Edline

PRIVACY POLICY

of the Edline online education platform (myedline.com)

(the "Policy")

ред. 3 от 09.09.2026 · In force from: 2026-09-09 · Version: v2.2

What changed in this edition
  • Хранение данных: база данных и резервные копии на территории Республики Казахстан.
  • Раздел 2 дополнен категориями данных, ранее не указанными: активности и достижения, ответы анкеты, сведения о финансовом положении семьи, загружаемые документы.
  • Указано, какие данные предоставляются добровольно.
  • Добавлены положения о системах искусственного интеллекта: получатели данных, маркировка результатов и права Пользователя.
  • Уполномоченный орган по защите персональных данных указан под действующим наименованием.
  • Реквизиты Оператора приведены в соответствие со статьёй 26 пункт 1 Закона «О защите прав потребителей»; ИИН исключён из публикуемого текста.

1. General provisions

1.1. This Privacy Policy (the "Policy") describes how the personal data of Users of the Edline online education platform at myedline.com (the "Platform") is collected, processed, stored, transferred and protected.

1.2. The personal data operator is ИП «QG Consulting» (Баймагамбетова Эльмира), registration number KZ21UWQ02673326, 124 Aimanov Street, office 507, Almaty, Republic of Kazakhstan (the "Operator").

1.3. This Policy has been prepared in accordance with:

  • the Law of the Republic of Kazakhstan of 21 May 2013 No. 94-V on Personal Data and its Protection (the "Law on Personal Data");
  • the Civil Code of the Republic of Kazakhstan;
  • the Law of the Republic of Kazakhstan on Informatisation;

other regulatory legal acts of the Republic of Kazakhstan on the protection of personal data.

1.4. By using the Platform and/or registering an account, the User confirms that they have read this Policy and consents to the processing of their personal data on its terms.

1.5. If the User does not agree with the terms of this Policy, they must stop using the Platform.

2. What personal data we collect

2.1. Data provided on registration

  • When creating an account the User provides the following data:
  • full name (given name, surname);
  • email address;
  • password (stored in encrypted form);

date of birth (to determine the User's age).

When registering through Google OAuth, the Platform receives the User's email address from the Google service.

2.2. Additional profile data (provided voluntarily)

  • While using the Platform the User may voluntarily provide:
  • GPA (grade point average);
  • standardised test results (SAT, IELTS, TOEFL and others);
  • intended fields of study (majors);
  • information about the need for financial aid;
  • the list of universities of interest;
  • information about the family's financial situation (the family's annual contribution to tuition);
  • information about extracurricular activities, achievements and awards;
  • answers to the questionnaire during initial profile setup;

other data needed to personalise the experience on the Platform.

Providing the data listed in paragraph 2.2 is entirely voluntary and is not a condition of using the Platform.

Information about academic performance (GPA, grades) and test results is provided solely at the User's discretion. The Operator does not require this data; declining to provide it does not restrict access to the Platform's functionality.

Information about extracurricular activities, achievements and awards is provided solely at the User's discretion. The Operator does not require this data; declining to provide it does not restrict access to the Platform's functionality.

Information about the family's financial situation is provided solely at the User's discretion. The Operator does not require this data; declining to provide it does not restrict access to the Platform's functionality.

Answers to the questionnaire during initial profile setup is provided solely at the User's discretion. The Operator does not require this data; declining to provide it does not restrict access to the Platform's functionality.

2.3. User content

  • While using the Open Space section the User may create and store:
  • notes and personal records;
  • tasks and plans;
  • essay texts;
  • university lists;
  • calendar entries;

other personal material.

2.4. Technical data (collected automatically)

  • The following technical data is collected automatically when the Platform is used:
  • IP address;
  • browser type and version;
  • device type and operating system;
  • date, time and duration of the visit;
  • pages viewed and actions taken on the Platform;
  • referrer;

cookie data (see the Cookie Policy for details).

2.5. Payment data

The Operator does not collect or store Users' bank card data. All payment data is processed exclusively by the payment provider Paylink (paylink.kz) in accordance with its privacy policy and payment industry security standards.

2.6. The personal data processed additionally includes: information about activities, achievements and awards; answers to the questionnaire (onboarding); information about the family's financial situation; documents uploaded by the User; the outputs of artificial intelligence systems; technical information about the use of artificial intelligence systems; and the data of parents and mentors invited by the User to shared access.

2.7. Providing information about the grade point average, test results, fields of study, activities, achievements, the family's financial situation and the questionnaire answers is voluntary. The Operator does not require this data; declining to provide it does not restrict access to the Platform's functionality. The data listed in paragraph 2.1 of this Policy is sufficient to register and use the Platform.

3. Purposes of collecting and processing personal data

3.1. Users' personal data is collected and processed for the following purposes:

Purpose of processingLegal basisCategories of data
Creating and managing the User's accountThe subject's consent; performance of the contractName, email, password, date of birth
Providing the Platform's functionalityPerformance of the contractProfile data, user content
Enabling shared access (collaboration)The subject's consentName, email, data of the sections access is granted to
Processing payments for the Premium subscriptionPerformance of the contractName, email (transferred to the payment provider)
Ensuring the security of the PlatformThe operator's legitimate interestIP address, technical data
Analysing use of the Platform and improving the serviceThe subject's consentTechnical data, cookie data
Sending service notificationsPerformance of the contractEmail
Complying with legal requirementsRequirement of lawAll applicable categories

3.2. The Operator does not process personal data for purposes not stated in this Policy without obtaining the additional consent of the personal data subject.

The purposes of processing additionally include: providing the "Edline Intelligence" tools, including automated processing of personal data; and monitoring compliance with the usage limits for those tools.

4. Consent to the processing of personal data

4.1. In accordance with Article 8 of the Law on Personal Data, the User's consent to the collection and processing of personal data includes:

  • the name, surname and given name, registration number and registering body of the Operator;
  • the surname and given name of the User (the personal data subject);
  • the duration of the consent;
  • the list of personal data covered by the consent;
  • the purposes of collecting and processing the personal data;
  • information about the third parties to whom the personal data may be transferred;

the list of operations on personal data covered by the consent.

4.2. Consent to the processing of personal data is given by the User on registration on the Platform by ticking the relevant checkbox. The text of the consent is available to read before it is accepted.

4.3. Consent to the cross-border transfer of personal data (section 6 of this Policy) is recorded as a separate entry and may be withdrawn separately from the consent to the processing of personal data.

4.4. For Users aged between 14 and 18, consent to the processing of personal data is given by a legal representative (parent, adoptive parent or custodian) by ticking the relevant checkbox on registration.

4.5. The User (or their legal representative) may withdraw consent to the processing of personal data at any time by:

deleting the account through the Platform's settings; or

sending a written request to info@myedline.com.

4.6. Withdrawal of consent results in the cessation of processing of personal data and deletion of the User's account. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

5. Storage of personal data

5.1. Place of storage

Users' personal data is accumulated and stored in a database located on server infrastructure within the territory of the Republic of Kazakhstan. Backup copies of personal data are also stored within the territory of the Republic of Kazakhstan. The Operator does not store personal data outside the territory of the Republic of Kazakhstan.

5.2. Retention periods

Category of dataRetention period
Account data (name, email, date of birth)For the whole life of the account plus 30 days after deletion
Profile data (GPA, tests, fields of study)For the whole life of the account; deleted when the account is deleted
User content (essays, notes, tasks)For the whole life of the account; deleted when the account is deleted
Technical data (IP, browser, actions)12 months from collection
Payment data (the fact, amount and date of payment)5 years from the date of payment (under the tax legislation of the Republic of Kazakhstan)
Consent records (the fact and date consent was given)3 years after the consent is withdrawn or the account is deleted

5.3. On expiry of the retention periods, personal data is destroyed or anonymised.

5.4. Where the User deletes their account, all personal data and User Content is deleted within the periods stated in paragraph 5.2, except for data whose retention is required by the legislation of the Republic of Kazakhstan.

6. Cross-border transfer of personal data

6.1. Cross-border transfer is carried out in accordance with the requirements of the Law on Personal Data and subject to the following conditions:

  • the User gives separate consent to the cross-border transfer of personal data on registration on the Platform;

Users' personal data is accumulated and stored in a database located on server infrastructure within the territory of the Republic of Kazakhstan. Backup copies of personal data are also stored within the territory of the Republic of Kazakhstan. The Operator does not store personal data outside the territory of the Republic of Kazakhstan.

6.2. Consent to cross-border transfer is given on registration by a single checkbox together with the consent to the processing of personal data, and is recorded as a separate entry. The User may withdraw the cross-border consent separately, without withdrawing the consent to the processing of personal data, in the account settings.

6.3. For Users aged between 14 and 18, consent to cross-border transfer is given by a legal representative.

6.4. Cross-border transfer of personal data is made to the recipients listed in section 7 of this Policy: OpenRouter, Inc. (USA) and Anthropic PBC (USA), Google LLC (USA), OpenAI, L.L.C. (USA) (United States of America), Google LLC, Meta Platforms Inc. and Namecheap Inc. (United States of America). The United States of America is not among the states recognised as providing protection of personal data within the meaning of Article 16 of the Law on Personal Data; the transfer is made on the basis of the personal data subject's separate consent.

7. Transfer of data to third parties

7.1. The Operator does not sell Users' personal data to third parties.

7.2. Personal data may be transferred to the following third parties, solely for the purposes stated in this Policy:

Third partyType of dataPurpose of transferLocation
OpenRouter, Inc. (USA)Essay text, names and levels of activities, academic indicatorsRouting of requests to artificial intelligence modelsUSA
Anthropic PBC (USA), Google LLC (USA)Essay text, names and levels of activities, academic indicatorsProducing the essay review, the profile assessment and the application reportUSA
OpenAI, L.L.C. (USA)Essay text, names and levels of activities, academic indicatorsThe same purposes; not in use as at the date of this documentUSA
Paylink (paylink.kz)Name, emailProcessing subscription paymentsKazakhstan
Google LLC (Google OAuth)EmailUser authenticationUSA (EU)
Google LLC (Google Analytics)Technical data (anonymised)Analytics of use of the PlatformUSA (EU)
Meta Platforms Inc. (Meta Pixel)Technical data (anonymised)Advertising campaign analyticsUSA (EU)
Namecheap Inc. (Private Email)Email correspondence with UsersProvision of an email serviceUSA

7.3. The Operator enters into agreements with third parties processing personal data that secure an appropriate level of data protection.

7.4. The Operator may transfer personal data to state bodies of the Republic of Kazakhstan in the cases provided for by law, including at the request of law enforcement agencies or by court order.

7.5. In the event of a reorganisation, sale or transfer of the Operator's business, Users' personal data may be transferred to the successor, subject to compliance with this Policy. Users will be notified of any such transfer.

7.6. Processing of data by artificial intelligence systems.

In order to provide the "Edline Intelligence" tools (essay review, profile assessment, application report), the User's data is transferred to the following recipients:

  • OpenRouter, Inc. (USA) — routing of requests to artificial intelligence models. Transferred: the essay text, the names and levels of activities, academic indicators;
  • Anthropic PBC (USA), Google LLC (USA) — provision of artificial intelligence models and production of the result. The same data is transferred;
  • OpenAI, L.L.C. (USA) — model providers to whom data may be transferred in future. As at the date of publication of this Policy, no transfer to those providers takes place.

Not transferred: surname and given name, email address, date of birth, account identifier, information about the family's financial situation, uploaded documents and payment data. The restriction is implemented by technical means of the Platform.

The data transferred is not used by the recipients to train artificial intelligence models. Detailed terms on the use of artificial intelligence systems are set out in the AI Use Policy.

The purpose of transferring data to artificial intelligence systems is a separate purpose and does not coincide with the purpose of transferring data to Google LLC (authentication through Google OAuth and analytics of use of the Platform).

8. Processing of minors' personal data

8.1. The Platform is intended for Users who have reached the age of 14 (fourteen). Persons under the age of 14 may not use the Platform or provide their personal data.

8.2. On registration the User states their date of birth. If the date of birth indicates an age below 14, registration is blocked.

8.3. For Users aged between 14 and 18:

  • personal data is collected and processed with the consent of a legal representative (parent, adoptive parent or custodian);
  • the legal representative's consent is confirmed by ticking the relevant checkbox on registration;
  • the legal representative confirms consent both to the processing of personal data and to its cross-border transfer;

the Operator may at any time request further confirmation of the legal representative's consent.

8.4. The legal representative of a minor User has the right to:

  • request information about the processing of the minor's personal data;
  • require the minor's personal data to be corrected or deleted;
  • withdraw consent to the processing of personal data at any time;

withdraw consent to the cross-border transfer of personal data.

8.5. On withdrawal of consent by the legal representative, the minor User's account is deleted and all personal data is destroyed in the manner set out in paragraph 5.2 of this Policy.

8.6. The Operator takes additional measures to protect the personal data of minor Users and does not use such data for marketing purposes without the separate consent of a legal representative.

9. Rights of the User (the personal data subject)

9.1. Under the Law on Personal Data the User has the right to:

  • (a) Right of access: to obtain information about the processing of their personal data, including the list of data processed, the purposes of processing and information about third parties to whom the data has been transferred;
  • (b) Right of rectification: to require inaccurate or incomplete personal data to be corrected;
  • (c) Right of erasure: to require their personal data to be deleted. The User may delete their account themselves through the Platform's settings;
  • (d) Right to restriction of processing: to require personal data to be blocked (processing restricted) where its accuracy or the lawfulness of processing is contested;
  • (e) Right to withdraw consent: to withdraw consent previously given to the processing of personal data;
  • (f) Right of appeal: to challenge the Operator's acts or omissions before the authorised body for the protection of personal data (the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan) or in court.

9.2. To exercise these rights the User sends a request to info@myedline.com stating:

  • their given name and surname;
  • the email address registered on the Platform;

a description of the request.

9.3. The Operator considers the request within 3 working days of receipt (Article 19-1 paragraph 3 of the Law on Personal Data) and sends a response to the User's email address.

9.4. The Operator may refuse a request in the cases provided for by the legislation of the Republic of Kazakhstan (for example, where retention of the data is required to comply with legal requirements).

9.5. Rights in relation to automated processing of personal data. The subject has the right to: learn that a result was produced by an artificial intelligence system; obtain a clear explanation of the result and information about the data it was based on; object to a result and require it to be reviewed by a human; refuse to interact with artificial intelligence systems entirely. An objection is considered within 3 working days of receipt, and the subject is notified of the outcome. The procedure is set out in the AI Use Policy.

10. Security of personal data

10.1. The Operator takes the necessary technical and organisational measures to protect personal data against:

  • unauthorised access;
  • loss, alteration or destruction of data;
  • unlawful disclosure;

other unlawful acts.

10.2. The protective measures include:

  • encryption of data in transit (SSL/TLS);
  • encryption of passwords;
  • restriction of access to personal data;
  • regular software updates;

use of secure server infrastructure.

10.3. Despite the measures taken, the Operator cannot guarantee absolute security of data transmitted over the Internet.

10.4. Notification of security breaches

  • In accordance with the legislation of the Republic of Kazakhstan, if a breach of personal data security is discovered (a leak, unauthorised access or another incident), the Operator:
  • notifies the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan within 1 (one) working day of discovering the breach;
  • takes steps to remedy the consequences of the breach;

notifies affected Users of the nature of the breach and of the recommended protective measures within a reasonable time.

11. Cookies

11.1. The Platform uses cookies and similar technologies to operate the site, for analytics and to improve the user experience.

11.2. Detailed information about the types of cookies used, the purposes for which they are used and how to manage them is set out in a separate document — the Cookie Policy published on the Platform.

12. Service notifications

12.1. Users may receive the following types of notification:

  • Service notifications — notifications relating to the operation of the account, payments, changes to the terms of use and account security. These notifications are mandatory and cannot be switched off by the User;

Notifications of proposed changes — notifications of Collaborators' actions under shared access.

12.2. As at the date of publication of this Policy, the Platform does not send marketing emails. If marketing mailings are introduced in future, the Operator will request the User's separate consent in accordance with the law.

13. International users

13.1. The Platform is aimed primarily at users from the Republic of Kazakhstan, but access to the Platform is not geographically restricted.

13.2. Users from other countries use the Platform on the terms of this Policy and acknowledge that their personal data is processed and stored in accordance with the legislation of the Republic of Kazakhstan.

13.3. The Platform assumes no obligation to comply with the personal data protection legislation of other jurisdictions, except where expressly required by applicable law.

14. Changes to the Privacy Policy

14.1. The Operator may make changes to this Policy.

14.2. An updated version of the Policy takes effect from the moment it is published on the Platform, unless a different date is stated in the updated version.

14.3. The Operator notifies Users of material changes to the Policy by publishing a notice on the Platform and/or sending a notice to their email address.

14.4. Continued use of the Platform after an updated Policy is published signifies the User's agreement to the new terms.

14.5. In the event of material changes to how personal data is processed, the Operator may request Users' consent again.

15. Languages of the Policy

15.1. This Policy is available in Russian, Kazakh and English.

15.2. In the event of any discrepancy between the language versions, the Russian version prevails.

16. Contact information

  • For matters relating to the processing and protection of personal data, the User may contact:

Name: ИП «QG Consulting»

Surname, given name: Баймагамбетова Эльмира

Registration number: KZ21UWQ02673326

Registering body: State Revenue Department for Medeu District

Address: 124 Aimanov Street, office 507, Almaty, Republic of Kazakhstan

Telephone: +7 (747) 403-73-53

Email: info@myedline.com

Working hours: The Platform is available 24/7. Enquiries are handled on working days from 10:00 to 19:00 (UTC+5).

Platform: Edline (myedline.com)

  • The authorised body for the protection of personal data:

Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan

Website: mdai.gov.kz

This document was drawn up in Russian. The Kazakh and English versions are translations of the Russian version. In the event of any discrepancy between language versions, the Russian version prevails.