PRIVACY

Privacy of your Stoodia central account

The central website manages your account and returns you to your chosen service. This page describes central website data; product data belongs to separate services.

The short version

  • Passwords are stored as hashes. Verification and recovery codes are delivered by email.
  • After sign-in, your account retains up to five service routes for 30 days to continue on another device. You can remove them in your account. Optional browser history is managed separately.
Latyshov Mikhail, Individual EntrepreneurGeorgiaNino and Ilia Nakashidze Street N1, Building N3, Apt N3, 0105 Tbilisi, GeorgiaIdentification code: 304814921; NAPR registration record: B26362340, 18 May 2026tevio@stoodia.orgvision@stoodia.orgTelegram @mlatyshov+995551003016

Privacy notice: Georgia and applicable GDPR

Controller and scope

Latyshov Mikhail, Individual Entrepreneur in Tbilisi, Georgia, is the controller of stoodia.org. This notice concerns stoodia.org accounts and contact forms. The Georgian Law on Personal Data Protection applies; GDPR protections apply where the processing falls within its territorial scope.

Purposes and legal bases

Account creation, authentication and requested profile functions use data needed to provide the account service (contract, GDPR Article 6(1)(b) where applicable). Security, abuse prevention and restricted operational logs protect the platform and its users (legitimate interests, Article 6(1)(f)). Legal duties use the applicable obligation (Article 6(1)(c)). Contact-form processing and optional persistent journey history rely on your separate choice (consent, Article 6(1)(a)). No marketing consent is bundled with sign-up or a contact request.

Information processed

Account data include email, password hash, profile fields you supply, language, status, verification and sessions. Contact forms collect your name, email, optional organisation and other contact, category, task text, language, page, referring host, submission identifier, hashed network abuse-prevention value and consent version/time. Operational logs may contain IP address, request path, time and result. Please do not submit sensitive personal data, passwords or third-party confidential documents through the contact form. If you enable a second factor, we store the encrypted authenticator secret, hashes of single-use recovery codes and the last accepted time step. The secret is provided during setup; recovery codes are shown once. Disabling the feature deletes its settings. Resetting a password does not disable the second factor.

Recipients and international processing

Authorised staff and selected providers support this website, including hosting, message delivery and abuse prevention. Team email notifications contain the contact request. Telegram notifications contain only its reference and a protected dashboard link. The controller and selected providers may process data in different countries when needed to operate the website and comply with law. Each recipient receives only the data needed for its task.

Retention and your choices

Data is kept only for as long as needed for the stated purposes, legal duties and the establishment or defence of claims. You may request access, correction, erasure or restriction and withdraw optional consent.

Rights and complaints

Where applicable, you may object to legitimate-interest processing and request data portability for data processed by consent or contract. You may contact the controller to exercise your rights. Applicable law provides the relevant response periods and permits a complaint to the competent supervisory authority.

Storage and analytics

The website uses necessary cookies for sign-in and requested functions. Optional storage for history requires your consent and can be disabled in the cookie settings.

Return after sign-in

To continue a requested action, the website may retain a return address for up to 30 days. It is used only for that purpose and deleted when the period ends or earlier on request.

Encrypted backups

The operator may create backups to restore the website and protect data. Backups are kept for a limited period.

Technical retention periods

Temporary data is removed when its purpose ends or its retention period expires.

Contact and project requests

When you send a Stoodia Tevio request, Stoodia stores the form before sending operational notifications to the responsible team.

  • The request includes your name, email, optional organization and contact, selected direction, task description, interface language and the Stoodia page used to submit it.
  • Telegram receives only the request reference and a protected dashboard link, without request text or contact details.
  • The request remains in the protected Stoodia administration area for follow-up, security, duplicate prevention and an auditable communication history. You may request correction or deletion unless retention is legally required.

Account and security

  • The central website stores your email, account status, language and profile fields you provide. Sessions and revocation support account access and security.
  • Account tokens are stored in the tab’s sessionStorage. Each service receives a separate server session, never your password or account tokens.
  • Default access lifetimes are 15 minutes for account access, 30 days for refresh and up to 12 hours for a service session. These are access lifetimes, not promises to delete every stored record when they expire.
  • Global sign-out and password changes revoke existing central and service sessions using the new protocol. Legacy adapters require a separate update.

Journey history

  • With consent, localStorage holds up to five journeys for 30 days; necessary sessionStorage supports the current tab: service, page path with query/fragment, contour and timestamp. A path may contain your document identifier.
  • Authorization codes, state, passwords and tokens are not stored in journey history. Email return context is carried in the link fragment.
  • Expired journeys are not offered for return; browser records are removed through history controls or by clearing site data. Remove one journey or clear all history in the continuation panel on the home or account page. If browser storage is blocked, the current return still works without saved history.

Counters and technical logs

  • Navigation counters contain only UTC day, service, central/service source, event type and count. They contain no email, IP address, token, document path or visitor identifier.
  • Counters are accessible to central website administrators. Event counts do not represent unique people.
  • Separate technical logs may contain IP addresses, request paths without query, status and response time for operations and troubleshooting. They are not a personal journey history.

Service boundaries and your controls

  • Projects, videos, manuscripts, calculations, product roles and purchases are handled by their respective service. A central account does not grant access to another person’s documents.
  • Use account sign-out to end central access and the history controls to remove local journeys. For data questions and requests, use the contact below.