Privacy Policy

1. Data controller

The controller of personal data is Aleksey Petrov, a natural person operating the CryptoEducationSchool project.

Contact for any data protection question and for exercising your rights: info@cryptoeducationschool.com.

If the project moves to a company or registered sole trader, the controller details in this section will be updated and you will be informed of the change.

2. Data we collect

Site forms. The waitlist form collects your name and email. The contact form collects your name, selected contact method, contact details, preferred callback time (for callback requests), and any message you choose to leave. Alongside these we store the originating page, the submission timestamp, and the fact and version of the consent text you agreed to.

Feedback after events. After a webinar, masterclass or intensive the school may send you a personal link to a short form. It collects a score from 1 to 10 and whatever answers you choose to give: your account of the event, what was unclear, what you have done since, what interests you next, and your goals. The answer is linked to your record in the school's contact file (section 3) and to the event. Your account of the event is published with your name only if you answered “Yes” to the publication question; answers about what was unclear and about your goals are seen by the school team only. The legal basis is the consent you tick in the form; you can withdraw permission to publish or ask us to delete your answer via the contact in section 1. Google Analytics and the Meta Pixel are not loaded on personal-link pages.

Technical data. Our server and hosting process your IP address, browser and device type, and request timestamps. This is required to operate the site, diagnose faults, and prevent abuse.

Measurement data. Only where you have given the matching consent: cookie identifiers, page views and on-site interactions, and approximate location derived from IP. Without consent these technologies are not loaded at all.

The site's forms accept neither payment details nor documents: they simply have no field for a card number, bank details, or identity papers. Payment happens away from this site, and the school records only the fact and the amount — see section 5.

3. The school's contact records (CRM)

Conversations with people who approach the school are kept in a closed set of records. A record holds: name, contact channels (email, phone, messengers, social profiles), language, city, occupation, the goal you came with, the state of the conversation, the team's working notes, the reason for a decline where there was one, and the dates we were in touch.

Some records were gathered before the school moved to this system — in the founder's personal correspondence. In August 2026 they were transferred into the record set with their content unchanged: what moved was the place of storage, not the amount or the meaning of the information.

The basis is the school's legitimate interest in keeping a history of the conversation, so that you are answered by someone who remembers the previous exchange rather than starting over each time.

The records are closed. Only the school's team has access; they are never published and are never passed to third parties for those parties' own purposes.

Marketing emails are not sent to these contacts without separate consent: a record on its own confers no right to mail you.

If you ask not to be contacted, the record is flagged and the contact stops. You may also object to processing based on legitimate interest — write to the contact in section 1.

4. Processing with artificial intelligence

The school uses language models for the team's internal assistant, for message drafts and for the morning task summary. The models are reached through the OpenRouter service.

The team assistant sees your data to the same extent as the team member working with it, according to that person's role: name and contact details, state of the conversation, the goal you came with, working notes, contact history, event registrations, feedback and learning progress. Payment details are visible only to the assistant of a team member with access to finances. For a message draft, the model receives a slice of the record: name, language, state of the conversation, segment, the goal you came with, and up to five of the most recent working notes.

All such requests go only through OpenRouter's European endpoint: the request is processed in the European Union and passed only to models running on servers in the EU. Requests and responses are not retained by the model providers and are not used to train them. OpenRouter itself is a company based in the United States; it keeps service data of the school's account (such as usage), but not the content of requests.

The school's founders use an AI agent. It runs on the school's own server in the European Union, sees your data no more widely than the team assistant, and reaches language models only through OpenRouter's European endpoint on the same terms. The agent reads the cabinet's data through a protected entry point only when the founders ask or on a schedule they set, within the team assistant's scope; every access is logged. At the founders' request it creates notes, tasks, reminders and drafts in the cabinet and stores files sent to it in the school's storage. The founders' conversations with the agent are kept on that server for no longer than 30 days; the server's backup copies hold them for up to 7 more days, after which the copies are overwritten. Actions that leave the cabinet or involve money (publications, mailings, advertising, opening registration, recording payments) are only prepared by the agent and carried out only after a founder confirms them.

The model publishes nothing, writes to no one and spends no money on its own: a team member reviews and sends every text meant for people; the agent makes small records in the cabinet only at a founder's direct request and reports each one. The school makes no automated decisions producing legal or similarly significant effects for you.

If you object to this processing, write to the contact in section 1 — we will flag your record, and the AI tools will stop seeing your data: the record, event registrations, feedback and learning data.

5. Payments and sales records

For each payment the school records the date, amount, currency, payment method, and the product paid for.

The basis is performance of the education contract and the school's accounting duties.

We do not store card numbers or card details, bank account details, crypto wallet addresses, account balances, or information about your transactions.

Payment records are not erased on an erasure request: the law requires them to be kept for a set period. The contact record is anonymised at that point, so the payment is no longer linked to your name.

6. Purposes and legal bases

Answering your enquiry and taking steps towards an education contract — basis: steps taken at your request prior to entering a contract.

Course launch emails and school materials — basis: your consent. Consent is given through a separate checkbox and can be withdrawn at any time, including via the link in every email.

Operating, securing, and stabilising the site — basis: our legitimate interest in protecting the service from faults and abuse.

Keeping a history of the conversation in the school's records, and preparing message drafts with language models — basis: our legitimate interest in holding a coherent conversation and answering to the point (sections 3 and 4).

Analytics and marketing measurement technologies — basis: your consent, given through the cookie banner.

Accounting and tax duties following a sale — basis: compliance with a legal obligation.

7. Cookies, analytics, and advertising pixels

Necessary technologies keep the site working and store your cookie choice. They do not require consent.

Analytics: Google Analytics (measurement ID G-X7ZGNGBSZH), provided by Google. Helps us understand which pages are read and where visitors drop off. Loaded only with consent in the "Analytics" category.

Marketing: Meta Pixel (ID 2251236635631457), provided by Meta. Used to measure advertising performance and build advertising audiences. Loaded only with consent in the "Marketing" category.

Before you make a choice, neither script executes and no requests are sent to Google or Meta. You can withdraw or change consent at any time through the "Cookie settings" link in the site footer; withdrawal applies going forward and does not undo processing that already took place.

8. Social media advertising audiences

Where you have given the separate marketing consent, the school may share your email and/or phone number with Meta Platforms to show the school's ads to existing contacts (the Custom Audiences technology).

As things stand, no such sharing takes place: consent was asked in advance so that we would not have to come back to you with the same question on the day it starts. When it does start, we will say so in this section and in the update date at the top of the page.

When such sharing begins, the data will leave only in hashed form: before transmission, the email and phone number will be converted with the SHA-256 algorithm into an irreversible code, which Meta uses solely to match against already existing accounts.

Unsubscribing from marketing emails will remove you from these audiences at the next synchronisation. You can also require your data to be removed from the audiences via the contact in section 1.

9. Who receives the data

We do not sell personal data. Access is limited to authorised people and to providers necessary to run the service, under contractual confidentiality terms.

Categories of recipients: hosting and site delivery (Vercel); database (Neon); email and CRM (Brevo); learning platform and course access (GetCourse); analytics (Google); advertising technologies (Meta); AI infrastructure (OpenRouter, the language model providers and hosting of the AI agent's server in the EU).

The exact list of providers and the corresponding data processing agreements must be documented and reviewed before commercial launch.

10. Transfers outside the EEA

Some providers may process data outside the European Economic Area, including in the United States. This applies in particular to analytics and advertising technologies and to hosting infrastructure. Language models process texts containing your data in the EU (section 4).

Such transfers must rely on legally required safeguards: an adequacy decision, standard contractual clauses, or another permitted mechanism. The specific transfer basis for each provider must be verified by a qualified lawyer before launch.

Please note that in third countries the level of protection may differ from the European one, and public authority access to data is governed by local law.

11. Retention

Waitlist and enquiry contacts are kept until consent is withdrawn or the purpose ceases to apply; where there is no activity, no longer than a reasonable period set by the controller.

A record with no contact for 24 months is anonymised: the name and contact details are deleted, leaving an anonymous entry for statistics.

Rejected AI drafts older than 12 months are deleted.

The founders' conversations with the AI agent are deleted after 30 days, and from the server's backup copies within 7 more days.

Data connected to payment and the contract is retained for the periods required by accounting and tax law.

Records of the fact and version of consent are kept for as long as needed to demonstrate that processing was lawful.

The contact records, the client list, correspondence, and any learner information are strictly confidential and are never published.

12. Your rights

You may request access to your data, its correction or deletion, restriction of processing, portability, and you may object to processing based on legitimate interest.

Once a deletion has been carried out we tell you by email. That email goes through our mailing service (Brevo), so your address stays in its delivery log for as long as that log is kept — even after the contact itself has been removed. We think telling you matters more than avoiding that record; if you would rather not receive the email, say so in your request.

On request we provide a copy of your record: the profile fields, contact channels, the history of our contact together with the working notes, any drafts prepared, and the payment entries.

On an erasure request the record is anonymised, drafts are deleted, and only what the school must keep under accounting and tax rules remains (section 5).

Where processing relies on consent, you may withdraw it at any time: via the link in any email, through the cookie settings in the site footer, or by writing to the controller's contact. Withdrawal does not affect the lawfulness of processing before it.

You have the right to lodge a complaint with the data protection supervisory authority in your place of residence, work, or of the alleged infringement.

To exercise these rights, write to the contact given in section 1. We respond within the periods set by applicable law.

13. Children

The site and courses are intended for adults. We do not knowingly collect children's data. If you believe a child has provided us with data, tell us and we will delete it.

14. Changes to this policy

We may update this policy when services, providers, or legislation change. The date of the last update is shown at the top of this page. Where a change materially affects consent, we will ask for consent again.