Privacy policy

Who is responsible

The operator named above decides how the personal data described here is used. We are based in the Republic of Moldova and offer QYA to training centres in Moldova, so this policy follows Moldova’s Law 195/2024 on personal data protection.

What we collect and why

You do not have to give us your data, but without it we cannot answer you or open your account.

Contact and support messages

Your name, email, training centre if you give it, topic, plan, message and language. We use them to answer you and to discuss a pilot. Legal basis: steps you ask for before a contract, or our legitimate interest in answering requests about our service. We keep them for 24 months after our last contact.

Accounts

Your email, whether it is verified, your Auth0 account identifier, language, and the dates of your first and last sign-in. Your password is held by Auth0, and we never see it. We use this to open your account and contact you about it. Legal basis: steps towards a contract with you, or our legitimate interest in serving the training centre you work for. We keep it until the account is deleted, or for 24 months after your last sign-in.

Alerts to us

When you sign up or send a message, we receive an email with the details above, including the text of your message. Legal basis: our legitimate interest in answering quickly. Copies stay in our mailbox for up to 24 months.

Security and operation

Our providers record technical data such as your IP address, browser and the time of a request. We use it to keep the service secure and working. Legal basis: our legitimate interest in security. Our own logs hold no names, emails or messages, and server logs are normally kept for 30 days.

What we do not do

We do not sell your data, show advertising or use analytics on this website. We make no automated decisions about you.

This website does not collect learners’ exam data. When a training centre uses QYA for exams, that centre decides how learners’ data is used and we act on its instructions. Learners should contact their centre first.

Who receives the data

We use these providers, who process data on our behalf:

Google (Firebase)

Hosts the website and stores accounts and messages in the EU, in Belgium and Poland. Web pages are delivered worldwide through a content delivery network.

Okta (Auth0)

Handles sign-up and login, on servers in the EU. Some of its support providers are outside the EU.

Resend

Sends us the alert emails. It is based in the United States and stores data there.

Our email provider

Holds the messages in our mailbox.

Transfers abroad

Your data is stored with our providers in the EU, as described above.

Data sent to the United States, mainly through Resend, is covered by standard contractual clauses in our agreements with providers. You can ask us for details of these safeguards.

Cookies

This website sets no cookies of its own. During sign-in, your browser briefly keeps technical data that is needed to complete it. Auth0 sets the cookies it needs for sign-in and security on its own domain.

Your rights

You can ask us to access, correct or delete your data, to limit its use, or to give it to you in a portable form. You can object at any time to processing based on our legitimate interests. Write to the address above, and we will answer within one month, or tell you if we need up to two more months.

Complaints

You can complain to Moldova’s National Centre for Personal Data Protection (datepersonale.md).

Children

This website is for staff of training centres, and we do not knowingly collect data from children.

Changes

We will update this page when our practices change, and the date at the top shows the latest version.