Privacy Policy for nuspace.kz

1. General Provisions

• By logging into the Service via Google OAuth2 or linking your Telegram account, you provide express consent to the processing of your data.
• The service operates in strict compliance with the Law of the Republic of Kazakhstan 'On Personal Data and their Protection'.
• This service is intended for users who are at least 18 years of age or possess legal consent from a parent or guardian.

2. What Data We Collect

• Google OAuth2: We receive your full name, NU email address (@nu.edu.kz), and profile photo URL to verify your student status.
• Telegram: We store your unique Telegram User ID and username to provide bot functionality.
• Cookies: We use essential cookies only to maintain your secure login session. No tracking or marketing cookies are used.
• Technical Logs: To maximize privacy, we do NOT collect or store user IP addresses or User-Agent strings.

3. Purpose of Data Processing

Your data is used exclusively to verify NU affiliation, link your web and bot accounts, and enable automated updates about your appeals.

4. Storage and Security

We implement industry-standard security measures. Data is stored in encrypted databases. Administrative access is strictly limited to authorized personnel via encrypted SSH channels with key-only authentication. We do not sell, trade, or rent your data to third parties.

5. Data Sharing and Disclosure

We do not share, transfer, or disclose your Google user data (Full Name, Email, Profile Photo) to any third parties. We do not sell, trade, or rent your personal data. Your data is only used internally to provide the service. The only exceptions where data interacts with third parties are for technical infrastructure, as described below:

• Google Cloud: We use Google Cloud Platform solely for data hosting and storage. Your data remains encrypted and is not accessed by Google for other purposes.
• Telegram: We do not share your Google user data with Telegram. The Telegram integration uses only your Telegram User ID to route notifications; your Google identity (email/name) is never transferred to Telegram servers.

6. Data Retention & Deletion

• Retention: Your data is stored only as long as your account is active.
• Right to be Forgotten: To request a permanent and total removal of all your data from our servers, contact the administrator via Telegram.
• Inactivity: Accounts inactive for more than 12 months may be subject to automatic deletion.

7. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or for legal reasons. Significant updates will be notified via the @nuspaceBot or through a prominent notice on the nuspace.kz homepage.