01Scope and principles
1.1. This Policy applies to Customer Materials, Order details, private Deliverables, customer support exchanges, payment-related administrative information and the technical information used to operate EduAshy.
1.2. We seek to limit processing and disclosure to legitimate purposes connected with the requested service, account operation, security, support and compliance with law.
1.3. This Policy is not a promise that every Course brief is treated as legally privileged information or as information protected by a separately negotiated non-disclosure agreement.
02Confidential handling of Customer Materials
2.1. Customer Materials are used for the agreed Course workflow and related operations. We do not make private briefs or Courses publicly visible by default.
2.2. Access should be limited to personnel or providers who have a genuine service-related need, including assigned human curriculum specialists for Mentor-Crafted Courses and technical systems processing AI Course Builder Orders.
2.3. Human participation in Mentor-Crafted Courses may involve reading the brief, drafting materials, substantive review, editing and quality checks. Customer Materials should not be used by an assigned specialist for unrelated personal projects, advertising or unauthorised redistribution.
2.4. AI technology providers may process necessary input and output under their applicable service arrangements. Users should consult the Privacy Policy rather than assume there is no provider access, retention or international processing.
03Service providers and disclosures
3.1. To operate the platform, EduAshy may use payment providers, hosting and storage partners, AI providers, email and support systems, security vendors and contracted personnel.
3.2. Information shared with a provider should be limited to the reasonably necessary categories, subject to appropriate contractual, legal and organisational safeguards in light of the provider's role.
3.3. We may disclose information where necessary to comply with binding law, court orders or lawful requests by competent authorities; prevent or investigate serious fraud or abuse; or establish, exercise or defend legal claims, subject to applicable confidentiality and privacy rules.
04Technical and organisational safeguards
4.1. Security controls are selected according to the nature of the service, available technologies and risks to personal information and Accounts. Controls may include authentication safeguards, restricted administrative permissions, logging, monitoring, controlled access to production systems and appropriate vendor management.
4.2. We will not claim a particular security certification, penetration-test result, encryption architecture, security standard or payment-card compliance status unless verified for the actual deployed systems and responsible service provider.
4.3. Payment-card entry may be handled through a third-party payment service. The precise payment integration and allocation of compliance responsibilities are determined by its implementation and contracts; we do not invite users to email full card credentials to support.
4.4. Technical protections are reviewed and adapted where reasonably appropriate in response to new risks, system changes or incidents.
05Your role in Account security
5.1. Use strong, unique credentials, protect access to your email inbox and devices, and do not share Account access with unauthorised people.
5.2. Contact info@eduashy.com promptly if you suspect unauthorised access, fraudulent top-ups, unexpected Course purchases or lost control of the account email.
5.3. Do not upload or paste passwords, private access tokens, payment-card security codes or unnecessary sensitive information into a Course brief.
06Data retention and deletion
6.1. We retain content and security records for defined operational and lawful purposes, not indefinitely by default. The categories and criteria are described in the Privacy Policy.
6.2. Closing an Account or requesting deletion may not remove accounting documents, payment dispute records, legally preserved evidence or isolated backup copies immediately where there is a lawful reason to retain them.
6.3. Where a provider has separate legal retention obligations, we may not be able to require instantaneous deletion of every record, but we assess the relevant contractual and data-protection requirements.
07Security incidents
7.1. If we become aware of an actual or suspected security incident, we will assess its nature, contain or mitigate it where feasible, investigate the affected data and take legally required notification steps.
7.2. Where UK GDPR, EU GDPR or another applicable law requires notification to authorities or affected individuals, we will follow the applicable criteria and time limits. Not every technical incident automatically requires a public notification.
7.3. We may temporarily restrict accounts or system features as a proportionate protective measure. Any handling of interrupted Orders and unspent paid Balance remains subject to the refund and consumer-rights policies.
08Limitations and mandatory obligations
8.1. No online service can be guaranteed entirely free from cyber risk, accidental failure or third-party outages. Users should retain private copies of downloaded Courses and maintain their own device security.
8.2. Nothing in this Policy excludes our legal duties to implement appropriate security, protect personal data, provide contracted services or compensate Consumers where mandatory law requires it.
09Contact and changes
9.1. For security concerns or confidentiality questions, email info@eduashy.com. Use the subject “Security Concern” where appropriate, and avoid including passwords or full card details.
9.2. We may update this Policy when systems, providers, risks or legal requirements change. Material changes will be reflected in the Website notice.
9.3. Operator: DAREVON TRADING LTD, company number 17470852, Suite 34, Cariocca Business Park 2 Sawley Road Manchester M40 8BB England, United Kingdom.