gemini Pro) to power EudoAI features:
- Functional Roles: Automated essay scoring, criterion-based feedback (Task Achievement, Coherence & Cohesion, Lexical Resource, Grammatical Range & Accuracy), audio transcription analysis, personalized error explanations, semantic document search, and real-time question generation.
- No Foundational Model Training on User Data: Educational prompts, essay text, and audio transcripts transmitted through our enterprise Gemini API integrations are processed strictly to return inference outputs. Under Google Cloud Vertex AI and Gemini enterprise terms, your personal data is NOT used to train or refine Google's foundational public language models.
- Data Minimization: The Platform automatically strips direct identity markers (such as email addresses and user names) from API payloads before sending prompts to the AI engine.
4.3. Focus Media Integration (Spotify Web API)
To enhance study concentration, EudoSpace integrates an optional Spotify playback widget utilizing the official Spotify Web API (`/api/spotify/token`):
- All user authentication and playback token authorisations occur directly through Spotify's secure OAuth flow.
- EudoSpace never intercepts, inspects, or stores your Spotify account password, payment instruments, or complete external listening history.
4.4. Legal Mandates & Law Enforcement
We do not disclose personal information to governmental agencies or law enforcement authorities unless strictly compelled by a valid subpoena, court order, or legally binding warrant issued under applicable jurisdiction.
5. PURPOSES OF DATA PROCESSING
We strictly limit our data processing activities to legitimate educational, operational, and security purposes:
- Core Educational Delivery: Authenticating user accounts, maintaining academic dashboards, recording test submissions, and syncing interactive collaborative study rooms in real time.
- Intelligent Feedback & Scoring: Generating instant, pedagogically rigorous assessments for IELTS Writing and Speaking submissions, accompanied by targeted corrective feedback.
- Virtual Economy Operations: Validating balances prior to initiating AI tasks, calculating merit-based EuCoin rewards, processing daily subsidy resets, and safeguarding our virtual token distribution against automated exploitation.
- Algorithmic & Platform Optimization: Refining our Spaced Repetition (SRS) algorithms, calibrating question difficulty through aggregated, anonymized student performance metrics, and resolving platform bugs.
- System Integrity & Defense: Detecting and mitigating brute-force attacks, distributed denial-of-service (DDoS) vectors, abusive scripting, and unlawful content submissions.
6. COMMUNICATIONS & FUTURE EMAIL NOTIFICATIONS
As part of our commitment to transparent communication, we disclose that EudoSpace utilizes email communications for critical and optional service workflows:
6.1. Essential Transactional & Security Communications
These emails are strictly necessary for the security and operation of your account and cannot be disabled while maintaining an active account:
- Account registration, email address verification, and two-factor authentication tokens.
- Password reset requests and suspicious login security alerts.
- Critical legal updates regarding our Terms of Service or Privacy Policy.
6.2. Educational Alerts & Learning Habit Notifications
To help you achieve your academic goals, EudoSpace may dispatch optional educational notices:
- Upcoming homework deadlines, study streak preservation alerts, and Spaced Repetition flashcard review notifications.
- Community notifications when an educator or peer answers your document inquiry or replies to your discussion comment.
- You maintain complete granular control over educational notifications and can toggle them on or off within your Profile Settings at any time.
6.3. Product Announcements & Newsletters
We may occasionally distribute newsletters covering new examination practice sets, major AI feature releases, or platform updates. Every promotional email contains a direct, automated one-click "Unsubscribe" link.
6.4. Strict Anti-Monetization & No-Spam Pledge
EudoSpace will NEVER sell, lease, rent, trade, or monetize your email address or personal contact details to third-party marketing agencies, advertisers, or data brokers.
7. DATA RETENTION, DESTRUCTION & BACKUP POLICIES
We adhere to strict data minimization principles and retain personal data only for as long as necessary to fulfill the legitimate purposes described in this policy:
- Active Accounts: Account credentials, academic score histories, virtual token logs, and user-generated documents are retained for the active lifecycle of your registered account.
- IELTS Speaking Audio Recordings: Microphone recordings submitted for IELTS Speaking evaluation are stored in encrypted object storage only to complete transcription, generate AI assessment metrics, and allow you to review your spoken responses in your personal test review history. You may delete specific test sessions at will. All associated audio files are permanently purged upon account termination or upon a verified deletion request.
- Disaster Recovery Backups: System backups generated for disaster recovery and business continuity are retained in encrypted, immutable cold storage on a rolling 30-day lifecycle. Once this 30-day window expires, backed-up data is permanently overwritten and eradicated.
- Anonymized Data Retention: De-identified academic statistics (e.g., aggregate question accuracy rates, anonymous error distribution patterns) that cannot be linked back to any individual identity may be retained indefinitely to support educational research and question calibration.
8. INTERNATIONAL STANDARDS & USER PRIVACY RIGHTS
Regardless of your physical location, EudoSpace affords all users comprehensive privacy rights inspired by global benchmarks:
8.1. Universal Data Subject Rights
- Right to Access: You have the right to request a complete overview of all personal data we maintain concerning your identity and academic history.
- Right to Rectification: You may update or correct inaccurate profile details directly through your Profile Settings.
- Right to Data Portability: You may request an export of your academic records, test submissions, and profile data in a structured, commonly used, and machine-readable format (such as JSON or CSV).
- Right to Erasure ("Right to be Forgotten"): You may request the permanent deletion of your account. Upon confirmation, your identity credentials, profile information, academic records, virtual wallet history (EuCoin and EuFluz balances), uploaded materials, and audio files will be irrevocably purged from our active databases.
8.2. Right to Withdraw Consent & Opt Out of AI Processing
You have the unrestricted right to withdraw your consent for future data processing at any time. Because EudoSpace's automated evaluation and scoring tools inherently rely on AI algorithms, opting out of AI processing requires refraining from utilizing those specific AI evaluation modules or requesting account deactivation.
8.3. European Economic Area (GDPR) Specific Provisions
If you reside within the European Union or European Economic Area, you enjoy statutory rights under Articles 15 through 22 of the GDPR, including the right to lodge a formal complaint with your local Data Protection Supervisory Authority if you believe our data processing infringes applicable law.
8.4. California Residents (CCPA / CPRA) Disclosures
Pursuant to the California Consumer Privacy Act and the California Privacy Rights Act:
- "Do Not Sell or Share My Personal Information": EudoSpace does not sell your personal information and has not sold personal information in the preceding 12 months.
- Right to Non-Discrimination: We will not discriminate against you (in pricing, access, or quality of service) for exercising any of your statutory CCPA/CPRA rights.
8.5. Vietnam Personal Data Protection Decree (Decree No. 13/2023/ND-CP)
In accordance with Vietnamese law, EudoSpace recognizes and implements all statutory obligations governing the protection of personal data:
- Data Classification: We classify your account information, academic metrics, and device logs as Basic Personal Data (dữ liệu cá nhân cơ bản). In alignment with Decree 13, customer voice recordings submitted for IELTS Speaking are treated as Sensitive Personal Data (dữ liệu cá nhân nhạy cảm) subject to heightened organizational and technical protective safeguards.
- Roles & Responsibilities: EudoSpace acts as both the Personal Data Controller and Personal Data Processor (Bên Kiểm soát và Xử lý dữ liệu cá nhân), upholding all obligations to safeguard data integrity and respect data subject rights (right to know, right to consent, right to delete, right to restrict processing, right to claim damages).
- Cross-Border Data Transfer: Where personal data is transferred across borders to international cloud providers (such as Supabase or Vercel servers located in Singapore or the United States), such transfers comply with statutory impact assessment requirements and international security standards.
9. CHILDREN'S PRIVACY (COPPA & VIETNAMESE LAW ON CHILDREN)
EudoSpace is designed for high school students, university students, and independent adult learners. We do not knowingly solicit, collect, or process personal data from children under the age of 13 (or under 16 where required by European or Vietnamese laws) without verified parental, guardian, or educational institution authorization.
If we discover that a minor under 13 has provided personal information without verifiable parental consent, we will promptly execute an immediate purge of the account, credentials, and associated data from our servers. Parents or legal guardians who become aware of an unauthorized minor registration are urged to notify us immediately at equilbyte@gmail.com.
10. DATA SECURITY & INCIDENT NOTIFICATION
We employ multi-layered technical, administrative, and physical safeguards designed to protect your personal data from unauthorized access, accidental alteration, disclosure, or destruction:
- Encryption in Transit: All communications between your client device and our servers are encrypted using modern Transport Layer Security (TLS 1.3 / SSL) cryptographic protocols.
- Encryption at Rest: Core relational databases, backups, and cloud storage volumes are protected with industry-standard AES-256 bit encryption.
- Granular Access Control: Strict PostgreSQL Row-Level Security (RLS) ensures that students can access only their own private records, with zero inter-tenant data leakage.
- 72-Hour Data Breach Protocol: In the highly improbable event of a confirmed security compromise or data breach that affects your personal data, EudoSpace will initiate an incident response protocol, notify affected users, and report the occurrence to relevant regulatory authorities within 72 hours of verification, in accordance with GDPR and Decree 13/2023/ND-CP guidelines.
11. CONTACT INFORMATION & POLICY UPDATES
We reserve the right to revise or update this Privacy Policy periodically to reflect technological advancements, new platform functionalities, or evolving statutory mandates. When substantive modifications are enacted, we will update the "Last Updated" timestamp at the top of this page and post a prominent notice on the platform interface. Continued usage of EudoSpace following notice of revisions constitutes your acceptance of the updated terms.
If you have any questions, inquiries, requests to exercise your data subject rights, or privacy-related concerns, please contact our Data Protection Officer directly:
