Last updated: 10 September 2026.
1. Who processes the data
The data controller is D&L Project56 EOOD, EIK 208418815, VAT BG208418815, 5A Pavel Krasov Street, Gorublyane, Mladost, 1138 Sofia, Bulgaria.
Contact for anything to do with data: info@dlproject.io.
This policy covers DL Academy only (academy.dlproject.io). Other D&L Project services have their own policies.
2. The short version
- No registration. We ask for no name, no email, no phone number, no account.
- No cookies. We set none, so there is no consent banner.
- No advertising trackers. No Google Analytics, no Meta Pixel, nothing shared with
- We do not store your IP address.
- Your progress stays in your browser.
advertisers.
3. What stays on your device
The application uses browser `localStorage` for: the chosen language, the group code, your progress (results, attempts, question status) and the state of the toolbar switches. These are technically necessary on-device values, not cookies, and they never reach our server. Clearing your browser data clears them. An "Export progress" button lets you keep your own copy.
4. Analytics without an IP address
To know how much the service is used, the server records events: a visit, opening a question, checking an answer (correct/incorrect only), the start and end of a test, and a question to the tutor.
Each event carries a visit pseudonym — an irreversible `sha256` digest of the date, the IP address, the `User-Agent` header and a secret salt, truncated to 16 characters. The digest rotates at midnight every day, cannot be turned back into an IP address, and is never joined with anything else. It groups the events of one visit; it does not identify a person.
The IP address and the `User-Agent` themselves are written nowhere. There is no user profile, no profiling and no automated decision-making with legal effect.
5. The tutor conversation
5.1 When you ask the tutor something, the text of your question and the tutor's answer are stored — the owner reads what people ask in order to improve the material and the explanations.
5.2 The record is pseudonymised: it carries only the daily visit pseudonym from section 4, the course, the language and the question identifier. No name, no IP address, no `User-Agent`.
5.3 Please do not enter personal data into the tutor conversation — yours or anyone else's. The tutor neither asks for it nor needs it.
5.4 The question and answer text is deleted automatically after 90 days. The bare event (that a question was asked, when, on which course) remains without the text and is deleted after 365 days. The service runs this deletion itself, with no manual step.
6. Retention periods
- Tutor question and answer text — 90 days
- Statistical events without text — 365 days
- Daily visit pseudonym — rotates every 24 hours
- Progress in your browser — until you clear it
7. Legal basis (GDPR)
- Article 6(1)(f) — legitimate interests: running the service, security (rate limiting),
- Article 6(1)(b) — performance of a contract: providing the practice service itself on
basic usage statistics and improving the material. The balance is kept by not storing the IP address and not building profiles.
the basis of the group code.
We process no special categories of data, and we process nothing on the basis of consent, because we ask for none.
8. Who the data goes to
- Hosting provider — a company established in an EU member state and compliant with
- Language model provider (the tutor) — the text of your question and the content of the
the GDPR. The service runs on a server inside the European Union.
open question are sent to an external AI provider in order to generate the answer. Provider name and country of processing: [[DOPUNITI]].
We do not sell data and pass nothing to advertisers. Any transfer outside the EEA is covered by Standard Contractual Clauses (SCC).
9. Security
- HTTPS/TLS end to end
- The question bank is never served as a public JSON file; correct answers are revealed
- Provider keys and the tutor system prompt stay server-side
- Per-visitor rate limits and a daily spend cap
- Access to the statistics is behind a separate admin token and is read-only
only after a check
10. Your rights
Under GDPR you have the right of access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interests.
An honest note: because we store no name, no email and no IP address, and because the visit pseudonym rotates daily and is irreversible, we are in practice unable to link any record to you or to identify you (GDPR Art. 11). That means a request to access or erase specific records will usually be one we cannot execute — not because we refuse, but because we have nothing to find you by. If you did put something recognisable into a tutor conversation, write to info@dlproject.io with as much detail as you can (approximate time, course, content) and we will look for it.
Progress in your browser you clear yourself, in your browser settings.
11. Complaints
You have the right to lodge a complaint with the supervisory authority: Commission for Personal Data Protection (Bulgaria) — www.cpdp.bg.
12. Children
The service is intended for adult trainees. We do not knowingly collect data from children.
13. Changes
We may update this policy. Changes are posted on this page with a new date.
14. Contact
D&L Project56 EOOD · Sofia, Bulgaria, EU · info@dlproject.io