Privacy Policy

ProABA is a program for ABA specialists, curators and centers.

Learner data is entered by the specialist or the center. They decide whom to add, which goals to set and how long to keep the records. In other words, the controller of this data is the specialist or the center, and ProABA processes it on their instructions and only to run the program.

Your account data, that is contact details and settings, we process as a controller: without it signing in to the program is not possible.

Owner of the Service and controller of account data: individual entrepreneur (Ukrainian FOP) Yuliia Anatoliivna Lastovetska, Ukraine. Contact: julia.lastovetska@gmail.com

• account data: contact details and settings;
• student data entered by the specialist, including health data;
• sign-in records: when and from which device the sign-in happened. They are needed to spot a sign-in that was not yours.
• support requests: your name, email and the text of the request;
• questions you ask the AI assistant and the name of the screen you ask from.

We do not collect anything beyond what the program needs to work, and we do not use the data for advertising.

Learner data is entered on the basis of written consent from parents or guardians. The specialist obtains the consent before adding the child and is responsible for having it.

Account data is processed on the basis of your registration with the service.

We process questions to the AI assistant to answer them (performance of the contract) and to improve our help content (legitimate interest). We process support requests to answer them and fix errors (performance of the contract).

Learner data is seen by the specialist who works with them and by those the specialist granted access to. No other user of the program has access to it.

Technical access to the servers is held by the service owner and the technical administrator the owner has authorized; they use it only for maintenance.

The database and files are stored in Supabase, EU region.

To make the program work we use services provided by other companies. They process the data on our instructions and have no right to use it for their own purposes. These services are:

• data storage and signing in to the program;
• application hosting;
• video connection for online sessions;
• email delivery;
• the AI assistant;
• the mailbox for support requests.

The list of these companies by name is provided to a center when a data processing agreement is signed, and to any person on request.

Transfers of data outside the EU take place on the basis of the European Commission's Standard Contractual Clauses.

The text of questions to the AI assistant is processed by Google, including in the USA, on the basis of the European Commission's Standard Contractual Clauses and the EU-US Data Privacy Framework; the assistant does not receive learner data. Support requests arrive in our mailbox, which is run by Google.

Learner data is kept for as long as the specialist or the center uses the program. How long to keep the records is decided by them under the law of their country: we keep the records on their instructions and delete them at their request.

Account data is kept until the account is deleted.

Sign-in records are kept for 90 days.

Questions to the AI assistant are kept for 90 days; Google keeps them for up to 55 days to detect abuse.

Support requests are kept for 2 years after the issue is resolved.

Deletion is final: the data cannot be restored afterwards.

Under GDPR you have the right to obtain a copy of your data, correct it, delete it, restrict processing, object to it or transfer the data to another service. You can also lodge a complaint with the supervisory authority in your country.

If a request concerns student data, it is directed to the specialist or the center working with that student: they are the controller. We help to fulfil such a request.

Send requests to julia.lastovetska@gmail.com. We respond within 30 days.

Strictly necessary. Needed to keep you signed in and to remember your chosen language. They always work: without them the program does not run, and no consent is asked for them.

Analytics and marketing. May be used only on the public pages of the site - the home page, the pricing page and the legal documents - and only after your consent in the banner we show on your first visit. They provide anonymised view statistics and show where people come to us from.

Inside the program, where you work with students, there are no analytics or marketing cookies, and there will be none. Children's data does not reach any advertising or analytics service.

You can withdraw consent at any time: decline it in the same banner or clear cookies in your browser.

Subscription payments are handled by an external payment system that acts as the seller to the end user. Your card number, its expiry date and the CVV code never reach ProABA and are not stored anywhere by us - you enter them in the payment system's form, not in ours.

From it we receive only what is needed to grant access: the payer and subscription identifiers, the payment status, its validity period and the email address the subscription is registered to.

Payment and tax records are kept for as long as the law requires.

To your email address we send: the sign-in code, the welcome email, notices about changes to the Terms or to this Policy, subscription expiry warnings, and replies to your enquiries.

These are service messages without which the service does not work, so you cannot opt out of them separately - you can only delete the account.

We do not send marketing mailings. If we ever start, we will ask for consent separately and unsubscribing will take one click.

Access to data is separated by permissions: everyone sees only what belongs to them. The connection is encrypted and the data is stored in secure infrastructure.

If we change this Policy, we will issue a new revision. We will announce material changes in the program and ask you to read them.

julia.lastovetska@gmail.com