Privacy policy
Updated: 2026-10-23
This policy explains in detail what personal data the Antiroot Academy website processes, why, on what legal basis, who else gets access to it, how long we keep it and how you can control it. Data is processed in accordance with the Law of the Republic of Armenia "On Protection of Personal Data". By using the site and registering, you confirm that you have read this policy.
The short version. We do not sell your personal data and do not share it with ad networks, data brokers or other companies for their own purposes. We process data only so the site works and stays secure, so you can learn, and so you get what you paid for. We pass data only to services the site cannot run without (hosting, email, AI), and only as much as they need.
1. Who processes the data
Data controller: moderator.
For any data question, or to request a copy, correction or deletion: [email protected]. We reply within 10 business days.
2. Terms
- Personal data: any information that directly or indirectly identifies a person (name, email, phone, IP address and so on).
- Processing: any action with data: collecting, recording, storing, using, changing, transferring, deleting.
- Processor: a company that processes data on our behalf and only on our instructions (for example, hosting).
3. What data we process
3.1. Account data
| Data | When we get it | Why |
|---|---|---|
| Name | at sign-up, in your account | addressing you, your name in the community, certificates |
| at sign-up | login, address confirmation, password reset, emails about plans and important changes | |
| Phone number and country | at sign-up | contact about plans and requests, protection against mass fake sign-ups |
| Password | at sign-up and change | login. We store only a hash (a one-way transformation); nobody sees the password itself, including administrators |
| Learning goal | at sign-up | choosing courses and a route |
| Age confirmation | at sign-up and in your account | handling minors' data correctly |
| Acceptance of the policy and its date | at sign-up | proving that you read the policy |
| Language and theme | when you choose them | showing the site the way you like |
3.2. Security data
| Data | Why |
|---|---|
| Two-factor authentication (2FA) secret and backup codes | login with a code from an app; backup codes are stored as hashes |
| Email confirmation and password reset links | single use, valid for a limited time |
| Visit log: IP address, country, browser and device (from the User-Agent string), page opened, time, account (if logged in) | protection against hacking, fraud, bots and abuse, incident investigation |
| Login log: email, IP, country, device, time, success or reason for failure | detecting password guessing and logins by others |
| Active sessions: IP, device, country, login time | you and the administrator can end a session that is not yours |
| Attempt counters | rate limiting (protection against password guessing and spam) |
The site cannot see your device's MAC address over the internet, and we do not collect it.
3.3. Learning data
- finished lessons and quiz results, XP, level, days in a row;
- placement test results and credited modules;
- "IT City" game data: office, upgrades, teams, credits;
- Antiroot Life game data: your life save (questionnaire, avatar, in-game money and progress) and, while you play, your position in the game city, avatar look, in-game name and course. Nearby players see this unless you choose "Friends only" or "Nobody";
- certificates issued (when you get them).
Progress is stored in your browser and, if you are logged in, a copy is stored on the server so it is on all your devices.
3.4. Communication and requests
- community messages, replies, reports, user blocks;
- in the Antiroot Life game: friends and requests, private chats, groups and lesson groups. Moderators see a message from a private chat or group only if someone reports it;
- questions to Antiroot AI and the "Help" guide (see section 6);
- plan requests and their notes, plan and discount history;
- emails you send us at [email protected].
3.5. Certification exam and identity verification
We process this data only if you book a certification exam yourself and give separate consent.
- Exam proctoring. The camera is on during the exam. Faces are detected right in your browser by a small model; the camera image is not streamed and no video is recorded. Only still snapshots reach the server (about every 30 seconds and at the moment of a violation). We also keep an exam log: start and end time, answers, switches to other tabs and windows, leaving full screen, "no face" and "more than one face", IP address and browser. We do not create or store biometric templates (digital face prints).
- Identity verification (KYC) to issue a certificate. Full name in Latin letters, date of birth, document country and type (passport or ID card), document number, a photo of the document page and a selfie holding the document. The full document number is not stored, only its last 4 characters. The document photo and selfie are stored encrypted and deleted right after the review decision.
- Certificate. Number, name, exam title, score and date. The certificate page, opened by its number or QR code, is visible to anyone you show it to, so employers can check that it is genuine.
3.6. Data we do not collect
We do not collect special categories of data (health, religion, political views and so on), biometric templates or bank card numbers. We receive passport data only for the identity check before issuing a certificate (section 3.5). Please do not put such data in messages or AI questions.
4. Purposes and legal bases
| Purpose | Basis |
|---|---|
| Sign-up, login, account, lessons, tests, game, community | performance of the contract with you (terms of use) |
| Activating and renewing a plan, payment records | performance of the contract, tax and accounting law |
| Security: logs, rate limits, 2FA, blocks | legitimate interest in protecting the site and its users |
| AI and guide answers | performance of the contract (a site feature you call yourself) |
| Service emails (confirmation, password reset, plan) | performance of the contract |
| Improving lessons from aggregate statistics (how many people finish a lesson, where they make mistakes) | legitimate interest; we use aggregated data not linked to a person |
| Certification exam: camera, snapshots, violation log | your separate consent when booking and before starting the exam; performance of the contract (fair exam) |
| Identity verification (KYC) and issuing the certificate | your separate consent; the legitimate interest of employers and the academy that a certificate cannot be issued in someone else's name |
| Answering a request from a state authority | legal obligation |
We do not send marketing emails. If a newsletter ever appears, it will be only with your separate consent and a one-click unsubscribe.
5. Who we share data with
We do not sell, rent or trade your data. We do not share it with partners, advertisers or employers.
Only processors the site cannot work without get access:
| Who | What they get | Why |
|---|---|---|
| The hosting provider whose server runs the site | all data in the site database (storage) | hosting the site and backups |
| Cloudflare (if connected) | IP address, request data | attack protection, speed, HTTPS |
| Email service (SMTP) | email address, text of the service email | delivering emails |
| Anthropic (Claude) | the text of your question and the lesson | generating the AI answer |
| Google Fonts | IP address and browser when fonts load | displaying the site fonts |
| Payment provider (when online payment appears) | data needed for the payment | taking payment; card details are entered on the provider's side and we never see them |
Inside Antiroot Academy only the owner and the administrators who need it for their work have access to data; moderators see only what they need to moderate the community. All of them must keep it confidential.
We disclose data to state authorities only on a lawful request and only to the extent required.
6. Antiroot AI and the "Help" guide
When you ask a question, your question and the text of the current lesson are sent to Anthropic to get an answer. We do not store the text of questions on our server; we only count how many you asked per day (for plan limits and cost tracking). Under Anthropic's commercial API terms, request data is not used to train models.
Lesson narration runs in your browser (the built-in speech synthesizer); the text is not sent anywhere.
Do not write passwords, card numbers or other sensitive data to the AI.
7. Transfers abroad
Some processors (Anthropic, Cloudflare, Google, email services) are outside the Republic of Armenia, including in the USA and the EU. We choose services that provide an adequate level of data protection and pass them only the minimum needed. By using features that require such a transfer (for example, AI), you agree to it.
8. Cookies and browser storage
| Name | Type | Lifetime | Why |
|---|---|---|---|
aa_session |
cookie, required | 30 days | keeps you logged in; protected with HttpOnly, Secure and SameSite |
lang |
cookie | 1 year | chosen language |
theme |
cookie and browser storage | 1 year | chosen theme |
| progress, game | browser storage | until you clear it | your progress without login and between visits |
There are no advertising, analytics or third-party tracking cookies on the site. You can block the required cookie in your browser, but then you will not be able to log in.
9. How long we keep data
| Data | Period |
|---|---|
| Account, progress, certificates | while the account exists |
| Visit and login logs | 90 days, then deleted automatically |
| Sessions | until logout or 30 days |
| Confirmation and password reset links | until used or expired |
| Community messages | while the account exists or until the message is deleted |
| Payment documents | periods set by tax law |
| Exam camera snapshots | 30 days after the exam, then deleted automatically |
| Exam log and result | while the account exists |
| Document photo and selfie (KYC) | until the review decision, then deleted at once |
| Identity data (name, date of birth, country, document type and last 4 characters) | while the certificate is valid, to confirm it is genuine |
| Database backups | the last 5 copies are kept; older ones are deleted when new ones are made |
When you delete your account, we delete your profile, progress, sessions, messages and related records from the database. Data stays in backups until they are replaced automatically and is restored only after a failure. Anonymous statistics (not linked to you) may be kept longer.
10. How we protect data
- HTTPS only, strict security headers (CSP, HSTS and others);
- passwords, 2FA backup codes and tokens are stored only as hashes;
- two-factor authentication, mandatory for administrators;
- limits on login attempts and requests, a login log, blocking of suspicious accounts;
- only appointed administrators can manage the site, with permissions split by role;
- the database is not reachable from the internet directly, and settings files are closed to reading;
- exam snapshots, document photos and selfies are stored encrypted (AES-256), only administrators can see them;
- regular backups.
No system is perfectly secure. If a breach happens that may affect your rights, we will tell you and the competent authority within the time set by law and explain what to do.
11. Your rights
You have the right to:
- Know what data about you we process and get a copy.
- Correct inaccurate data (name, phone and so on, in your account or on request).
- Delete your account and data: the button in your account (password required) or an email to [email protected].
- Restrict processing or object to processing based on legitimate interest.
- Withdraw consent where processing is based on consent. This does not affect processing before withdrawal.
- Get your data in a machine-readable format (on request to [email protected]).
- Complain to the personal data protection authority of the Republic of Armenia (the Personal Data Protection Agency of the Ministry of Justice).
To protect your data, we may ask you to confirm that the account is yours before acting on a request (for example, by writing from the account's email).
12. Children
If you are under 16, sign up together with a parent or guardian, who gives consent to the processing. If you are a parent and believe your child signed up without your consent, write to [email protected] and we will delete the account.
13. Automated decisions
We make no automated decisions that have legal effects for you. AI answers are for reference. Test scores are counted automatically from correct answers; if you disagree with a result, write to [email protected] and a person will review it. In the certification exam, violations (leaving the page, no face in frame and so on) are recorded automatically and the exam ends at the third one; only an administrator can annul a result or refuse a certificate, after reviewing the snapshots and the log. You can contest that decision at the same address.
14. Changes to this policy
We may update this policy, for example when new features or services appear. The date of the last change is shown at the top of the page. We will announce significant changes in advance by email or on the site. If you do not agree with the new version, you can delete your account.