1. Data Controller Information
The data controller responsible for the processing of your personal information on Easy Krok is the Easy Krok development and operations team.
For any data protection inquiries, rights requests, or supervisory questions, you can contact our dedicated Data Protection lead at privacy@easykrok.com.
2. Information We Collect
Account & Profile Data: Your email address, encrypted authentication hashes, chosen study specialty (General Medicine, Dentistry, Pharmacy), target exam stage (Krok 1, Krok 2), preferred language for question explanations, and optional display name.
Study Progress & Performance Data: Questions answered, selected options, correct/incorrect metrics, response duration, bookmarked questions, flagged exam questions, simulated test completions, and calculated readiness scores.
Technical & Session Data: IP address, browser type and version, operating system, timestamped session tokens, and unique device fingerprints necessary to enforce our two-device security policy.
Payment Information: Payment processing is handled directly and securely by Stripe Inc. We never receive, process, or store your credit or debit card numbers, CVC codes, or banking credentials on our servers. We receive only a sanitized customer token, plan status, and transaction confirmation.
3. Legal Basis for Processing
We process your data strictly on legitimate legal bases recognized by the EU General Data Protection Regulation (GDPR) and the Law of Ukraine 'On Personal Data Protection':
• Performance of Contract: To create your account, deliver practice exam sets, save your test history, calculate readiness scores, and provide AI tutor explanations.
• Legitimate Interests: To detect and prevent fraudulent account sharing, enforce device limits, protect our intellectual property, and ensure platform uptime and security.
• Legal Obligation: To maintain accurate financial transaction and tax compliance records for subscription purchases.
4. Artificial Intelligence & Third-Party Processors
AI Tutor Requests: When you request an AI explanation for an exam question, the prompt transmitted to our AI model provider contains only the medical question text, multiple choice options, and your language preference. We do NOT transmit your name, email, IP address, or student identity to the model provider.
Subprocessors: We use trusted service providers who adhere to strict data security standards: Stripe Inc. (payment processing), Supabase / PostgreSQL (encrypted database hosting), and OpenRouter (stateless LLM routing for explanations).
5. Cookies & Local Storage
Easy Krok uses strictly essential cookies and browser LocalStorage tokens required for authentication, keeping your session signed in, and offline progress caching.
We do NOT use third-party behavioral advertising trackers, data brokers, or retargeting pixels on the Easy Krok platform.
6. Data Retention & Deletion
We retain your account profile and study history for as long as your account remains active so you can continue your preparation across exam cycles.
You may request the complete and permanent deletion of your account, test attempts, bookmarks, and associated analytics at any time by sending an email from your registered address to support@easykrok.com. All personal records will be purged within thirty (30) days.
7. Your Rights Under GDPR & Data Protection Laws
Depending on your jurisdiction, you possess the following statutory rights regarding your personal data:
• Right to Access: Obtain confirmation of data held and a copy of your records.
• Right to Rectification: Correct inaccurate or incomplete profile information.
• Right to Erasure ('Right to be Forgotten'): Request deletion of your account and personal history.
• Right to Data Portability: Receive your study records in a structured, machine-readable format.
• Right to Object & Restrict: Limit or object to specific processing activities under certain conditions.
To exercise any of these rights, contact privacy@easykrok.com.
8. Security Measures
We implement industry-grade security measures including HTTPS/TLS 1.3 encryption in transit, Argon2/bcrypt cryptographic password hashing, role-based database access, stateless encrypted JWT session cookies, and continuous vulnerability monitoring.