Privacy Policy

1. Two roles

• Controller: for the data of our own customers (school owners and staff who create an account) and of website visitors, we decide how the data is used.
• Processor: for the data that schools enter about their students and families ("Customer Data"), the school is the controller and we process it only on the school's instructions to provide the Service.

2. Data we collect

• Account data: name of the school, email address, password (stored hashed by our authentication provider), language and settings.
• Billing data: plan, subscription status and billing identifiers. Card details are collected directly by Creem, our payment provider; we never see them.
• Customer Data entered by schools: student names, names of parents or guardians, phone numbers, email addresses, groups, notes and payment records.
• Technical data: IP address, browser information and logs needed to keep the Service secure and working.

3. Why we use it (legal bases)

We do not sell personal data and we do not use it for advertising.

• To provide the Service and manage your account and subscription (performance of a contract).
• To send service emails, receipts and reminders configured by the school (performance of a contract; for Customer Data, on the school's instructions).
• To keep the Service secure, prevent abuse and fix errors (legitimate interests).
• To meet legal obligations such as tax and accounting (legal obligation).

4. Service providers

We use these providers (sub-processors) to run AulaPay:

• Supabase: database and authentication (data stored in the European Union, Frankfurt region).
• Vercel: website and application hosting.
• Creem: subscription payments, invoicing and taxes, as merchant of record.
• Resend: sending emails such as receipts and reminders.

5. International transfers

Some providers may process data outside the European Economic Area, including in the United States. Where this happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

6. How long we keep data

• Account and Customer Data: for as long as the account is active, and up to 30 days after it is closed (to allow export), then deleted.
• Billing records: as long as required by tax and accounting law.
• Technical logs: for a short period, normally no more than 30 days.

7. Cookies

We only use cookies that are necessary for the Service: a session cookie to keep you logged in and a cookie that remembers your language. We do not use advertising or tracking cookies.

8. Security

Data is encrypted in transit (HTTPS). Each school's data is separated at database level so that only that school's account can access it.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict its processing, and to withdraw consent. To exercise these rights, email contact@aulapay.app. You can also complain to your local data-protection authority.

If you are a student or family member of a school that uses AulaPay, please contact the school first: it is the controller of your data. We will help the school respond to your request.

10. Children

AulaPay is used by schools, not by children directly. Schools may enter data about minors; they are responsible for having a lawful basis and, where required, parental consent.

11. Changes

We may update this policy. We will notify customers of significant changes by email or in the app.

12. Contact

ISSAGRAPH LLC, 271 W. Short St., Ste 410, Lexington, KY 40507, United States. Email: contact@aulapay.app. Phone: +1 (364) 207-1710.