Privacy policy

How Kabinata processes your personal data. Last updated: May 2026.

This is a translation provided for convenience. The Bulgarian version is the binding one. Bulgarian version

1. Who we are

The data controller is Kabinata BG OOD, EIK BG200590600, address: 14 Minzuhar St., Lozenets, 1421 Sofia.

For contact on matters relating to personal data: privacy@kabinata.com

The website kabinata.com and its features (online courses, AI teacher, voucher requests) are managed by Kabinata BG OOD. This policy explains what data we collect, why, to whom we pass it on and what rights you have.

2. What data we collect

When you register and use the platform, we collect:

• Identification data — name, email address, password (hashed), interface language.
• Learning data — which lessons you have completed, progress by level, answers to exercises, time spent on the platform.
• Communication data — the content of conversations with the AI teacher (Ms Kabinkova), questions to real teachers.
• Payment data — processed ENTIRELY by Stripe/Revolut (PCI DSS Level 1 certified). Kabinata does NOT store card numbers or CVV codes.
• Technical data — IP address, device type, browser, time of access, pages visited, referrer.
• Marketing data — reactions to email campaigns, clicks in emails, ad attribution from Meta Pixel.

3. On what basis we process the data

We process your data on the following legal bases (GDPR Art. 6):

• Performance of a contract — necessary for providing the service (login, progress, payment).
• Legal obligation — accounting documentation, VAT invoicing (5 years’ retention).
• Legitimate interest — for improving the platform, fraud prevention, security logging.
• Consent — for marketing emails, analytics cookies, retargeting. You can withdraw your consent at any time.

4. How we use your data

• Providing the service — authentication, progress tracking, AI conversation.
• Improving the courses — anonymous aggregate analysis of which lessons are difficult.
• Support and communication — answers to questions, notifications about new lessons.
• Invoicing — VAT invoices for the paid services.
• Marketing (with your consent) — newsletter, new courses, discounts.
• Security — fraud detection, abuse prevention, login logging.

We do NOT sell your data to third parties. We do NOT exchange our email database for marketing purposes.

5. Who else receives the data

We share your data only with processors that help us operate:

• Supabase (USA/EU) — database hosting + authentication (GDPR compliant, DPA signed).
• Anthropic (USA) — AI teacher (Claude API). Pseudonymous data — we do not share PII unless it is necessary for explaining a language question.
• Cloudflare (USA/EU) — CDN, DDoS protection, DNS. Minimal data (IP, request).
• Microsoft 365 (EU) — sending transactional emails (signup, password reset).
• Stripe / Revolut (EU) — payment processing (PCI compliant only).
• Meta Pixel (USA) — advertising on Facebook/Instagram. Hashed email and hashed actions. You can turn it off in the cookie settings.
• Google Analytics (if active) — aggregated traffic analysis. Anonymised IP.

All providers undergo an assessment of compliance with the GDPR. Data processing agreements (DPA) have been signed.

6. How long we keep the data

• Account data — for as long as you have an active profile + 30 days after a deletion request (for recovery in case of error).
• Learning progress — for as long as you have an active profile. On deletion — we anonymise it and keep it for statistics.
• Payment records — 5 years (a legal requirement under the Accountancy Act).
• Access logs — 90 days for security, then we delete them.
• Marketing data — until consent is withdrawn, then we delete it within 30 days.

7. Your rights

You have the following rights under the GDPR (Art. 15-22):

• Right of access — which data we hold about you (reply within 30 days).
• Right to rectification — correction of inaccurate data.
• Right to erasure (“to be forgotten”) — complete deletion, unless we have a legal obligation.
• Right to restriction — we stop the processing until a dispute is clarified.
• Right to portability — a copy of your data in a machine-readable format (JSON).
• Right to object — to marketing, profiling.
• Right to withdraw consent — for anything based on consent.

Exercise your rights by email to privacy@kabinata.com. We reply within 30 days. For complaints — the Commission for Personal Data Protection (CPDP): kzld.bg.

8. Cookies and tracking

We use the following types of cookies:

• Necessary — for logging in to the platform, language preference. They do not require consent.
• Analytics — Google Analytics, Meta Pixel for understanding traffic. They require consent (cookie banner).
• Marketing — for retargeting on social media. They require consent.

You can manage your consent from the cookie banner at the bottom of the site. Turning off marketing cookies does not interfere with the use of the courses.

9. Data security

We take care of the security of your personal data:

• HTTPS for all communication (Cloudflare Universal SSL).
• Bcrypt hashing of passwords (never in plain text).
• Row-level security in the database (Supabase RLS) — even a compromised key does not give access to other people’s data.
• MFA option for administrative accounts.
• Regular security audits and vulnerability scans.
• Encrypted nightly backups (point-in-time recovery for up to 30 days).

If a breach is identified — we notify the affected users and the Commission for Personal Data Protection (CPDP) within 72 hours (GDPR Art. 33-34).

10. Children under 16

The platform is not intended for children under 16 without the consent of a parent/guardian. When you register, you declare that you are over 16 or have parental consent. If we notice that we have collected data of a child under 16 without consent — we delete the account immediately.

11. Changes to the policy

We may update this policy. In the event of significant changes (for example a new provider with access to your data, new tracking technologies) we will notify you by email and/or with a notification on the platform 30 days in advance. Historical versions are available at /privacy/archive.

12. Contact

For questions about this policy or your rights:

Email: privacy@kabinata.com Post: Kabinata BG OOD, 14 Minzuhar St., Lozenets, 1421 Sofia Phone: +359 878 755 009 (24 hours a day, 7 days a week)

Commission for Personal Data Protection (CPDP) — kzld.bg, 2 Tsvetan Lazarov Blvd., 1592 Sofia.

Kabinata BG OOD · EIK BG200590600 · privacy@kabinata.com · Last updated: 18 May 2026

In other languages: Български · Deutsch · Español