Edukamentas Privacy Policy

Effective date: 1 October 2026

MB “Uncascade”, company registration number 307057505, trading as “Edukamentas” (referred to below as “Edukamentas” or “we”), is the controller of your personal data where it determines the purposes and means of processing in connection with the edukamentas.lt website, mobile app and its other services (the Services). This policy explains what data we collect, why, how long we keep it, who receives it, and your rights and how to exercise them.

Contact: [email protected]

A clear overview

• We process your data to provide the Service and maintain security, technical stability and quality. Usage events from our website and mobile app may be linked to your Account; separate Umami analytics, when enabled, is used for aggregate website signals, while GA4 is enabled only with your consent.

• Schools are separate controllers for their educational and administrative purposes. Children under 14 cannot register independently. Access may be provided by parents/guardians, or by a school where this access method has been agreed with it and each processing purpose has an appropriate legal basis.

• AI services, including handwriting extraction from images or PDFs in the writing tools, are used only when you use the relevant features.

• We keep data for as long as necessary to provide the Services, maintain security, pursue legitimate interests and meet applicable legal obligations.

• Where a provider may process data outside the EU/EEA, we apply the transfer safeguards required by the GDPR.

• You can exercise your rights by email or through your account settings.

1. Roles and scope

Edukamentas as controller: where it determines its own purposes for personal accounts, payments and subscriptions, fraud and abuse prevention, platform security, legal compliance, or operating and improving its product. This may include an organisation-provided account, but the organisation's decision to assign a student access is not a legal basis for all of Edukamentas's independent purposes.

Schools and other institutions: act as separate controllers for their educational, administrative and organisational purposes. They decide who receives access, what necessary data is provided for the account, and how results or reports visible to their community are used; they establish the legal basis for their processing according to their status and activities. Where we process particular school data solely on its documented instructions, we act as a processor under the applicable agreement. A school and MB “Uncascade” do not become joint controllers merely by using the platform. A particular school's conditions of use may also be set out in a pilot agreement, order form or other institutional agreement. More information is available in the GDPR information notice for schools and end users.

Our service providers: hosting, communications, payments, analytics, support, translation and AI providers. Where they process data on our behalf, we apply the relevant contractual data protection terms. The current public list is available at /subpro.

This policy applies to all users: students, teachers, parents/guardians and administrators, as well as people who register for beta programmes, try pilot features or use community features.

2. Personal data we collect

The extent of the data processed depends on how you use the Services, for example whether you register independently or through a school, or use the mobile app, community features, a subscription or a beta programme.

Personal scratch notes containing text, mathematics or drawings on a lesson page are stored in your browser's local storage. Simply writing them does not save them in our database; they may disappear if you clear browser data or change devices. This differs from teacher notes saved to a lesson in an account and slide speaker notes, which are stored in our database.

Sources: the user, the School (invitation lists and minimum registration data), and events generated by the Service.

3. Processing purposes and legal bases

Personal access and providing the Service: where the data subject is themselves a party to a contract with Edukamentas, processing objectively necessary for the account, sign-in, content, assignments, progress and support is based on performance of a contract (GDPR 6(1)(b)). For minors, we separately take account of the legal representative's role under civil law. A parent/guardian's permission to create a child's account is not blanket GDPR consent for every processing purpose; where a particular additional purpose relies on consent (6(1)(a)), we request it separately in accordance with age and the law.

School-provided access: the school determines its own basis for processing for education, assigning access and school reports according to its status and activities, and supplies only necessary account data. For a public school's public task or legal obligation, 6(1)(e) or 6(1)(c) may be relevant where applicable; the appropriate basis for another organisation is assessed in its particular circumstances. The school's contract with Edukamentas is not, in itself, the student's contract under 6(1)(b), and school assignment is not parental/guardian consent. When we process on the school's instructions for its purposes, we rely on its established basis and the applicable data processing agreement; when we determine our own limited purposes for account administration, platform security, support or legal obligations, we act as a separate controller with our own appropriate basis for the purpose, normally legitimate interests (6(1)(f)), after assessing necessity and the child's rights, or a legal obligation (6(1)(c)).

Displaying progress within a family: we show the manager of a family-plan seat a summary of the recipient student's account learning progress, results and activity, so the family can follow learning and manage the access provided. If the student uses the same account at school, the summary also reflects school activity. Edukamentas bases this display on its and the family-plan manager's legitimate interests in providing family access and supporting the student's learning (GDPR 6(1)(f)), taking account of the student's age, the scope of data, their interests and the option to end access from age 14. Accepting a family seat is not blanket GDPR consent for all data uses. Separate progress access for a parent/guardian, unrelated to a family seat and chosen by a student aged 14 or over, is based on the student's consent (6(1)(a)); it can be withdrawn without losing paid access. For a younger child, we take account of the access provided by the legal representative and the basis for the specific processing. The school's educational basis does not, in itself, become the basis for our independent display of progress to a family.

The performance-of-contract basis, 6(1)(b) mentioned below in this section applies only where the data subject is themselves a party to the relevant contract. It does not automatically apply to a student merely because the school bought the Service. Processing for the same feature on behalf of a school is subject to its established basis and, where we are a processor, its documented instructions; our independent purposes require the separately specified appropriate basis.

Writing tools, handwriting extraction and automatic feedback: when you upload a handwriting image or PDF, the attachment may be processed temporarily to extract text, establish page order and prepare a writing review. The legal bases are providing the Service under a contract (6(1)(b)) and our legitimate interests in feature quality, security and error correction (6(1)(f)).

Robot Teacher document scanning: the pages you select from an uploaded image or PDF are processed to extract text and other information needed for a response. The legal basis is providing the Service under a contract (6(1)(b)); processing needed for feature security and error correction is based on our legitimate interests (6(1)(f)).

Slides, teacher notes and exports: when you create, save, generate or export slide decks, we process slide content, teacher notes, comments, images, links, interactive embeds, sharing settings and technical export data to provide editing, storage, sharing and export features. The legal bases are providing the Service under a contract (6(1)(b)) and our legitimate interests in feature security, integrity, error correction and dispute resolution (6(1)(f)).

Security, abuse prevention and Service stability (access control, security and system logs, incident investigation, technical error detection, and activity records needed for motivational and engagement features): the primary legal basis is legitimate interests (GDPR 6(1)(f)), and, where necessary to provide the Service or meet a legal obligation, also performance of a contract (6(1)(b)) and/or a legal obligation (6(1)(c)). This data is not used for unrelated monitoring or advertising profiling.

Service improvement, error correction and quality assurance: necessary technical and support data is processed on the basis of legitimate interests in a reliable and secure Service (GDPR 6(1)(f)), after assessing necessity, proportionality and users' rights. Processing objectively necessary to provide a selected feature may rely on performance of a contract (6(1)(b)). Additional beta research purposes and bases are described in subsection 3.1.

Mobile app operation and improvement: we use account-linked sign-in, session duration, screen, search, learning, subscription and notification interaction signals to provide the Service, maintain security and app reliability, deploy versions and assess usage trends. The legal bases are performance of a contract (6(1)(b)) and legitimate interests in operating, securing and improving the product (6(1)(f)). We do not create advertising profiles, track users across other apps, collect precise location, or use a persistent first-party analytics identifier before sign-in.

Our website usage analytics: our systems record visit, learning, search, subscription-page and invitation interaction events to understand feature use, fix problems and assess product performance. Signed-in records may be linked to the Account and may contain the event time, page, action type and limited technical data. Server-recorded events are based on our legitimate interests (6(1)(f)), after assessing the necessity of the data collected and users' rights. Additional first-party account analytics events recorded by website browser code are sent only with your consent (6(1)(a)); the temporary transmission queue used for this is described separately in section 7. This analytics stream is separate from Umami and Google Analytics 4 and is not used for advertising profiles or automated decisions about student achievement.

Opted-in learning reminders: if you enable this category of mobile notifications, their timing and content may be selected according to your learning or visiting rhythm, streaks, unfinished activities, chosen subjects and approaching goals; we also record which notification variant was sent and whether it was opened. The legal basis is your consent to receive these notifications (6(1)(a)); you can turn them off in notification settings.

Social and gamified features: the friends list may include both confirmed friends and members of the same active school group, even without a separate friend request. Subject to age, parent/guardian and blocking restrictions, fellow group members may see a profile, XP, badges, activity indicators, online status and last-active time; name, city and school visibility have separate profile settings. Providing a feature selected for a personal account is based, where applicable, on performance of a contract (6(1)(b)); security and abuse prevention are based on our legitimate interests (6(1)(f)). A school-provided account for a student under 14 does not, in itself, enable the Forum, friend requests, public profiles or rankings: these additional purposes require a separately established basis, clear information and age-appropriate restrictions.

Processing by a school for its educational and administrative purposes has a legal basis determined by the school as a separate controller. This policy does not change that.

High-level cookieless traffic analytics (for example, Umami Cloud EU, if enabled): the legal basis is legitimate interests (6(1)(f)); it is used only for aggregate analysis of visits, page performance, sources, device categories and conversion trends, without analytics cookies or linking this data to your account. We may use aggregate account-type, access-status and plan categories for analysis, but do not send an account ID, email or other persistent identifier. We do not use this analytics for advertising profiles, third-party audiences or assessment of a student's learning results.

Analytics cookies / GA4: the legal basis is consent (6(1)(a)); they operate only after explicit consent.

Service messages: we send information about Account security, access, orders and important Service or document changes to the extent necessary to provide the Service (6(1)(b)), pursue our legitimate interest in informing users (6(1)(f)) or meet a legal obligation (6(1)(c)). These messages do not depend on newsletter preferences.

Promotional newsletters and other marketing messages: the legal basis is consent (6(1)(a)). A message's content and purpose determine its nature, not merely the fact that it is sent by email. We do not market to people under 14 or those who have opted out of marketing messages.

Offers displayed on the website: on the basis of our legitimate interests in selecting and testing offers (6(1)(f)), we may use visit timing, limited session signals such as first-visit and return times, and a randomly assigned offer variant, but we do not use learning results or the content of users' work for this purpose.

Accounting and legal compliance: the legal basis is a legal obligation (6(1)(c)).

3.1. Beta and pilot programme purposes

Free or discounted beta access may be provided in return for agreed testing participation, such as trying features, questionnaires, bug reports, examples or conversations with the team. Before participation, we explain the particular programme's purposes, the data collected, its uses and retention conditions. Not every programme includes every activity listed below.

The individual beta registration form separately asks you to confirm contact about the application and participation, the use of beta feature usage data and submitted feedback to test and improve those features, and acceptance of the beta terms. These confirmations do not permit unrestricted use of data for any future research, recording a separate interview or publishing an identifiable testimonial. School participation is governed by school agreements, not this individual form.

Legal bases by activity. Registration for an agreed trial, providing access, agreed testing activities and necessary service messages are based on performance of a contract (6(1)(b)) only to the extent objectively necessary for that contract. Technical quality checks, error investigation, support, security and limited agreement or permission records may rely on legitimate interests (6(1)(f)), after a necessity and balancing assessment; we pay particular attention to minors' rights. Legal obligations are met under 6(1)(c). These bases are not interchangeable merely to continue a use after a participant withdraws consent.

Optional research and additional uses. Where a separate study, interview recording, broader analysis of identifiable work or publication of an identifiable testimonial relies on consent (6(1)(a)), we request a separate, specific and freely given choice. A particular scientific study's basis, methodology and safeguards are set out in its notice; calling something “scientific research” does not establish a legal basis. General acceptance of the beta terms does not cover undefined future studies or any and all data uses.

Choice and free access. If you decline objectively necessary agreed testing activities, that particular trial or the extra free access provided for it may end. Refusing optional additional data use or withdrawing that consent does not, in itself, remove a purchased plan or other access independent of that use. Participation terms explain what is necessary for the trial and what is optional.

Anonymous findings and presentations. We may use irreversibly anonymous findings, summaries and examples prepared from data lawfully processed for that purpose for research, product improvement, support, school communications and commercial presentations. Participation in beta alone does not permit us to sell or publish named student work or identifiable results. Separate rights apply to use of a school's name, logo or confidential information. Service communications about a pilot are not general permission for direct marketing, which is subject to sections 7 and 12.

Where we process particular data on a school's behalf as a processor, its use depends on lawful documented instructions and the applicable agreement. This list of purposes does not expand previous consent or school instructions. Before a new incompatible purpose, we assess the legal basis and provide information; where necessary, we obtain new consent.

4. Sharing data with recipients

Apple purchases. Apple administers App Store payments under its own privacy information. Edukamentas receives the transaction data needed to verify a purchase, provide and restore access and update its validity, and links it to your Edukamentas account using a technical identifier. This processing is necessary to provide the purchased Service (GDPR 6(1)(b)); fraud prevention and particular disputes rely on legitimate interests (6(1)(f)), and accounting obligations on 6(1)(c). We do not receive your Apple account password or full payment card number. Website and Apple purchase-channel data may differ; payment records have separate rules for accounting, access verification and disputes.

Referrals and subscription credit: when you open a personal invitation link, we retain a limited first-referral intent in the session for up to 30 days. If you create a new account through it, we keep invitation-link data, the relationship between the inviting and invited accounts, email verification and reward status, and records needed to calculate credit and prevent abuse. We may show the inviter limited joining and reward status, but not your payment details. We pass the payment provider only information needed to apply credit, not the invitation link or the invited person's name. We may retain financial accounting and dispute records for as long as necessary for legal obligations and particular claims, even if the referral relationship is later removed.

To a school as a separate controller: summaries and named indicators for educational purposes, through the organisation dashboard or exports on request. A parent/guardian may see student progress when given separate access or when the student receives a seat in their family plan. The end of payment alone does not remove an already assigned family seat or separate parental access. If a student uses the same account at school, the family summary may reflect school activity. When a student aged 14 or over leaves a family-plan seat, we stop showing that student's progress to the seat manager in the Edukamentas family area and end that manager's separate access there too. Other parents'/guardians' separate access is managed independently. The student loses the paid content provided through the seat they left, but their account and work remain.

To other users: community posts and social-profile data are visible according to the particular feature, group membership, profile, age and parent/guardian settings, and blocking restrictions. Members of a shared school group may be treated as friends without a separate invitation, so online status or last-active time may be shown to them.

To service providers: Hetzner (EU) for hosting; Google Workspace for email/documents; Cloudflare for website operation and protection; Sentry for error and outage monitoring; Umami Cloud EU for aggregate cookieless website analytics, if enabled; Google Analytics 4 for analytics with consent only; Stripe for payments; DeepL for translation when used; OpenAI / OpenRouter / Google Cloud, including Gemini services, for AI features, writing tools, automatic feedback and document scanning; Google Firebase Cloud Messaging (FCM) / Google Cloud for mobile notification delivery when that feature is used. The Crisp integration is disabled for new support chats and account data transfers. Any earlier conversations or other personal data remaining there are also subject to the retention criteria in section 6 and your rights. We publish provider information in the subprocessor list. We update material changes that significantly affect school or other institutional data there and, where appropriate, notify the school's designated contact.

To authorities: where required by law or necessary to defend rights.

We do not sell data.

5. International transfers

We prioritise processing in the EU/EEA. If a provider may involve transfer outside the EU/EEA, such as for certain AI, security or analytics features, we rely on applicable transfer mechanisms, such as the European Commission's standard contractual clauses, and assess additional measures needed in the particular case.

6. Retention periods

Accounts and saved learning history. While you use your Account, we do not automatically delete saved work, results, Robot Teacher conversations, slide decks or other learning objects available in the account solely because of their age. We may automatically delete an account and its associated personal learning history if you have neither signed in to the website nor used the mobile app while signed in for three years, the Account no longer has a personal subscription or organisation access, and deletion can be performed safely and automatically.

Notice before deletion. Before automatic deletion, we notify you by email at least 31 days in advance and state the planned deletion date. Signing in to the website or using the mobile app while signed in during that period cancels deletion and restarts the inactivity period. We confirm deletion of the Account by email afterwards.

When the period starts. The three-year period runs from the later of the last website sign-in and last authenticated mobile app use; if neither occurred, it runs from Account creation. A message we send, a staff review or a school data change alone does not restart the period.

When automatic cleanup does not apply. Automatic deletion does not apply while a personal subscription, including an Apple purchase, or active paid or trial organisation access remains valid, even if a particular user has not signed in for three years. We do not automatically delete staff, administrator, moderator or other specially privileged accounts; their owners may request account deletion by email under section 11. Accounts with an unfinished payment, a family or parent/child relationship, a financial record or another dependency that cannot safely be handled automatically are not deleted automatically; deletion may be requested by email under section 11. Cleanup runs periodically, so no specific deletion date is guaranteed. Records needed for accounting, a dispute, lawful school instructions or another legal obligation may be retained separately only to the extent and for the time necessary.

The age of your work is not a deletion deadline. Work saved in grade seven does not disappear merely because it is old if you continue using the Account through grade twelve. Saved objects may be deleted at your request, through a product deletion feature, after the Account inactivity period described here, or where required by law or an applicable school agreement. Temporary processing files and technical or security logs are not saved learning objects and have the separate periods below.

Activity, security and system records: kept for as long as necessary for Service security, abuse prevention, incident investigation and traceability, but no longer than 3 years unless a particular dispute or legal obligation requires longer retention.

Our website and mobile app usage analytics: account-linked usage events, session duration and screen-view data are kept in our systems for a rolling period of no more than 3 years. When an Account is deleted, detailed events linked directly or by a technical code to the Account, together with user analytics summaries, are deleted with it; removing the direct Account link alone is not treated as anonymisation. Older events, sessions and installation codes are deleted periodically. Only genuinely anonymous aggregate summaries and separate records needed for another lawful purpose, such as accounting or a particular security incident, may remain. Aggregate Apple and Google store reports are not account-linked, but are also kept for no more than 3 years.

Community content (such as forum threads, posts, comments, replies and content reports): kept while an account is active or until content is removed, anonymised or deleted under the applicable moderation and deletion process. If content is part of a discussion, anonymisation may replace removal where needed for discussion integrity, security, a dispute or lawful archival record-keeping.

Saved user work: slide decks, their speaker notes and comments, teacher notes saved server-side to lessons, lesson plans, work and other learning history have no separate deletion deadline based on creation date. We keep them while the relevant account or organisation context is active, until removal at your request or through a dedicated Service feature, or until the three-year inactivity cleanup above applies, subject to the contract and law. Local slide-editor drafts may remain only in the browser until saved to the server. Our server retention period does not apply to lesson scratch notes stored only in the browser. When an object is deleted through self-service, copies may remain for a limited time in backups or records needed for a particular dispute, security purpose or legal obligation.

Support requests, conversation history and related attachments: kept while a request is being handled and afterwards for as long as needed to follow up the same issue, assess service quality or resolve a particular dispute, security incident or legal claim. Once these needs end, records are deleted or anonymised. An email or attachment being in an archive is not, by itself, a reason for unlimited retention.

Writing-tool history and extracted text: submitted writing, AI review results, text extracted from handwriting or PDFs and page-order context may be retained in account history as needed to provide the feature, display the review, address disputes or support issues, and under applicable product settings. Where an attachment is used only to extract text, raw image or PDF files are not intended for long-term Edukamentas storage; they are processed temporarily and technical temporary files are removed as part of system operation.

Robot Teacher documents and conversations: an uploaded original file is kept only for the short period needed for scanning; extracted page text and analysis are stored in a separate encrypted document record for up to 7 days and then deleted. The conversation is stored separately in Account history: your question, the Robot Teacher's response and a reference to the document pages used remain until you delete the conversation or the Account is deleted. Document extracts included in a question or answer may also remain in the conversation text. After 7 days, the full original document text is not automatically reconstructed in the conversation. The 7-day period therefore does not apply to conversation history itself.

Beta registration, beta feature and pilot programme data. Beta work and conversations saved in an account follow the same active-Account and three-year inactivity rule as other saved learning history; they are not deleted merely because a particular record is old. Identifiable examples, recordings and transcripts separately retained for research, quality assessment or programme records undergo a review of necessity for their purpose. We normally delete or irreversibly anonymise them when their purpose ends or three years have passed since the participant's own last website sign-in, authenticated mobile app use or, if they have no account, trial participation. Staff reviews, exports or archiving do not restart this period. Selected records may be needed longer for continuing multi-school-year research or verification of its findings, a defined AI quality comparison and error retesting, an unresolved support request, an ongoing school agreement, evidence of consent or access provided, or investigation of a security incident, complaint or legal claim. In each case we establish the purpose, legal basis, necessity, scope of retained data and next review or deletion date or clear triggering event. Once the need ends, we delete or anonymise the data without waiting three years. For scientific research, where applicable, we observe GDPR Article 89 safeguards. More specific criteria are set out in the particular study's notice or applicable agreement.

Beta copies and anonymous findings. Beta applications, participation and consent history, survey answers and copies retained for research or quality assessment are separate records; closing an Account alone does not automatically remove them. They undergo the necessity review and normal three-year participant inactivity rule above, with the listed exceptions. Before deleting old beta usage events, we may retain a programme results report. It contains a code linkable to the participant, so it remains personal data while the connection can be established; absence of a name alone does not make it an anonymous summary. Copying or archiving does not change the participant's last-active date. Irreversibly anonymous findings, statistics and examples may be kept indefinitely for the purposes in subsection 3.1. Backups are deleted under a reasonable backup cycle and are not used for routine analysis after the originals are deleted. Data processed on a school's behalf is subject to the relevant instructions and agreements.

Accounting documents: 10 years.

Analytics data (for example, GA4): kept as long as necessary for analytics purposes under applicable settings. Longer retention is limited to aggregate, anonymised statistical data from which a particular person can no longer be identified.

7. Cookies and analytics

Essential cookies and similar technologies: used for Service operation, sign-in, sessions, security, consent management and, where applicable, support chat functionality.

Information stored in your browser: this may include sign-in and security data, analytics preferences, interface settings and lesson drafts remaining only on that device. These are not work saved in our systems. If you consent to account analytics, usage events not yet transmitted may remain temporarily in the browser. On your next visit, we remove events older than 7 days; if you do not return, local data may remain until browser data is cleared. When analytics consent is withdrawn, we delete these local events and stop sending new ones. Clearing browser data may remove local drafts and preferences, but does not, in itself, delete data already in our systems.

Events stored in our systems: usage events recorded server-side and transmitted from the browser with consent may be linked to your Account; both types follow the retention period in section 6. Withdrawing analytics consent stops new browser events; for data already stored, you may contact us under section 11. You may object to server records based on legitimate interests; we will assess the objection under the GDPR.

Cookieless analytics: we may use privacy-conscious cookieless analytics, such as Umami Cloud EU, to measure overall traffic, popular pages, sources, device categories and conversion trends. It does not use analytics cookies, is not linked to your account and is not used for advertising profiles or assessment of a student's learning results.

Analytics cookies and analytics: Google Analytics 4 is loaded only after explicit consent in the cookie banner. If you decline or later withdraw consent through footer cookie settings, GA4 is not loaded and previously set _ga cookies are removed from the browser as far as technically possible.

Mobile app analytics: after sign-in we record account-linked usage events and sessions: duration, screens opened, search, learning, subscription and notification interactions, a separate app-installation code, platform, app version and time. From Apple and Google, we receive only aggregate download, installation, uninstallation and usage reports, which we do not link to particular accounts.

We do not market to people under 14 or those who have opted out of marketing messages.

8. AI features

AI features are used for task generation, explanations, summaries, writing feedback, automatic assessment signals, handwriting or document scanning and similar functions.

Data minimisation: we normally do not send direct identifiers, such as first name, surname or email, in AI requests unless required for a particular feature or supplied by the user in a request, free-text field or uploaded content. Please do not submit unnecessary personal data in AI fields.

Writing tools and text recognition: if you upload an image or PDF to a writing tool, its content may be sent to the selected AI service to recognise text, determine page order, prepare structured context and provide feedback. Edukamentas retains the text, page context, review results and technical history needed for the feature for the periods in this document, rather than keeping the raw attachment long term.

Slide generation: if you use AI slide creation or editing, your slide request, linked study-set or lesson context, slide text, teacher notes or other information necessary for the slide feature may be sent to the AI service. This data is used to prepare a slide draft or editing result, not for advertising profiling.

Providers and transfers: we use selected providers such as OpenAI, OpenRouter or Google Cloud, including Gemini services, for AI features. The provider depends on the feature, plan, availability, model chain and technical configuration. We prefer an EU/EEA region where available; otherwise, we apply the transfer safeguards described in section 5.

Retention: technical logs for non-beta AI features are kept for no more than 3 years unless longer retention is necessary for security, a dispute or a legal obligation. Saved AI work, beta records and separate research copies follow the different rules in section 6 and the Beta Programme Terms.

Non-beta features: where a non-beta feature saves your content or history, such as writing-tool history, it is retained so you can view and use it in your account and is not used to train AI models. If you submit feedback or a support request about a non-beta feature, we may use that information for product quality assurance, error correction and feature improvement under the Terms of Service.

Transparency: AI feature use and the associated data use are explained to the user. AI features are optional unless a particular beta or product feature you select inherently operates only with AI.

9. Children's privacy

The Services are aimed at students in grades 7–12, and the subject selection is expanded in stages.

Independent registration: is not intended for people under 14. If a user supplies a date of birth indicating they are 14 or older, we normally accept it as correct unless we have reasonable grounds to believe otherwise.

School use: where a school or another educational organisation has an agreed access method for students under 14, it may assign that access on an appropriate basis for providing necessary student data and access. Ordinary independent registration and an organisation invitation code are not this method. A teacher's or administrator's invitation does not replace parental/guardian consent where separately required. The school explains its own basis, while our independent processing bases are set out in section 3. When school access ends, a younger child's account does not automatically become an independent personal account.

Ages 14–17: may give or withdraw GDPR consent themselves in cases covered by GDPR Article 8 and Lithuania's age threshold of 14. Turning 14 does not automatically end a previously lawfully assigned family seat or parental/guardian payment, nor the parent's/guardian's right to represent the child under civil law. A child aged 14 or over personally confirms new separate parental/guardian access and a new family-plan seat. If the child no longer wants the family-plan manager to see their progress, they may leave the seat; the same manager's separate progress access also ends. Other GDPR consent is managed separately, and withdrawal ends the data use based on it. The child may contact us about their data.

At age 18, parents/guardians no longer act as the user's representatives solely because of the earlier family relationship. A previously assigned family-plan seat or separate progress access does not automatically disappear: the adult user may leave the seat or revoke separate access themselves so its manager can no longer see progress in the Edukamentas family area. Another person paying for a subscription alone does not give them new access to an adult user's progress.

Children under 14 cannot register independently. A parent/guardian may provide personal access through the family model by confirming their representative status, account linking and the progress visible to them. If a school has a separate access method for younger students, it may provide only the learning access it manages under its order and applicable legal basis. In each case, the processing basis is established according to purpose and roles; neither creation of a family account nor school assignment means unrestricted consent to use a child's data. If we learn that a younger child is using the Service without one of these routes and the necessary basis, we may restrict or remove access under applicable law.

Students may choose not to participate in a trial programme by not registering on the portal.

10. Security and organisational measures

We apply measures supported by our technical configuration and working product. For example:

• we use one-time email links for sign-in, with backup sign-in codes valid for a limited time;

• sign-in and registration flows have request limits, and certain forms use Cloudflare Turnstile anti-bot checks;

• the website and related traffic use HTTPS/TLS;

• the website has a Content Security Policy (CSP) restricting permitted script, connection and embed sources;

• we make backups for business continuity and recovery;

• school/organisation dashboard access is limited to active members according to their role and specific permissions.

No technical measure guarantees absolute security. If we identify a personal data breach requiring notification by law, we will act under the applicable GDPR and other legal requirements.

11. Your rights

You have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent where we rely on it. You can withdraw analytics consent through footer cookie settings, change notification preferences in their settings, and, from age 14, revoke separately granted parental/guardian progress access on the family account page. You may also write to us about any consent. Leaving a family-plan seat is not withdrawal of GDPR consent: from age 14, you may leave it on the family account page, ending the paid access it provides and progress display to its manager. You may object under GDPR Article 21 to processing based on our legitimate interests; we will consider the particular circumstances.

Account deletion. When we can fulfil a verified Account deletion request, we also remove associated detailed website and mobile app usage events, user analytics summaries and persistent account codes used for that analytics, without waiting for the general three-year analytics period to end. We assess separate beta applications, participation and consent history, survey answers and archived reports in light of the request and the purposes in section 6; Account deletion alone does not make them anonymous. Once there is no necessary purpose or lawful retention basis, we delete or irreversibly anonymise personal data without undue delay. Where the GDPR permits and requires some records to be retained for a particular legal obligation, dispute, security incident, lawfully conducted study or school instruction, we retain only what is necessary for that purpose. Removing names alone is not anonymisation if a record can still be linked to you.

You may complain to the State Data Protection Inspectorate, L. Sapiegos g. 17, LT-10312 Vilnius, www.vdai.lrv.lt.

Data copies and export. To request a copy of available account data, learning history or your work, write to [email protected]. A school representative may also contact [email protected]. After verifying identity and authority, we provide remaining data you are entitled to receive under the applicable agreement and law, while protecting others' data. Where data portability applies, we use a commonly used machine-readable format. We respond to statutory requests within the required periods; the first copy of personal data is free to the extent required by law. We do not have to reconstruct data lawfully and permanently deleted before the request. Receiving a request does not justify deleting data still held and needed to fulfil it in order to avoid providing it.

We respond to GDPR requests without undue delay and no later than one month after receipt. If the GDPR permits an extension of up to two further months because of request complexity or volume, we inform you of the extension and reasons within the first month.

12. Communications and notifications

We send necessary service messages, including information about security, access, orders and important privacy or Service changes. These may use a newsletter format; a message's nature depends on its content and purpose, not its title. We may send such a message to a user under 14 or their legal representative where necessary for the Service they use; newsletter preferences do not prevent this. We do not send promotional offers, marketing newsletters or promotional mobile notifications to people under 14. Other users may opt out of marketing messages in the relevant settings.

13. Changes to this Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will inform you of material changes by publishing an updated version on the Website and/or by email. We recommend reviewing the policy regularly. The latest version will always state its effective date. Earlier versions are available on the Privacy Policy page. A new version does not, in itself, expand earlier consent or create a right to use data for a new incompatible purpose.

14. Contacts

MB “Uncascade” (Edukamentas) Email: [email protected] Partners/schools: [email protected]