Политика конфиденциальности Atma School

Кто мы

Atma School (ранее — Школа системной йоги) — онлайн-школа Андрея Дроботина: курсы ведической астрологии (Джйотиш), йоги, медитации, трейдинга и AI-автоматизации. Сайт: atmaschool.com. Связанные учебные кабинеты: jyotishcourses.universl.top и другие поддомены школы.

Владелец и оператор: Андрей Дроботин (Andrii Drobotin). Контакт по вопросам данных: yoga@jyotisha.club, Telegram: @YogaAndrey.

Google API Services User Data Policy — Limited Use

Использование данных, полученных через Google APIs, соответствует Google API Services User Data Policy, включая требования Limited Use. Мы:

• используем данные Google только для функций, видимых пользователю (проверка оплат, отправка писем школы, загрузка на свои YouTube-каналы);
• не продаём данные Google и не передаём их рекламным сетям;
• не используем данные Google для показа рекламы, в том числе персонализированной;
• не передаём данные Google третьим лицам, кроме случаев, когда это нужно для работы сервиса (хостинг, обработка запросов) и разрешено политикой Google;
• люди не читают данные Google без вашего согласия, кроме ограниченного доступа для безопасности, соблюдения закона или отладки с вашего разрешения.

Google user data — full disclosure (English)

This section describes how the Atma School web application (atmaschool.com, admin panel at atmaschool.com/astrology/courses/) accesses, uses, stores and shares data received from Google APIs. It applies in every language version of this page.

Who grants Google access

Only the school owner and administrators connect Google accounts in the admin panel: the school mailbox yoga@jyotisha.club and the owner's own YouTube channels. Students never grant Gmail or YouTube access. Optional "Sign in with Google" for students requests only basic profile scopes (openid, email, profile) and is used only to identify an existing account.

Data we access and why

• Gmail (read-only, gmail.readonly): the server searches the school mailbox only for payment-notification emails from banks and payment providers (e.g. Monobank, PrivatBank, Wise, YooMoney, PayPal), using label and sender filters. From those emails it reads sender, date and text to extract the amount, currency, payer name and time, and matches them to a student's pending order to unlock the paid lesson.
• Gmail (send, gmail.send): sends emails from the school mailbox: payment and report notifications and school newsletters to people who submitted the school's forms. Every newsletter has an opt-out link.
• Google Forms, Google Meet, Google Sheets (read-only): reads the school's own forms and their responses (applications), the school's own Meet conference records and participants (class attendance) and the school's own spreadsheets, to show them in the admin panel.
• YouTube (youtube.readonly, youtube.upload, youtube.force-ssl): lists the connected channel (name, handle, avatar, subscriber and video counts) so the owner can choose the target channel; uploads a video file chosen by the owner with the title, description, tags, privacy status and "made for kids" setting chosen by the owner; sets the owner's thumbnail; adds the uploaded video to the owner's playlist. We do not read comments, do not delete videos and do not download or store YouTube audiovisual content.

Limited Use

Atma School's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not use or transfer it for advertising, credit-worthiness or lending, do not transfer it to data brokers or AI providers, and do not use it to develop, improve or train generalized AI/ML models. Humans do not read Google user data, except with the owner's explicit consent, for security purposes, to comply with law, or when the data is aggregated and anonymized.

YouTube API Services

This application uses YouTube API Services. By using its YouTube features you agree to be bound by the YouTube Terms of Service. See also the Google Privacy Policy (http://www.google.com/policies/privacy). The application does not let third parties serve content or advertisements through YouTube features.

Storage, retention and deletion

• OAuth tokens are stored only on the school's server, in directories readable only by the web service; YouTube tokens are encrypted with AES-256-GCM. All traffic uses HTTPS (TLS).
• Gmail: message contents are not stored permanently. A short-lived cache of matching payment notifications is overwritten on every check (seconds to minutes). Only the derived payment record (amount, date, payer name, matched order) is kept as part of the order history.
• YouTube: we keep only the channel name, handle, avatar URL, counts and the IDs of videos we uploaded; this data is refreshed while the channel is connected (at least every 30 days) and deleted within 7 days after disconnection.
• Forms / Meet / Sheets data is cached on the server only to display it in the admin panel and is refreshed automatically.

Cookies

The site uses session cookies and browser local storage (login session, language, theme). No third-party advertising cookies are used.

How to revoke access and delete data

The owner can disconnect Gmail or any YouTube channel in the admin panel ("Disconnect" revokes the token at Google immediately and deletes the stored data). In addition to this, any user can revoke the app's access at any time on the Google security settings page: https://security.google.com/settings/security/permissions. To request deletion of any stored data, email yoga@jyotisha.club with the subject "Data deletion" — we delete it within 7 days. Deleting data stored by Atma School does not delete anything on YouTube; to delete videos on YouTube use YouTube Studio.

Contact

Questions or complaints about our privacy practices: Andrii Drobotin, Atma School, yoga@jyotisha.club.