Privacy Policy

1. Data controller

S.C. Metis IT&Software S.R.L. (Romania), VAT RO45457364, Trade Register No. J2022000382407, Str. Râmnicu Vâlcea nr. 8, cam. 1, et. 8, ap. 809, Sector 3, București, România, email support@stodimosio.gr.

2. Data we collect

Account data: email; if you sign in with Google, we also receive the name and profile picture provided by Google. Usage data: answers, progress, score estimates, interactions with the AI tutor. Payment data: handled by Stripe; we receive only limited information (subscription status), not the card number. Technical data: cookies, device/browser type and a pseudonymized (hashed) IP address for basic, first-party analytics.

3. Purposes & legal basis

Providing the service (contract performance); improvement & security (legitimate interest); marketing/measurement only with your consent.

4. Processors / third parties

We use: Supabase (database), Vercel (hosting), Google (sign-in/authentication), Stripe (payments), Anthropic (AI processing), ZeptoMail/Zoho (email), Meta (ad measurement, with consent). Some may process data outside the EU (e.g. USA) under appropriate safeguards (Standard Contractual Clauses).

5. Retention

Account & learning data: for as long as your account exists; deleted or anonymized within 90 days after you delete your account, unless longer retention is legally required. First-party analytics (pseudonymized): up to 14 months. Invoicing/transaction records: for the period required by tax & accounting law (in Romania, up to 10 years). Sign-in links/tokens: deleted on use or expiry.

6. Your rights (GDPR)

Access, rectification, erasure, restriction, portability, objection, withdrawal of consent. Exercise them at support@stodimosio.gr. We respond within 1 month.

7. Minors

The Service is intended solely for adults and is not directed at minors. We do not knowingly collect data from anyone under 18; if we become aware of such collection, we delete the data.

8. Cookies

We use essential cookies (sign-in, security) and basic first-party analytics with pseudonymized data, on the basis of legitimate interest. The Meta (Facebook) advertising pixel loads ONLY with your explicit consent. You can change or withdraw your consent at any time.

• authjs.session-token — essential: keeps you signed in (up to ~30 days).
• sd_session — analytics (legitimate interest): visit identifier for internal statistics (up to 12 months).
• sd_consent — essential: stores your cookie choice (up to 12 months).
• _fbp (Meta) — marketing: only with consent, ad measurement (up to ~3 months).

9. Security

We take reasonable technical and organizational protection measures.

10. Complaints

You have the right to lodge a complaint with a supervisory authority — the Romanian DPA (ANSPDCP, www.dataprotection.ro), where the controller is established, or the Hellenic Data Protection Authority of your place of residence (www.dpa.gr).

11. Contact

support@stodimosio.gr