Privacy Policy

Effective date: 11 August 2026 · Version 1.0

Talpyn is built for children, so we keep this simple and collect little. This policy explains what we collect, why, and the choices you have.

1. Who is responsible for your data

The data controller for the Talpyn service (talpyn.com and the Talpyn learning application) is Codo LLP, BIN 170440018644, 2B Bauyrzhan Momyshuly Ave., premise 4, Astana 010010, Kazakhstan. Contact: support@codo.kz.

2. What we collect

From the parent or guardian

• Email address (account, receipts, consent and service messages), or a phone number if you choose to receive the parental-consent request by messenger instead of email.
• Subscription status. Once international checkout opens, payment card details will be collected and processed by Paddle, our merchant of record – card numbers never reach our servers. Until it opens, no payment data of international customers is collected at all.
• If you choose to leave a public review of Talpyn: the rating, the text, the city you specify and your chosen signature style. A review is published only with your separate consent, and a child's learning data never appears in it.

From the student

• A first name or username, chosen at sign-up (email is optional for students; login works with a username alone), and an account password, stored only as an irreversible hash.
• Date of birth – or, for an account created by a parent, date of birth or school year (at least one of the two). We use it solely to apply the age gate and the parental-consent regime for students under 14.
• Learning data: answers, progress, mastery of concepts, accuracy and streaks, levels and achievements, results of optional math duels with their rating, and the student's ratings of learning content (a reaction plus a reason from a closed list – no free text). This is what makes the course adaptive.

Automatically

• Technical logs necessary to run and secure the service (IP address, browser type, timestamps). We use no advertising trackers.

We deliberately do not collect from children: home address, the child's own phone number, school identifiers, photos or biometric data, geolocation, or social media profiles.

3. Children's privacy and parental consent

• A child's account is created or authorised by the parent or legal guardian.
• For children under 14, the account becomes active only after verifiable parental consent, which we request by email or messenger to the contact the parent provides.
• Parents may review their child's data, withdraw consent or request deletion at any time via support@codo.kz.
• We show no advertising to anyone, and we never use children's data for marketing or profiling beyond the learning adaptivity described above.

4. How we use data

To run the course (accounts, progress, adaptivity), to show parents their child's progress, to provide support, to send service and billing messages, and to keep the service secure. We send marketing email only to adults who opted in, and every such email contains a working unsubscribe link.

5. Who we share data with

We do not sell personal data. We share data only with service providers that help us run Talpyn, under contracts that limit their use of it:

• Paddle (merchant of record) – will process payments and issue receipts once international checkout opens; Paddle is an independent controller of checkout data under its own privacy policy.
• Email/messaging delivery providers (e.g. Mailgun) – to deliver consent requests, receipts and service messages.
• Cloud hosting providers – to host the service and its databases in secure data centres.

We disclose data to authorities only where the law requires it.

6. International transfers

Talpyn serves families in several countries; data is processed on our hosting infrastructure and by the providers listed above, which may be located outside your country. Where required, we use contractual safeguards for such transfers.

7. Retention

Account and learning data are kept while the account exists. If a subscription lapses, the account is retained so the child can resume without losing progress; you may request deletion at any time. After account deletion we remove personal data within a reasonable time, keeping anonymised learning statistics and what billing and tax law obliges us to keep (records held by Paddle follow Paddle's retention rules). Technical logs are kept for no more than 90 days.

8. Security and incidents

Data is encrypted in transit, access is restricted and logged, and we minimise what we collect in the first place. If a data breach is likely to harm you or your child, we will notify you and the competent authority as required by the law that applies to you.

9. Cookies

Necessary cookies keep the service working (login session, protection against request forgery, your language choice) and are always on. Analytics cookies (Google Analytics) are set in the learning application only if you consent via its cookie notice; choosing essential-only keeps them off, and you can change the choice at any time. We use no advertising cookies. This website itself sets no cookies.

10. Your rights

You may request access to, correction of, or deletion of your and your child's personal data, object to marketing, and withdraw consent, by writing to support@codo.kz. We answer within 30 days.

Depending on where you live, these rights are additionally protected by, in particular: the Personal Information Protection and Electronic Documents Act (Canada), the Privacy Act 1988 and the Australian Privacy Principles (Australia), and the Personal Data Protection Act 2012 (Singapore). You may also lodge a complaint with your local privacy authority.

11. Changes to this policy

If we change this policy in a material way, we will notify account holders by email before the change takes effect and, where the change concerns children's data, renew parental consent where the law requires it.

12. Contact

Codo LLP (BIN 170440018644), 2B Bauyrzhan Momyshuly Ave., premise 4, Astana 010010, Kazakhstan · +7 778 680 11 19 · support@codo.kz