01Who is responsible for your data
The data controller is IE Ikaev Igor (Individual Entrepreneur Igor Ikaev), an individual entrepreneur registered in Georgia. Identification number: 300429016. Registration date: 14 April 2025.
Registered address: Georgia, Tbilisi city, Gldani district, Baraleti (Engelsi) street No. 5. Privacy contact: info@eagle-school.com.
This policy covers eagle-school.com, the account area at app.eagle-school.com, our learning services and the Eagle School CRM application, including communications through connected Facebook and Instagram accounts. Meta and other external platforms also process data under their own privacy policies.
02Data we receive
The data involved depends on how you interact with the school. We receive it from you, your legal representative, teachers, payment providers and connected platforms. Technical data is generated when you use the website.
- Enquiries and profile: name, contact email, phone number, username, avatar, language, time zone and information you include in an application or correspondence.
- Learning: goals and language level, schedules, attendance, assignments, answers, learning materials, teacher feedback and lesson history.
- Payments: subscription selected, amount and currency, transaction identifiers and statuses, refunds, receipts and balance. Payment credentials entered on a payment provider's page are processed by that provider.
- Communications: messages, comments, files you send, timestamps and delivery information. Meta data is described separately below.
- Technical information: IP address, browser and device type, pages visited, usage events, error logs, cookies, session identifiers and push notification tokens when that feature is enabled.
03Purposes and legal grounds
We process necessary data to respond to enquiries, arrange lessons, provide account access and support, and handle payments in order to enter into and perform a contract. Without contact details and essential learning information, we cannot arrange or provide the relevant service.
Accounting and other mandatory records are processed to comply with legal obligations. Account security, abuse prevention and technical troubleshooting serve our legitimate interests, taking your rights into account.
Where consent is required, it must relate to a specific purpose, such as promotional emails or optional processing. You can withdraw it by contacting us. Withdrawal does not affect the lawfulness of earlier processing. Visiting the website or reading this policy does not amount to consent to all processing.
04Facebook, Instagram and Meta Bot
When you message the school or comment on its posts, Eagle School CRM may receive message or comment text, your username, sender, account, conversation, message, comment and media identifiers, event timestamps and button interactions through Meta APIs. Access depends on Meta permissions and the integration settings.
We use this information to respond, pass enquiries to school staff, maintain conversation history and send automated replies under configured rules, including comment keyword rules. An enquiry may be saved in our CRM with a contact record. An automated reply is not a final decision about admission or contractual terms; you can contact a staff member by email.
Connecting the school account does not grant access to all your private conversations. We do not ask for your Facebook or Instagram password. Access tokens for connected accounts are stored encrypted on the server and used for authorised requests to Meta.
You can request deletion of data received through Meta by following the Data deletion section, even without an Eagle School account. Revoking the application's access in Meta settings limits further access, but does not itself erase records already held by the school.
05Teacher's Google Calendar
A school teacher may choose to connect their own Google account to Eagle School CRM so that their lesson schedule appears in Google Calendar. The connection is optional and is not offered to students. We never ask for or receive the Google account password.
When the account is connected, the CRM receives the email address and account identifier from Google, and permission to create a separate "Eagle School" calendar in that account and to create, change and delete lesson events in it. The account's calendar list is read only to find that calendar. The CRM does not read, change or store the teacher's personal calendars or personal events.
Events contain the lesson time, the student's name, the language taught and a link to enter the lesson. Student contact details, payment information and guest invitations are not sent to Google. Data received from Google is used only to show the schedule to the teacher: it is not sold, not transferred to third parties, and not used for advertising or to train artificial intelligence models.
The access key for the Google account is stored encrypted on the server. The teacher can disconnect the calendar in the CRM settings or revoke access at myaccount.google.com/permissions: the access key is erased and the schedule is no longer transferred. Events already created remain in the teacher's calendar and can be deleted by the teacher. The connected account address and internal event identifiers are deleted on request as described in the Data deletion section.
Eagle School CRM's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
06Online lessons and AI features
During online lessons, the video service processes audio, video, screen sharing and connection information. Depending on the feature used, recordings, transcripts and learning feedback may also be processed. Recording and its purpose must be agreed separately before recording starts; browser permission to use a microphone is not, by itself, consent to storing a recording.
When you use AI exercises, speech recognition or learning material generation, the relevant text, audio and learning context may be sent to an AI provider, including OpenAI, to fulfil the request. Do not include identity documents, passwords, health details or other unnecessary personal information. Automated learning feedback can be inaccurate and can be discussed with your teacher.
07Children and learning
Please contact the school first if you would like to arrange lessons for a child. Enrolment, contact details and agreement on learning arrangements must involve a parent or other legal representative. This policy does not permit a child to register independently and does not set a minimum age for admission.
For consent-based processing of data about a child under 16, Georgian law requires consent from a parent or other legal representative, subject to statutory exceptions. That consent must be verified before such processing begins. Recording lessons and using AI features with a child's data require separate consideration of the conditions and necessary consents.
Do not create a social media account for a child to contact the school in breach of that platform's age rules. If you believe a child has provided data without the necessary involvement of a representative, contact info@eagle-school.com so we can investigate and, where appropriate, delete it.
08Who may receive data
Access is given to staff and teachers within their responsibilities and to providers of infrastructure and service features. Our technical infrastructure includes Vercel (hosting), Supabase (authentication, database and files), LiveKit (video calls), Mux (video materials), Resend (email), OpenAI (AI features), Meta (social platforms), and payment providers PayPal and T-Bank. The providers involved depend on the feature, payment method and active configuration.
Other participants in a group lesson may see your display name, video and materials you share with the group. Do not include information in shared materials that you do not want other participants to see.
Analytics and advertising services are described in the Cookies section. Data may also be disclosed to competent authorities where legally justified and to advisers assisting with accounting or legal claims. Public social media comments remain visible in accordance with the platform's settings.
09International processing
The controller is based in Georgia. Cloud and communications providers may process data outside Georgia, including in the European Economic Area and the United States. Locations depend on the provider, selected region and subprocessors.
International transfers require a basis and any safeguards required by applicable law. Contact info@eagle-school.com for information about recipients, storage regions and safeguards for your particular service. This policy does not itself constitute separate consent to an international transfer.
11Retention and security
Retention depends on purpose: enquiries and correspondence support responses and follow-up; profiles and learning records support teaching and access to learning history; payment records support mandatory accounting and dispute resolution. Relevant factors include active contracts, statutory retention periods, unresolved claims and deletion requests. There is no single period for all categories.
Data should not be retained longer than needed for the relevant purpose or legal obligation. Email us to ask about the period for particular records. Removal from active systems and backups may occur at different times because of backup replacement cycles.
We use HTTPS, authentication, access controls and server-side secret storage; Meta tokens are encrypted. No system eliminates all risks. Do not share your password or sign-in code; report a suspected data breach to info@eagle-school.com.
12Your rights
Depending on applicable law, you may request processing information and a copy of your data, correction, deletion, restriction or portability; object to processing and withdraw consent. Contact info@eagle-school.com. We may request the minimum information needed to verify your identity or a representative's authority.
Requests are handled within the time limits of applicable law. If a legal obligation limits deletion or another request, we will explain why. You may also complain to a competent data protection authority or court; in Georgia, supervision is carried out by the State Audit Office of Georgia.
13Data deletion, including Facebook and Instagram
Email info@eagle-school.com with the subject “Personal data deletion / Eagle School CRM”. Include the email you used with the school or your Instagram/Facebook username, and describe what you want deleted: correspondence, enquiry details, Meta integration data or your school account.
You do not need an Eagle School account to make this request. Do not send passwords, Page Access Tokens, sign-in codes or a passport copy in your initial email. If you represent a child, mention this; we will separately agree a proportionate way of verifying your authority.
After any necessary verification, we will delete data that does not need to be retained on a lawful basis and explain the outcome or any limitations. For example, mandatory payment records may need to be retained after correspondence is deleted. A request to the school does not delete data Meta or other providers hold for their own purposes; contact them separately.
info@eagle-school.com14Updates and contact
The current version is available on this page, with its revision date at the top. If the purposes or methods of processing change materially, we will provide further information and seek separate consent where required. Send questions about this policy and personal data requests to info@eagle-school.com.