Privacy notice: Georgia and applicable GDPR
Controller and scope
Latyshov Mikhail, Individual Entrepreneur in Tbilisi, Georgia, is the controller of stoodia.org. This notice concerns stoodia.org accounts and contact forms. The Georgian Law on Personal Data Protection applies; GDPR protections apply where the processing falls within its territorial scope.
Purposes and legal bases
Account creation, authentication and requested profile functions use data needed to provide the account service (contract, GDPR Article 6(1)(b) where applicable). Security, abuse prevention and restricted operational logs protect the platform and its users (legitimate interests, Article 6(1)(f)). Legal duties use the applicable obligation (Article 6(1)(c)). Contact-form processing and optional persistent journey history rely on your separate choice (consent, Article 6(1)(a)). No marketing consent is bundled with sign-up or a contact request.
Information processed
Account data include email, password hash, profile fields you supply, language, status, verification and sessions. Contact forms collect your name, email, optional organisation and other contact, category, task text, language, page, referring host, submission identifier, hashed network abuse-prevention value and consent version/time. Operational logs may contain IP address, request path, time and result. Please do not submit sensitive personal data, passwords or third-party confidential documents through the contact form. If you enable a second factor, we store the encrypted authenticator secret, hashes of single-use recovery codes and the last accepted time step. The secret is provided during setup; recovery codes are shown once. Disabling the feature deletes its settings. Resetting a password does not disable the second factor.
Recipients and international processing
Authorised staff and selected providers support this website, including hosting, message delivery and abuse prevention. Team email notifications contain the contact request. Telegram notifications contain only its reference and a protected dashboard link. The controller and selected providers may process data in different countries when needed to operate the website and comply with law. Each recipient receives only the data needed for its task.
Retention and your choices
Data is kept only for as long as needed for the stated purposes, legal duties and the establishment or defence of claims. You may request access, correction, erasure or restriction and withdraw optional consent.
Rights and complaints
Where applicable, you may object to legitimate-interest processing and request data portability for data processed by consent or contract. You may contact the controller to exercise your rights. Applicable law provides the relevant response periods and permits a complaint to the competent supervisory authority.
Storage and analytics
The website uses necessary cookies for sign-in and requested functions. Optional storage for history requires your consent and can be disabled in the cookie settings.
Return after sign-in
To continue a requested action, the website may retain a return address for up to 30 days. It is used only for that purpose and deleted when the period ends or earlier on request.
Encrypted backups
The operator may create backups to restore the website and protect data. Backups are kept for a limited period.
Technical retention periods
Temporary data is removed when its purpose ends or its retention period expires.