Privacy policy
What Quadrivium Academy collects when you use this site, why it does, and what you can ask of us.
Last updated 17 September 2026
Who we are
Quadrivium Academy Sihtasutus is a nonprofit foundation registered in Estonia under registry code 90015241, at Viru väljak 2, Tallinn. It runs this site and is responsible for the personal data described here. Write to info@qda.ee about anything on this page.
What we collect
An account is an email address and a password. Our authentication provider stores the password only as a hash, and nobody at the Academy can read it.
Signing in sets one cookie, academy_session, which keeps you signed in for up to thirty days. It holds an encrypted session and nothing else. The site sets no analytics or advertising cookies, runs no trackers, and loads nothing from a third party.
If you pay for a programme, Stripe takes the payment. We receive a customer identifier, the status of the subscription and its dates, and never your card number.
The residentship's application opens your own email client. What you send arrives as an ordinary email and stays in our mailbox.
Our hosting keeps ordinary access logs — the address a request came from, what it asked for and when — for a short time, to keep the site secure and to find faults.
Why, and on what basis
We use your account details to give you the account and anything you pay for, and to send the emails an account needs: a confirmation, a password reset, a receipt. That is the performance of our agreement with you.
We keep logs and watch sign-ins to keep the site and its members safe, which is our legitimate interest.
We send no newsletters or announcements unless you ask for them, and you can stop them at any time.
Who helps us
A few companies process data on our instructions. Supabase keeps the accounts and the database on servers in Frankfurt, Germany. Resend posts our letters from servers in Ireland. Stripe handles payments. Our own servers run in the European Union.
Stripe may process payment data outside the European Union; such a transfer rests on the European Commission's standard contractual clauses or on an adequacy decision.
How long we keep it
Account data for as long as your account exists, and for thirty days after you ask us to delete it.
Payment records for seven years, as Estonian accounting law requires.
Access logs for thirty days.
Your rights
You may ask what we hold about you, have it corrected or deleted, restrict or object to its use, and receive a copy to take elsewhere. Write to info@qda.ee and we answer within a month.
You may also complain to the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon, or to the authority where you live.
Changes
When this page changes we update the date above. A change that matters to you we announce by email before it takes effect.