Privacy Policy
This policy describes the data the platform actually processes. It must be reviewed by a qualified lawyer for the jurisdictions where OrionStats operates (for example the EU/UK GDPR and Azerbaijani personal data law) before launch. OrionStats does not claim compliance with any specific regulation until that review is complete.
Who we are
OrionStats ("we") operates orionstats.com. [Legal entity name, address and contact email to be inserted.]
What we collect and why
| Data | Purpose | Basis (to be confirmed) |
|---|---|---|
| Name, email, password hash | Account, sign-in, communication | Contract |
| Verified name | Printing on certificates after identity confirmation | Contract |
| Learning activity (lessons viewed/completed, exercise answers, bookmarks) | Progress tracking, recommendations, dashboard | Contract |
| Exam attempts and answers | Scoring, feedback, certification decisions, exam integrity | Contract / legitimate interest |
| Project and practical submissions, uploaded files | Grading and feedback | Contract |
| Certificates (holder name, level, dates, status) | Public verification by third parties | Contract / legitimate interest |
| IP address, user agent, timestamps | Security, rate limiting, audit logs, fraud prevention | Legitimate interest |
| Purchase records (when payments are activated) | Billing, refunds, legal obligations | Contract / legal obligation |
We do not sell personal data, and we do not use third-party advertising trackers.
What is public
Only certificate verification data is public, and only to someone who has the certificate ID: holder's verified name, certificate title and level, issue and expiry date and status.
Who processes data for us
Hosting provider, managed database and file storage provider, transactional email provider and (when activated) a payment provider. [List actual providers and their locations at launch.]
Retention
Account and learning data: while the account is active and [N] months after closure. Certification records: for the validity of the certificate plus [N] years to allow verification and appeals. Audit logs: [N] months.
Your rights
You may request access, correction, export or deletion of your data, and object to certain processing. Certification records needed to answer verification requests may be retained as described above. Contact: [privacy email].
Security
Passwords are hashed with bcrypt; sessions use HTTP-only secure cookies; access is role-based and enforced on the server; exam answer keys are never sent to browsers; uploaded files are stored privately.