Privacy Policy

Scoilsy is run by [Operator legal name], a sole trader based in Ireland, trading as Scoilsy. For the purposes of data protection law, we are the controller of the personal data described in this policy.

Postal address: [Postal address]
Email: privacy@scoilsy.com

We are not required to appoint a Data Protection Officer. Please send any privacy question to the email address above.

We only collect what we need to run Scoilsy:

• Account details: your email address, first name and password. We store your password only as a secure one-way hash, so we never see it.
• School and class profile: the school you choose, the class levels you teach and the subjects you plan for.
• Planning content: everything you create in Scoilsy: short-term plans, learning outcomes, activities, notes, reflections, holidays, library items and Cuntas Míosúil reports.
• Principal requests: if you ask to be recognised as a principal, the full name, role and school you give us, and our decision.
• Technical logs: when you use Scoilsy, our servers record the pages requested, the time, errors, your user ID and, in our hosting provider's logs, your IP address and browser details.
• Marketing preference: whether you've chosen to get tips and product news from us, and when you gave or withdrew that consent.
• Usage and error data (only if you allow analytics): the pages you visit and the features you use in Scoilsy, linked to your user ID, plus technical details of errors your browser hits. It never includes your name, email address, school name or anything you've written in your plans.

Scoilsy is for teachers, not pupils. Our Terms of Use don't allow you to enter information that identifies a pupil, and we don't knowingly process pupils' personal data.

Data protection law requires a lawful basis for each thing we do with your data:

We don't sell your data or show you adverts. We only send marketing emails if you ask for them. We don't use your planning content to train AI models, and our AI provider is not permitted to either.

We use a small number of service providers (called processors) who handle data only on our instructions and under a data processing agreement:

• OpenAI generates AI planning suggestions. It receives the curriculum details and planning content needed for each suggestion, but not your name or email address.
• Loops delivers our account emails and, if you've asked for them, our tips and product news. It receives your email address, your first name, your user ID and the content of each email.
• PostHog provides our analytics and error tracking. If you allow analytics, it receives the pages you visit and the features you use, linked to your user ID. It also receives technical details of server errors, which aren't linked to you unless you've allowed analytics.
• Microsoft Azure hosts Scoilsy and its database, so all the data above is stored there.
• Microsoft Azure AI Translator translates text into Irish when you ask it to. It receives only the text being translated.
• Microsoft Azure Monitor stores technical logs and performance data about how Scoilsy is running.

We may also disclose data where the law requires it, for example in response to a valid court order.

Scoilsy is hosted by Microsoft Azure in [Azure region, e.g. North Europe (Ireland)]. Some of our processors are based in the United States:

• OpenAI and Loops process data in the United States. These transfers are protected by the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-U.S. Data Privacy Framework.
• Microsoft is certified under the EU-U.S. Data Privacy Framework and also uses Standard Contractual Clauses. Remote support may occasionally involve access from outside the EEA.
• PostHog stores our analytics data in its EU cloud, in Frankfurt, Germany.

You can ask us for a copy of the safeguards by emailing privacy@scoilsy.com.

• Account, profile and planning content: until you delete your account. You can do this at any time from My Account, and it takes effect immediately.
• Plans and holidays you delete: permanently removed 30 days after you delete them.
• Technical logs: 30 days.
• Database backups: kept for [backup retention, e.g. 7 days], then overwritten. Deleted data disappears from backups within that time.
• Loops contact: removed when you delete your account. If you unsubscribe, Loops keeps a record that you did, so you aren't emailed again.
• Analytics and error data: kept by PostHog under its standard retention period. It's linked only to your user ID. If you'd like it deleted, email privacy@scoilsy.com.

Some cookies are needed for Scoilsy to work, so they're always on:

• Sign-in cookie: keeps you signed in.
• Security cookie: protects our forms against cross-site request forgery.
• Theme preference: stored in your browser's local storage to remember light or dark mode. It never leaves your device.
• Analytics choice: a cookie (tpa_analytics_consent) that remembers whether you allowed or declined analytics, so we don't ask again.

Analytics cookies are optional. We ask the first time you visit, and nothing is set until you choose Accept:

• PostHog: a cookie and a local storage entry that let us recognise your browser between visits and count how features are used. If you change your mind in My Account, we remove them from your browser straight away.

We don't use advertising cookies. Fonts and icons are served from our own servers, so visiting Scoilsy doesn't send your IP address to Google or any other font provider.

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy of it;
• correct data that's wrong. You can change your name, email and password in My Account;
• erase your data. Deleting your account in My Account removes everything straight away, including your Loops contact. To have analytics data deleted as well, email us;
• restrict or object to how we use your data, where we rely on legitimate interests;
• data portability: receive the data you gave us in a machine-readable format;
• withdraw consent for marketing emails or analytics at any time from My Account. This doesn't affect anything we did before you withdrew it.

To use any of these rights, email privacy@scoilsy.com from the address on your account. We'll reply within one month. We may ask you to confirm your identity first. There's no charge.

If you're unhappy with how we've handled your data, please tell us first and we'll try to put it right. You also have the right to complain to the Data Protection Commission, Ireland's supervisory authority:

Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
www.dataprotection.ie

Scoilsy is for teachers and school staff aged 18 or over. We don't offer accounts to children. If we learn that an account belongs to someone under 18, we'll delete it.

If we change this policy, we'll update the version number and date at the top. Next time you sign in, Scoilsy will show you a summary of what changed and ask you to confirm before you continue.