Privacy policy

OpenEduCat Tools for teachers and OpenEduCat Board are run by OpenEduCat Inc., a company registered in Delaware, United States. OpenEduCat Inc. decides how your personal data is used here, so it is responsible for that data under data protection law. Its registered address is 2803 Philadelphia Pike, Suite B #1117, Claymont, DE 19703, USA. OpenEduCat Inc. is the controller of your account, screens, name lists, saved items, payments and Odoo CRM leads. It processes My Class records for you, and school workspace data for the school.

For any question about your data, write to privacy@openeducat.org.

Teachers sign in with Google, Microsoft or a code sent to their email address. The account holds the email address, the data region and the role.

Accounts are for adults. Students never hold accounts and never sign in.

If you sign in with Google or Microsoft, they send us your email address and confirm that it is verified. We never see your password.

When you create your account, we record which version of the terms of service and of this policy you were shown, your language, the time and a scrambled (hashed) copy of your IP address.

Your saved screens and name lists live in your account, on our servers in the region you chose at sign-up. This device keeps a copy only as a cache so the board works offline; the cache belongs to your session and is wiped when you sign out.

Your account also keeps the last 10 versions of each screen for 30 days, so you can restore an earlier one.

At launch you cannot upload files from your device. An image or PDF you add by link is fetched by your own browser, never by our servers.

Sound is measured on this device and never recorded.

The webcam widget shows the camera only on your screen; nothing from it is stored or sent.

Polls store counts only.

You do not sign in or give your name. A one-lesson token on this phone stops double votes; it is not linked to you and expires with the poll.

My Class keeps your roster, attendance, marks and fee records by student name, in your account in the region you chose.

For these records you are the controller and we process them for you under the Data Processing Terms.

See the Data Processing Terms

A student row holds a name, a roll number, a group and tags only: no contact details, no photos and no parent data. Students never hold accounts and have no access.

Only you can see the names. Our staff see counts, never names.

My Class records are deleted 18 months after your last visit, and we email you 30 days before.

Items you save, such as worksheets and printables, are kept in your account in the region you chose and are deleted with it.

We use your data only for these reasons, each with its legal basis:

• To run your account and the board you signed up for: sign-in, your screens and your name lists. Basis: our contract with you, the terms of service.
• To keep the service and your account safe: bot checks at sign-in, security logs and error reports. Basis: our legitimate interest in a secure service.
• To learn which tools teachers use, with Google Analytics 4. Basis: your consent in the EU, the UK and India; elsewhere, our legitimate interest in knowing which tools are used.
• To keep the records the law asks of us, such as the consent records above. Basis: our legal obligations.

In India, under the Digital Personal Data Protection Act, 2023, we use your data on the basis of the consent you give when you create your account.

You choose a region when you create your account: the United States, Europe (Germany) or Singapore. Your account and everything in it is stored only in that region and never moves. Backups stay in the same region.

Two things are kept outside your region: customer and payment data with Stripe, and a lead in Odoo CRM, as the sections on payments and Odoo CRM explain.

So that one email address cannot hold two accounts, a one-way code made from your email address, never the address itself, is kept in our Europe region.

Pages and requests travel through the Cloudflare network, which may route them through other countries; your data is stored only in your region.

Some companies that help us run the service are in other countries, as the sub-processors page shows. When data goes to them, we rely on the EU-US Data Privacy Framework where the company is certified, and otherwise on the EU standard contractual clauses and the UK addendum.

We never sell your data and never show ads. The companies that help us run the service receive only what their job needs; the sub-processors page lists each one, what it does and where.

See the sub-processors

We email tips and news only to teachers who tick the box for it, and one click stops it. The list is kept in Odoo.

For paid plans, OpenEduCat Inc. sells them and Stripe processes the payments in the United States.

We give data to a court or the police only when the law requires it.

Teacher Plus is sold by OpenEduCat Inc., the seller of record. Stripe processes the payment and works out the tax.

You enter your card details on Stripe’s own checkout page, so they never reach us. Stripe keeps customer and payment data in the United States, outside your region.

We keep your plan and its dates in your account, with a payment reference from Stripe.

We create a lead in Odoo CRM, our customer system, only if your role is school office or IT, if you run a school workspace, or if you choose Recommend to my school. The lead holds your contact details and your school, or the school and the person you name.

Apart from payment data with Stripe, Odoo CRM is the one exception to the region rule: a lead is kept there wherever your account is. Our Odoo database is in Germany.

No student data ever goes to Odoo CRM, and the roles parent or other adult and other never become leads.

A school workspace keeps its members and settings in its admin’s region, and its admins see class summaries only, with each teacher’s consent.

We use Google Analytics 4 to learn which tools teachers use. In the EU, the UK and India it loads only after you agree. It never loads on a page a student can reach, such as the vote page.

We use only the cookies and storage below. The Google Analytics cookies are set only after you accept them where the law asks for consent; the others are needed for the service to work.

• Records are deleted 18 months after your last visit.
• We email you 30 days before that happens, so you can sign in and keep your account.
• When you delete your account, it closes at once and a restore link works for 7 days; after that everything is deleted within 24 hours and we email you.
• Earlier versions of a screen are kept for 30 days.
• Backups are kept for up to 12 months and then deleted. If we ever restore a backup, accounts deleted since then are deleted again.
• Mailgun keeps the log of sign-in emails for 30 days, Sentry keeps error reports for 30 days and our servers keep their logs for 30 days. Security events are kept for 90 days.
• Consent records are kept while your account exists and for 3 years after it is deleted. After the deletion they hold only the kind of consent, the version, your choice and the time, linked to a scrambled copy of the account number.
• NPS answers and page feedback are pseudonymised at 12 months and deleted at 24.
• Credential logs are kept for 90 days.
• Support ticket text and the sender’s address are deleted 24 months after the ticket closes.
• Your ideas board account is deleted with your account.
• Payment records are kept as long as the tax rules require; Stripe holds the card data and Stripe Tax the tax records.

You can ask to see the data we hold about you, to correct it, to delete it and to get a copy in a file you can reuse. Where we rely on your consent, you can withdraw it at any time; this does not change what was done before.

To use a right, write to the grievance officer named below from the email address of your account. We confirm it is you by asking you to sign in to that account, and we answer within 30 days.

In the EU, the UK and India, where we ask for your consent, you can change your analytics choice at any time: choose Cookie settings at the foot of this page and the banner shows again.

If you are not happy with our answer, you can complain to a data protection authority: in the EU or the UK, the authority where you live or work; in India, the Data Protection Board of India; in Singapore, the Personal Data Protection Commission.

In India, our grievance officer answers questions and complaints about your data.

• NameParthiv Patel, CEO
• Emailprivacy@openeducat.org

More about the grievance officer

In Singapore, our data protection officer answers questions about your data under the Personal Data Protection Act.

• NameParthiv Patel, CEO
• Emailprivacy@openeducat.org

More about the data protection officer

When we change this policy in a way that matters to you, we email you before the change takes effect. The version number at the top of this page changes with every new version.

This text is published in eight languages. If a translation differs from the English text, the English text applies.