Personal Data Processing

The controller of personal data is the administrator of the GreekMentor service. The controller name, registered address and registration details, together with the email address for enquiries, are shown in the site footer and in section 10 of this document.

The service comprises a Telegram bot, a Telegram Mini App and the browser version at greekmentor.pro.

Processing is carried out with reference to Regulation (EU) 2016/679 (GDPR) and the data protection legislation of the Republic of Cyprus (Law 125(I)/2018).

Account data: first name and (optionally) last name, email address, password hash, email-verification flag, Telegram user id when signing in through Telegram, service role, date of last activity.

Settings: interface language, time zone, learning programme and selected modules, reminder settings (which modules, which weekdays and what time), word-list display mode.

Learning data: study sessions and exercises, answers and whether they were correct, learned status of words and of grammar, history and culture topics, daily study statistics.

Technical and communication data: the log of notifications sent (channel, time, Telegram message id), the log of AI-feature requests, records of accepted legal documents (document type, its version, date and source of acceptance), and acquisition data — utm_* parameters and the referring user id when you arrived through an invitation link.

Your IP address and User-Agent string are recorded at registration and at account deletion, and are included in the internal notification to the administrator (see section 5).

The service does not request or deliberately process special categories of data (Article 9 GDPR). If you type such information into free-text fields — for example into your own word sets — you do so on your own initiative; please do not enter it unnecessarily.

Registration, authentication and maintaining a single account across Telegram and the browser version; email verification and password recovery.

Delivering the learning functionality: storing progress, building the daily plan, selecting exercises and repetitions, showing statistics.

Sending reminders and service messages via Telegram and email, to the extent you configured in your profile.

Security: session protection, protection against password guessing, detection of abuse and automated attacks, diagnosis of technical faults.

Assessing the quality of the service on aggregated, pseudonymous metrics (only if you consented to analytics).

Performance of a contract — Article 6(1)(b) GDPR: creating and maintaining the account, authentication, storing learning progress, operating the learning modules, email verification and password recovery. Without this data the service cannot be provided.

Consent — Article 6(1)(a) GDPR: analytics cookies and the visit statistics derived from them; optional reminders and messages not directly related to the operation of the account. Consent can be withdrawn at any time — through the reminder settings in your profile and through the "Cookie settings" link in the footer. Withdrawal does not affect the lawfulness of processing carried out beforehand.

Legitimate interests — Article 6(1)(f) GDPR: security of the service and its infrastructure, prevention of abuse, fault diagnosis, and keeping the notification and AI-request logs for quality and cost control. You may object to this processing (see section 8).

Compliance with a legal obligation — Article 6(1)(c) GDPR: where disclosure or retention of data is expressly required by applicable law.

Telegram (Telegram Messenger Inc. and affiliated companies) — delivery of bot messages and reminders, operation of the Mini App and Telegram sign-in. The Telegram user id and the text of the messages sent are shared. If you use only the browser version and have not linked a Telegram account, no data is shared with Telegram.

Yandex (Yandex Metrica) — web analytics of the public pages, only with your consent. The data involved and its consequences are described in the Cookie Policy.

AI providers — Google (Gemini API), OpenAI and OpenRouter. The content of the request is shared when you use the explain, hint and material-generation features: the word or task being worked on and its related context. Your name, email and Telegram id are not included in those requests.

Email provider (SMTP) — delivery of email-verification and password-reset messages. The recipient address and the message body are shared.

Hosting provider — hosting of the application servers, the database and the backups, acting as a processor on the instructions of the controller.

Internal notifications to the service administrator about registrations and account deletions are sent to a private Telegram chat of the operator and contain the name, email, Telegram id, IP address and User-Agent. Those messages remain in the Telegram chat history after the account is deleted; their removal is performed on request through the contacts in section 10.

The controller does not sell personal data, does not share it with advertising networks, and does not use it for advertising profiling. Disclosure to public authorities occurs only in the cases and in the manner expressly provided by law.

Some of the recipients listed above process data outside the European Economic Area: Yandex Metrica — including in the Russian Federation; Google, OpenAI and OpenRouter — including in the United States; Telegram — in jurisdictions outside the EEA.

There is no European Commission adequacy decision for the Russian Federation. That is precisely why analytics is loaded only on your explicit consent (Article 49(1)(a) GDPR) and switched off entirely if you decline.

For transfers necessary for the performance of the contract with you, Article 49(1)(b) GDPR applies. Whether additional safeguards are in place — standard contractual clauses under Article 46(2)(c) GDPR and the corresponding transfer impact assessments — is being established by the controller for each recipient; current details are provided on request through the contacts in section 10.

Account data, settings, learning progress and the notification and AI-request logs are kept for as long as the account exists.

When you delete your account through the profile settings, that data is irreversibly removed from the primary database, including study sessions, attempts, word and topic statuses, daily statistics, the notification log, the AI-request log, consent records and access tokens. For accounts linked to Telegram the service additionally attempts to delete the messages the bot sent to your chat.

Database backups are taken weekly and no more than four are kept at a time, so deleted data disappears from the backups within roughly four weeks.

Retention inside the systems of the recipients listed in section 5 is governed by the documents of those recipients.

Right of access (Article 15 GDPR) — to obtain confirmation of processing and a copy of your data; right to rectification (Article 16) — some data you can correct yourself in the profile settings.

Right to erasure (Article 17) — you can delete your account yourself in the profile settings; erasure of data held outside the primary database is carried out on request.

Right to restriction of processing (Article 18) and right to object (Article 21) — including objection to processing based on legitimate interests, and to receiving any message that is not strictly a service message.

Right to data portability (Article 20) — to receive your data in a structured, machine-readable format. There is no automated export in the interface yet; requests are handled manually through the contacts in section 10.

Right to withdraw consent (Article 7(3)) — at any time and without giving reasons: reminders are switched off in the profile settings, analytics through the "Cookie settings" link in the footer.

Right to lodge a complaint with a supervisory authority (Article 77 GDPR). For the Republic of Cyprus this is the Office of the Commissioner for Personal Data Protection (Γραφείο Επιτρόπου Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), commissioner@dataprotection.gov.cy. You may also complain to the supervisory authority of your country of habitual residence or place of work.

Requests concerning data-subject rights are answered within the period set by Article 12(3) GDPR — no later than one month, extendable in the cases the Regulation allows.

The service selects exercises and repetition intervals automatically on the basis of your answers. This is not automated decision-making within the meaning of Article 22 GDPR: such calculations produce no legal effects for you and do not otherwise significantly affect you.

Some of the learning materials and images in the service were produced using generative artificial-intelligence models. Such materials may contain inaccuracies and do not replace a teacher or official examination materials.

The controller applies organisational and technical safeguards: encrypted connections (HTTPS), storage of passwords as hashes only, access limited to authorised persons on a least-privilege basis, cross-site request forgery protection on forms, and rate limiting on expensive operations.

Send enquiries about personal data processing and about exercising data-subject rights to the email address shown in the site footer. To speed up handling, state the email address or Telegram id of your account and what you are asking for.

The controller has not appointed an EU representative under Article 27 GDPR or a data protection officer under Article 37 GDPR; whether such an appointment is required is assessed separately in the light of the scale and nature of the processing.

The controller may update this document. The current version is published at a permanent public URL and applies from publication. Where a material change affects processing based on consent, consent is requested again.