Privacy Policy
Last updated: 18 October 2026
Brainschool is a learning platform used by children, their parents, their teachers and their schools. This policy describes what we collect, why, who can see it, and what you can ask us to do with it. It describes the product as it actually works today.
Who is responsible for your data
The owner of the personal data processed on Brainschool, in the sense of the Law of Ukraine "On Personal Data Protection", is ФОП Мостова Оксана Геннадіївна, taxpayer number 2737410101, бульвар Вацлава Гавела, 6, кв. 7, м. Київ, 03067. Questions and requests about your data go to support@mg.brainschool.top.
What we collect
When an account is created we collect an email address, a name, a school grade and, optionally, a date of birth and a profile picture. As the platform is used we store what it needs to teach: answers to exercises, attempts, progress, exam results, and the topics a student finds difficult. We store messages exchanged with the AI tutor. We keep ordinary server logs, which include IP addresses. If a plan is paid for, we keep the payment record: the plan, the amount, the date and its status. The card itself is entered on monobank’s payment page; we never receive the card number.
Why, and on what basis
We process personal data with the consent of the person it is about — given when the account is created, and for a child by a parent or by the school that enrolled them — and to perform the agreement under which a plan is bought (the Public Offer). Payment records are also kept because accounting and tax law require it. Consent can be withdrawn at any time, as described under “Your rights”; what the agreement or the law requires us to keep stays for as long as they require it.
Profile pictures
An uploaded picture is re-encoded before it is stored. Nothing of the original file survives: the orientation is baked into the pixels and every other piece of embedded data — camera model, timestamp, and the GPS coordinates a phone writes into a photograph taken at home — is discarded. What we keep is a small JPEG whose bytes we wrote ourselves.
Homework photographs
A photograph of a homework problem is sent to our AI provider to be read, and the review comes back to the student. We do not store the photograph. It is held in memory for the length of the request and discarded; what remains is the text of the review.
The AI tutor
The tutor is built on models operated by Anthropic. The content of a conversation, and the exercise a question is about, are sent to Anthropic to produce an answer. The tutor is instructed to answer school-subject questions only and to refuse anything else. We measure how many tokens each account uses, to control cost and to enforce plan limits.
Who can see a child’s data
A student’s learning data is visible to the student, to a parent who has been linked to that student through an invitation the student or parent accepted, to the teacher of a classroom the student has joined, and to the lead of the school that classroom belongs to. It is not visible to other students, and it is not visible to teachers of classrooms the student has not joined.
Where the data lives
Brainschool runs on brainschool.top. Its servers are in the European Union (IONOS SE, Spain), and that is where the database and its backups are stored. Some processing happens outside Ukraine and the EU — see the next section.
Who else processes data for us
Anthropic, PBC (USA) — the AI tutor, homework review and generated exercises. Mailgun Technologies, Inc., on its EU servers — account emails such as password resets and reports to parents. IONOS SE (Spain) — hosting. monobank (JSC UNIVERSAL BANK, Ukraine) — card payments. Sending a conversation to Anthropic in the USA is a transfer of data abroad: it happens on the consent described above, and for a child only once that consent is in place. We do not sell personal data, and we do not use it for advertising.
How long we keep it
Account and learning data is kept while the account exists. The rest expires on a schedule: conversations with the tutor after two years, homework reviews after one, notifications after six months, and the individual usage records behind our statistics after one year. An account that goes unused for three years is closed and its personal details removed — we write to it a month beforehand, and signing in is enough to keep it. Backups are encrypted and kept on the server for a week, so data can survive in a backup for up to a week after it is deleted. Payment records are kept for as long as accounting law requires, even after the account is deleted.
Cookies
The site stores one cookie, `bs_lang`, which remembers the language you chose so the next page is served in it. We use no analytics, advertising or tracking cookies, and no third-party scripts run on the site. The platform itself keeps your session in your browser's local storage rather than in a cookie.
Security
Traffic is served over HTTPS only. Passwords are stored hashed, never in readable form. Backups are encrypted. Administrative access to the platform is limited to staff accounts and is logged.
Your rights
You can view and correct the data on a profile from the settings page at any time, and export or delete the account from there too. A parent linked to a child does the same for that child from the child’s page: download everything the platform holds about them, delete the account, or withdraw the consent given for the features that send a child’s words out of the platform — the AI tutor, the photo check and generated exercises stop, the conversations held under it are deleted, and everything the child learns with carries on. You can also write to the address below. Deleting an account removes it from the live platform; backups already taken are removed as they rotate out. Under the Law of Ukraine "On Personal Data Protection" you can also ask what data we hold about you, where it came from, why we process it and who it is shared with; object to its processing; and have inaccurate or unlawfully processed data corrected or deleted. We answer within 30 calendar days. If you think your data has been handled unlawfully, you can complain to the Ukrainian Parliament Commissioner for Human Rights or go to court.
Contact
Write to support@mg.brainschool.top with any question about this policy, or to make a request about your data or your child’s data. By post: ФОП Мостова Оксана Геннадіївна, бульвар Вацлава Гавела, 6, кв. 7, м. Київ, 03067.
Changes to this policy
If we change what we collect or who we share it with, we update this page and the date at the top of it. Where a change materially affects children’s data, we notify the account holder by email rather than relying on this page alone.
