Privacy Policy

This Privacy Policy explains how Edudex (“Edudex”, “we”, “us”) collects, uses, shares, and protects personal data when you use our website and application at edudex.app (the “Service”). We are committed to handling personal data in line with the EU General Data Protection Regulation (GDPR) and Finnish data protection law.

1. Who we are

The Service is provided by:

• Kazim Muhammad (sole trader / toiminimi)
• Business ID (Y-tunnus): 3610276-2
• Harustie 8D 36, 00980 Helsinki, Finland
• Contact: support@edudex.app

2. Controller and processor roles

Edudex is a tool used by education agencies (“Agencies”) to capture and manage enquiries from prospective students (“Leads”).

• For account data about the Agency and its staff, Edudex acts as a data controller.
• For Lead and applicant data that an Agency captures and stores in Edudex, the Agency is the data controller and Edudex acts as a data processor, processing that data only on the Agency’s instructions to provide the Service.

3. Data we collect

Account & staff data. Name, work email, hashed password, role, branch, and profile settings of the Agency’s users.

Lead & applicant data. Information Agencies capture about prospective students — such as name, email, phone number, countries/destinations of interest, notes, tasks, application and offer details, and any custom fields the Agency defines.

Integration data. Where an Agency connects a lead source, we receive the lead information that source sends, including:

• Facebook & Instagram Lead Ads (via Meta). When an Agency connects a Facebook Page, we receive lead-form submissions (for example name, email, phone, and the answers to the Agency’s own form questions), together with the Page and form identifiers needed to deliver them.
• WhatsApp chat imports and CSV imports that the Agency chooses to bring in.
• Hosted and embedded lead forms the Agency publishes through Edudex.

Billing data. Subscription and payment status. Card payments are handled by our payment processor (Stripe); we do not store full card numbers.

Technical data. Log data, IP address, device and browser information, and strictly necessary cookies used to keep you signed in and to secure the Service.

4. How we use data

• To provide, operate, and secure the Service;
• To authenticate users and remember preferences;
• To route captured leads into the Agency’s pipeline and send in-app and push notifications the Agency has enabled;
• Where an Agency switches on the Conversions API, to tell the Agency’s own Meta ad account how its leads progressed (see section 6);
• To process subscriptions and payments;
• To provide support and communicate about the Service;
• To prevent abuse, fraud, and security incidents, and to comply with legal obligations.

We do not sell personal data, and we do not use Lead data for our own advertising.

5. Legal bases (GDPR Article 6)

• Performance of a contract — to provide the Service to the Agency and its users;
• Legitimate interests — to secure, maintain, and improve the Service, where not overridden by your rights;
• Consent — where required, for example for optional communications; you may withdraw consent at any time;
• Legal obligation — to meet accounting, tax, and other legal requirements.

6. Facebook & Instagram (Meta) data

With the Agency’s authorisation, Edudex uses Meta’s Graph API to receive Lead Ads data. We request only the permissions needed for this: pages_show_list, pages_read_engagement, pages_manage_metadata, and leads_retrieval. We use this access to identify the Agency’s Pages, subscribe them to new-lead notifications, and deliver each new lead into that Agency’s Edudex pipeline. We do not share this data with third parties for their own purposes, and use of Meta data also follows Meta’s Platform Terms and Developer Policies. An Agency can disconnect a Page at any time in Edudex, which stops further data flow.

If a new lead cannot be saved straight away, for example because a Page connection has stopped working, we keep Meta’s identifier for that lead, and no contact details, so we can collect the lead once the problem is fixed.

Conversions API (optional, off by default). An Agency can choose to send updates about leads that came from its Facebook & Instagram lead forms to its own Meta dataset, so its advertising can focus on people likely to become students. On the Agency’s instruction, and only for the stages it selects, we send Meta’s lead identifier, the stage reached (for example “Registered”), the time, and the lead’s email address and phone number in hashed (SHA-256) form. Leads from other sources are not included. The Agency uses its own Meta account and access token, can switch this off at any time, and is responsible for telling its leads about it. Meta handles this data under the Agency’s own agreement with Meta.

7. Sharing and sub-processors

Apart from data an Agency instructs us to send to its own ad accounts (see section 6), we share personal data only with service providers who process it on our behalf to run the Service, under appropriate data-processing terms:

• Supabase — database and authentication hosting (EU region, Ireland);
• Vercel — application hosting and delivery (EU region);
• Stripe — subscription billing and payment processing;
• Resend — transactional email delivery;
• Meta Platforms — as the source of Lead Ads data an Agency connects, and as the recipient of Conversions API updates where the Agency switches them on.

We may also disclose data where required by law or to protect our legal rights.

8. International transfers

Our primary hosting is located in the European Union. Where a sub-processor processes data outside the EU/EEA, that transfer is protected by an adequacy decision or by Standard Contractual Clauses.

9. Retention

We retain account data for as long as the Agency’s account is active. Lead and applicant data is retained under the Agency’s control and is deleted when the Agency deletes it or closes its account, subject to short technical backup periods. We keep billing records for as long as required by law.

10. Your rights

Subject to the GDPR, you have the right to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability. Where Edudex acts as processor for Lead data, please direct requests to the relevant Agency; we will assist them in responding.

To exercise your rights, contact support@edudex.app. You also have the right to complain to your local supervisory authority — in Finland, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).

11. Deleting your data

You can request deletion of your data — including data received from Facebook — at any time. See our Data Deletion instructions.

12. Security

We use encryption in transit, access controls, tenant isolation, and least-privilege handling of integration tokens to protect personal data. No method of transmission or storage is completely secure, but we work to protect your data and to address issues promptly.

13. Children

The Service is intended for business use by Agencies and is not directed to children. We do not knowingly collect data directly from children.

14. Changes

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, by notice in the Service.

15. Contact

Questions about this policy or your data: support@edudex.app.