How we keep your students' data

Children's data

Many students are children. Each tutor, centre or school decides what data it keeps about its students and why, and it is responsible for informing their parents or guardians and, where the law requires it, for obtaining their consent.

We use children's data only to provide the service to whoever keeps it: never for marketing or profiling. We do not send marketing emails, and we do not sell personal data.

The GDPR and the CNPD

For the data about students, families and the team, the school is the controller and we are its processor: we process the data on its behalf and only on its instructions, under GDPR Article 28 terms that are part of the terms of service.

Everyone who works for us with access to the data is bound to confidentiality. If a personal data breach affects a school, we inform it without undue delay and at the latest within 48 hours of becoming aware of it. A new sub-processor is announced at least 30 days in advance.

A parent who wants to see, correct or delete their child's data speaks to the school first, which decides; we help the school answer. They can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD).

Where the data lives

We choose providers that keep the data in the European Economic Area.

When data leaves the European Economic Area, for example when the school connects a Google, Microsoft or Zoom account, it is transferred only with the safeguards the GDPR requires: to a country covered by an adequacy decision of the European Commission, or under its standard contractual clauses.

Encrypted data

Every connection to the app is encrypted (HTTPS). And what is most sensitive is kept so that it cannot be read by anyone who should not:

• Passwords are kept only as Argon2id hashes, which cannot be turned back into the password.
• Sessions, the one-time links we email and recovery codes are also kept only as hashes.
• Two-factor authentication secrets and connected accounts' tokens are encrypted, with keys kept in a key management service.
• Backups are encrypted.
• The codes in the links we email are removed from the address bar and from our logs.

Backups

Every day we make an encrypted backup, kept with a different provider from our servers. We keep the last 7 daily backups, and older ones are removed within 30 days.

So data deleted in the app also disappears from the backups within about 37 days.

Taking all the data

In Settings → Data, the owner downloads everything the school keeps, whenever they like and without asking anyone: a CSV file per table and every file, in one ZIP archive, which opens in a spreadsheet or can be taken to another program.

Deleting the school

The owner asks for the school to be deleted in Settings → Data. For 30 days the school is read-only: everything can still be exported, and the request can be cancelled.

After the 30 days, we delete everything the school kept: its records, its files, its change history, the events the app put in connected calendars, and the accounts that belonged only to that school. The data then disappears from the backups as they expire.

Who sees what

The owner decides who joins the school and with which role, and can remove access at any time. Assistants and tutors see what their role allows: in a team, a tutor sees their own students and lessons.

Every account can turn on two-factor authentication: a code from the phone on top of the password. And every change is recorded: who changed what, and when.

On our side, only the people who need access to run the service can reach the servers.

Each school kept apart

Each school's data is kept apart from the others' by the database itself (row-level security), in addition to the app's own checks.