Privacy Policy

Last updated: 4 September 2026

This Privacy Policy explains how EduDex(“EduDex”, “we”, “us”) collects, uses, shares, and protects personal data when you use our website and application at edudex.app(the “Service”). We are committed to handling personal data in line with the EU General Data Protection Regulation (GDPR) and Finnish data protection law.

1. Who we are

The Service is provided by:

  • Kazim Muhammad (sole trader / toiminimi)
  • Business ID (Y-tunnus): 3610276-2
  • Harustie 8D 36, 00980 Helsinki, Finland
  • Contact: support@edudex.app

2. Controller and processor roles

EduDex is a tool used by education agencies (“Agencies”) to capture and manage enquiries from prospective students (“Leads”).

  • For account data about the Agency and its staff, EduDex acts as a data controller.
  • For Lead and applicant data that an Agency captures and stores in EduDex, the Agency is the data controller and EduDex acts as a data processor, processing that data only on the Agency’s instructions to provide the Service.

3. Data we collect

Account & staff data. Name, work email, hashed password, role, branch, and profile settings of the Agency’s users.

Lead & applicant data. Information Agencies capture about prospective students — such as name, email, phone number, countries/destinations of interest, notes, tasks, application and offer details, and any custom fields the Agency defines.

Integration data. Where an Agency connects a lead source, we receive the lead information that source sends, including:

  • Facebook & Instagram Lead Ads (via Meta).When an Agency connects a Facebook Page, we receive lead-form submissions (for example name, email, phone, and the answers to the Agency’s own form questions), together with the Page and form identifiers needed to deliver them.
  • WhatsApp chat imports and CSV imports that the Agency chooses to bring in.
  • Hosted and embedded lead forms the Agency publishes through EduDex.

Billing data. Subscription and payment status. Card payments are handled by our payment processor (Stripe); we do not store full card numbers.

Technical data. Log data, IP address, device and browser information, and strictly necessary cookies used to keep you signed in and to secure the Service.

4. How we use data

  • To provide, operate, and secure the Service;
  • To authenticate users and remember preferences;
  • To route captured leads into the Agency’s pipeline and send in-app and push notifications the Agency has enabled;
  • To process subscriptions and payments;
  • To provide support and communicate about the Service;
  • To prevent abuse, fraud, and security incidents, and to comply with legal obligations.

We do not sell personal data, and we do not use Lead data for our own advertising.

5. Legal bases (GDPR Article 6)

  • Performance of a contract — to provide the Service to the Agency and its users;
  • Legitimate interests — to secure, maintain, and improve the Service, where not overridden by your rights;
  • Consent — where required, for example for optional communications; you may withdraw consent at any time;
  • Legal obligation — to meet accounting, tax, and other legal requirements.

6. Facebook & Instagram (Meta) data

With the Agency’s authorisation, EduDex uses Meta’s Graph API to receive Lead Ads data. We request only the permissions needed for this: pages_show_list, pages_read_engagement, pages_manage_metadata, and leads_retrieval. We use this access solely to identify the Agency’s Pages, subscribe them to new-lead notifications, and deliver each new lead into that Agency’s EduDex pipeline. We do not share this data with third parties for their own purposes, and use of Meta data also follows Meta’s Platform Terms and Developer Policies. An Agency can disconnect a Page at any time in EduDex, which stops further data flow.

7. Sharing and sub-processors

We share personal data only with service providers who process it on our behalf to run the Service, under appropriate data-processing terms:

  • Supabase — database and authentication hosting (EU region, Ireland);
  • Vercel — application hosting and delivery (EU region);
  • Stripe — subscription billing and payment processing;
  • Resend — transactional email delivery;
  • Meta Platforms — as the source of Lead Ads data an Agency connects.

We may also disclose data where required by law or to protect our legal rights.

8. International transfers

Our primary hosting is located in the European Union. Where a sub-processor processes data outside the EU/EEA, that transfer is protected by an adequacy decision or by Standard Contractual Clauses.

9. Retention

We retain account data for as long as the Agency’s account is active. Lead and applicant data is retained under the Agency’s control and is deleted when the Agency deletes it or closes its account, subject to short technical backup periods. We keep billing records for as long as required by law.

10. Your rights

Subject to the GDPR, you have the right to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability. Where EduDex acts as processor for Lead data, please direct requests to the relevant Agency; we will assist them in responding.

To exercise your rights, contact support@edudex.app. You also have the right to complain to your local supervisory authority — in Finland, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).

11. Deleting your data

You can request deletion of your data — including data received from Facebook — at any time. See our Data Deletion instructions.

12. Security

We use encryption in transit, access controls, tenant isolation, and least-privilege handling of integration tokens to protect personal data. No method of transmission or storage is completely secure, but we work to protect your data and to address issues promptly.

13. Children

The Service is intended for business use by Agencies and is not directed to children. We do not knowingly collect data directly from children.

14. Changes

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, by notice in the Service.

15. Contact

Questions about this policy or your data: support@edudex.app.