Data Protection Policy

Where our Privacy Policy explains what data we collect and why, this Data Protection Policy explains, more concretely, how we actually protect it — the technical and organizational measures behind the promises.

1. Database-Level Access Control

Our database uses Row Level Security (RLS), enforced by PostgreSQL itself — not just checked in application code. This means a student's data is only ever returned to that student's own authenticated session, a teacher only ever sees data relevant to their own courses, and an admin's broader access is itself logged. This is enforced at the data layer, so even a bug in the application UI can't accidentally expose another person's record.

2. Encryption

• All data in transit between your browser and our servers is encrypted via HTTPS.
• Passwords are never stored in plain text — they're hashed using industry-standard methods.
• Sensitive files (like homework submissions) are stored in access-controlled storage, not public folders, and are served through short-lived signed URLs rather than permanent public links.

3. Payment Data

4. Access Auditing

Sensitive administrative actions — role changes, account suspensions, refund approvals, data exports — are recorded in an audit log, so there's always an accountable record of who did what and when.

5. Service Providers

We use a small, deliberate set of infrastructure providers: Supabase (database, authentication, storage), Vercel (hosting), Razorpay and Stripe (payments), Anthropic (AI Assistant), and Resend (email). Each is contractually and technically restricted to using your data only to provide their specific service to us.

6. Data Minimization

We collect what we need to run the Platform well, and avoid collecting data we have no genuine use for. Where a feature could work without a particular piece of personal data, we design it that way.

7. Breach Response

In the unlikely event of a data breach affecting your personal information, we will investigate promptly, take immediate steps to contain it, and notify affected users and relevant authorities as required by applicable law.

8. Staff Access

Internal access to student data is limited to what's needed for the relevant role — support, teaching, or administration — following the same principle as our RLS policies: access is scoped, not blanket.

9. Your Role in Data Protection

Use a strong, unique password, enable the security features available in Account Settings (like reviewing active sessions), and never share your login credentials — the strongest technical protections still depend on account-level security too.

10. Questions

For any question about how your data is protected, contact hidayetenglishacademy@gmail.com.

11. Testing & Development Practices

When we build and test new features, we use synthetic or clearly separated test data wherever possible rather than real student records, to reduce the exposure of genuine personal data during development.

12. Third-Party Security Standards

Our infrastructure providers are chosen partly for their own security posture: Supabase and Vercel both maintain independently audited security practices, and Razorpay and Stripe are both certified to the PCI-DSS standard required of payment processors handling card data.

13. Data Backups

Our database infrastructure includes regular automated backups, so that a technical failure doesn't put your learning history, certificates, or progress records at risk of being permanently lost.

14. Ongoing Review

As HEA grows and adds features, we review these protections regularly rather than treating them as a one-time setup — new functionality is built with the same row-level-security and least-privilege principles described above, not bolted on afterward.

15. Vendor Risk Management

Before adopting a new infrastructure or service provider, we consider their security track record and data-handling practices, favoring established providers with clear, published security commitments over untested alternatives, even where a newer option might be cheaper.

16. Physical Security

Because our infrastructure runs on managed cloud platforms (Supabase and Vercel) rather than our own physical servers, the physical security of the data centers hosting your information is handled by these providers' own enterprise-grade facilities, audited independently to standards well beyond what a small platform could maintain on its own hardware.

17. Data Protection Officer

Data protection matters are currently overseen directly by HEA's administration team through hidayetenglishacademy@gmail.com; as the Platform scales, a formally designated data protection contact will be published here.