Edubrain

GDPR overview

The publisher is established in Cyprus, so the GDPR applies directly and no Article 27 representative is required or named. The privacy policy is explicit rather than merely present: it names the GDPR, states the legal basis relied on (legitimate interests), lists six data subject rights — access and rectification, erasure, objection, restriction, portability, and complaint to a local supervisory authority — and undertakes, where data leaves the EEA, to protect it "to a level that meets the EU requirements". Beyond that the framework is thin. No data protection officer is designated, no response deadline is given, no retention period is quantified, no processing agreement is offered and no subprocessor list is published. Rights are exercised through a single general mailbox rather than a dedicated form, and no certification such as SOC 2 or ISO 27001 is claimed anywhere on the site.

Who owns the data?

PIXELLA RISE LTD retains ownership of the site and of every deliverable produced by its human experts; you receive only a limited, non-transferable licence for personal and educational use, which terminates the moment you breach the terms. Content you submit remains yours in name, but you grant the company a non-exclusive, perpetual, irrevocable, transferable, fully sub-licensable, worldwide, royalty-free licence to use, modify, publish, translate, sell and create derivative works from it in any medium. You are also asked to waive your moral rights and never to contest changes. Because the licence is sub-licensable and transferable, unnamed third parties may exercise the same rights.

Reuse rights

On the free tier you may download every response — answers, presentations, flashcards — and share them with others without asking permission; both are listed as plan features. Expert-made deliverables are narrower: the licence covers personal and educational use only, so you may not share them, resell them or present them as your own work, and it terminates on breach or after a successful chargeback. As for what the company does with your data, the privacy policy says it collects voluntarily supplied details (email, name) plus automatically captured identifiers (hostname, IP address, cookie ID, session time), relies on legitimate interests as its legal basis, may email or message you for marketing, and may transfer data outside the EEA. Third-party cookie vendors are named — Google Analytics, Google Dynamic Remarketing, Google AdWords, Facebook products, Hotjar — but the list closes on "etc.". Note that the about page claims no personal data is collected at all, which its own privacy policy contradicts.

Data retention & training

Hosting summary

Nothing is published about where data is hosted. No country, no region, no provider and no data centre is named anywhere on the site, and there is no trust or security page. The only related statement is in the privacy policy, which allows for data being shared with and stored by third parties in jurisdictions outside the European Economic Area, notes that those jurisdictions may not offer equivalent safeguards, and treats continued use of the site as consent to that transfer. Against it the policy sets a general, unquantified undertaking to protect transferred data "to a level that meets the EU requirements". One technical signal should not be mistaken for a hosting location: the domain resolves to Cloudflare anycast addresses, which identifies a content delivery network edge, not where the data actually lives. The publisher itself is established in Cyprus, which places the controller inside the European Union, but that says nothing about server location.