Scholaxy Privacy Policy
1. About this Policy
1.1 This Privacy Policy explains how Scholaxy ("Scholaxy", "we", "us") collects and uses personal data as a controller in connection with:
- our website at scholaxy.com (the "Website");
- the Hub, our central management system, where schools sign up, manage their account, subscription and billing, accept our terms and contact support;
- the people who act for our customers, such as account owners, administrators and billing contacts ("Customer Representatives");
- support requests, including conversations with our AI support assistant;
- the Scholaxy mobile app for iPhone and Android, to the extent described in Section 13; and
- people who contact us by email or through forms on the Website.
1.2 Data inside a school's installation: the school is the controller. Each of our customers (a "School") has its own separate Scholaxy installation. The School is the controller of the personal data processed in its installation, including data about its students, parents or guardians, staff, leads, webinar participants, message recipients and website visitors. We process that data only on the School's behalf and on its instructions, as its processor, under our Data Processing Agreement. This Policy does not cover that processing.
If you are a student or another user of a School, please read the School's privacy notice and contact the School to exercise your rights. If you contact us instead, we will forward your request to the School when we can identify it, and tell you that we have done so.
1.3 Our services are for running an educational activity, not for personal learning. This Policy concerns individuals who act for our business customers, customers who are individuals, individuals who contact us, and visitors to our Website. Students and other users of Schools may use the Scholaxy mobile app; Section 13 explains the limited data the app itself handles.
2. Who we are
| Role | Details |
|---|---|
| Controller | SVESHEDUTECH L.L.C-FZ, a Meydan Free Zone limited liability company, business licence no. 2314401.01, formation no. 2314401, with its registered address at Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates, operating under the Scholaxy brand |
| Privacy contact | privacy@scholaxy.com |
| EU representative (Article 27 GDPR) | Not yet appointed |
| UK representative (Article 27 UK GDPR) | Not yet appointed |
3. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, business email, phone number, School or company name, role, country, preferred language, password (stored only as a hash), two-factor authentication settings | You, or the colleague who created the Account |
| Business information | Legal entity name (or the full name of an individual customer), address if given, country, VAT or business registration number if given | You |
| Document acceptance records | Which document and version was accepted, by which user, date and time, IP address | Created when you accept |
| Billing data | Billing contact name and email, billing address, plan, invoices, payment history and status, Stripe customer identifier, and limited card details provided by Stripe (such as card brand and last four digits). We do not receive or store full card numbers. | You, Stripe |
| Service and usage data | Hub activity and security logs, IP address, browser and device information, and usage counts of the School's installation used for billing (numbers of Active Students, storage and AI replies) | Collected automatically |
| Support data | Messages and attachments, conversations with the AI support assistant, machine translations of messages, records of support access granted to an installation and of each access | You, our staff, our systems |
| Communications | Correspondence with us, service announcements, marketing preferences | You, our systems |
| Website data | IP address, pages visited, referring page, device and browser data, cookie identifiers (see Section 11) | Your browser |
We do not intend to collect special categories of personal data. Please do not include such data, or personal data of students, in support requests unless it is needed to resolve the request.
4. Why we use personal data and our legal bases
Where the GDPR or the UK GDPR applies, we rely on the legal bases below. Where other laws apply, we process personal data in accordance with them.
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Creating and managing the Account; provisioning and operating the School's installation; providing the Hub | Contract (Art. 6(1)(b)) if you contract in your own name; otherwise our legitimate interest in performing our contract with the customer you represent (Art. 6(1)(f)) |
| Verifying status and location; tax compliance; sanctions screening | Legal obligation (Art. 6(1)(c)) where EU or UK law requires it; otherwise our legitimate interest in complying with the laws that apply to us and in selling only to customers we are allowed to serve (Art. 6(1)(f)) |
| Billing, collecting payments, keeping accounting records | Contract or legitimate interests, as above; legal obligation for record-keeping where applicable |
| Recording acceptance of our terms and policies | Legitimate interest in proving what was agreed, when and by whom (Art. 6(1)(f)) |
| Answering support requests, including through the AI support assistant and machine translation | Contract, or legitimate interest in providing efficient support in several languages (Art. 6(1)(f)) |
| Managing support access to installations and keeping access logs | Legitimate interest in security and accountability; also required by our contract with the School |
| Security, fraud and abuse prevention; enforcing our terms | Legitimate interest in protecting our service, customers and users (Art. 6(1)(f)) |
| Service communications, such as security notices, changes to terms and billing notices | Contract or legitimate interests |
| Marketing emails about our products | Consent (Art. 6(1)(a)), or legitimate interest where the law allows it for existing customers. You can opt out at any time. |
| Improving the Service using aggregated statistics | Legitimate interest in developing our products (Art. 6(1)(f)) |
| Establishing, exercising or defending legal claims; responding to lawful requests from authorities | Legitimate interest; legal obligation where applicable |
| Non-essential cookies on the Website | Consent (Art. 6(1)(a)) |
Where we rely on legitimate interests, you can ask us for information about the balancing test we carried out.
5. AI support assistant and machine translation
5.1 When you contact support, an AI support assistant gives the first answer. It is labelled as an AI assistant. A human member of our staff takes over when needed, or when you ask for a human.
5.2 Our support staff may not speak your language. So that they can read and answer your message, it may be machine-translated by an AI provider, currently Anthropic PBC (USA). Their reply is translated back, so you receive it in your language (English or Spanish). Machine translation may contain errors.
5.3 The AI provider processes your messages on our behalf and only to provide these functions.
5.4 We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
6. Who we share personal data with
6.1 Service providers acting on our behalf. Each is bound by a contract that requires it to protect personal data.
| Provider | Purpose | Location |
|---|---|---|
| Netcup GmbH | Hosting of the Hub, all installations, the Website and crash reports of the Scholaxy app | Germany |
| Hetzner Online GmbH | Storage of encrypted backup copies (without access to the encryption keys) | Germany |
| Stripe | Card payments for prepaid periods | Ireland / USA |
| Resend | Delivery of transactional emails | USA |
| Anthropic PBC | AI support assistant; machine translation of support messages | USA |
| GitHub / Microsoft | Source code hosting and deployment automation (no personal data intended) | USA |
Stripe also processes some data as an independent controller, for example for fraud prevention and its own legal obligations, under its own privacy policy.
6.2 The customer you represent. Other authorised representatives of the same customer may see information about the Account, subscription, invoices and support requests.
6.3 Professional advisers, such as lawyers, accountants and auditors, who are bound by confidentiality.
6.4 Authorities, where applicable law requires it or where needed to protect our rights, our users or others, after we have assessed the request.
6.5 Buyers or successors in a merger, acquisition or sale of assets. They will be bound by this Policy.
6.6 Complaints about a School. If an End User, a payment provider or an authority complains about a School's offerings, we may give them the School's name and business contact details.
6.7 We do not sell personal data. We do not share it for cross-context behavioural advertising.
6.8 App stores. Apple and Google distribute the Scholaxy app through the App Store and Google Play. They process data about your download and use of their stores as independent controllers, under their own privacy policies.
7. Where personal data is processed; international transfers
7.1 The Hub and all installations are hosted in Germany (EU) by Netcup GmbH. Encrypted backup copies are stored in Germany by Hetzner Online GmbH.
7.2 We are established in the United Arab Emirates, and our support and engineering staff access personal data remotely from there. The European Commission does not recognise the United Arab Emirates as providing adequate protection.
7.3 Some of our service providers (see Section 6) process personal data in the United States.
7.4 When personal data protected by the GDPR or the UK GDPR is transferred to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses (with the UK Addendum for UK data). Where a US recipient is certified under the EU-US Data Privacy Framework (and its UK Extension), we may rely on that certification instead. We add supplementary measures: access control, mandatory two-factor authentication for our staff, encryption in transit, access logging and data minimisation for remote access. You can ask for a copy of the relevant safeguards at privacy@scholaxy.com.
8. How long we keep personal data
| Data | Retention period |
|---|---|
| Account data | For the life of the Account, then 90 days after it is closed, unless needed for a purpose below |
| Business information, invoices and payment records | 5 years after the end of the financial year to which they relate |
| Document acceptance records | For the life of the Account plus 6 years |
| Support requests and translations | 24 months after the request is closed |
| Support access logs | For the life of the installation plus 12 months |
| Hub security and access logs | 12 months |
| Crash reports of the Scholaxy app | 90 days |
| Website analytics data | As set out in the cookie list |
| Marketing preferences | Until you opt out. After that we keep a suppression record so that your opt-out is respected. |
We may keep data for longer where we need it to establish, exercise or defend legal claims or to comply with a legal obligation.
9. Security
We protect personal data with technical and organisational measures appropriate to the risk. They include:
- encrypted (TLS) connections;
- mandatory two-factor authentication for all our staff;
- separate installations, each with its own database and encryption keys;
- regular backups;
- logging of access to our systems; and
- support access to a School's installation only when the School grants it, for a limited time and a specific request, with every access logged and visible to the School.
No system is completely secure. If a personal data breach is likely to result in a high risk to you, we will inform you as the law requires.
10. Your rights
10.1 Subject to the conditions and exceptions in the law, you have the right to:
- access your personal data and receive a copy;
- have inaccurate data corrected;
- have data erased;
- restrict processing;
- receive data you provided in a portable format;
- object to processing based on legitimate interests; and
- withdraw consent at any time, without affecting processing that took place before.
You can object to direct marketing at any time.
10.2 To exercise these rights, write to privacy@scholaxy.com. We will reply within one month. We may extend this by two further months for complex requests, and if we do, we will tell you. We may need to verify your identity. There is normally no fee.
10.3 You have the right to complain to a supervisory authority. In the EU, this is the authority of your habitual residence, your place of work, or the place of the alleged infringement. In the UK, it is the Information Commissioner's Office.
10.4 For data held in a School's installation, please contact the School, which is the controller.
10.5 If you are outside the EEA and the UK, you may have similar rights under your local law. Contact us, and we will respond as that law requires.
11. Cookies and similar technologies
11.1 The Website and the Hub use strictly necessary cookies for sign-in, security, load balancing and remembering your language. They do not require consent.
11.2 We use analytics or marketing cookies only with your consent, which you give or refuse through the cookie banner. You can change your choice at any time in the cookie settings. You can ask us for the current list of cookies at privacy@scholaxy.com.
11.3 Cookies set by a School's installation or website are under the School's control. The School is responsible for its own cookie notice and any consent it needs.
12. Children
The Website and the Hub are for users aged 18 or over who run an educational activity. They are not directed at children. As a controller, we do not knowingly collect children's personal data. If a child's data reaches us in a support request, we handle it under our Data Processing Agreement with the School, or delete it. Students of a School, who may be children, are covered by the School's privacy notice (Section 1.2).
13. The Scholaxy mobile app
13.1 The Scholaxy app for iPhone and Android lets students and other users of Schools open their School's installation on a phone. The app shows the School's installation in a built-in browser. Everything you do there, such as signing in, studying, submitting assignments and sending messages, is data of the School's installation, and the School is its controller (Section 1.2). This Section covers only the data that the app itself handles.
13.2 Data kept only on your device. The app keeps on your phone the list of Schools you added (name, address and icon of each School) and your app settings, such as whether the app opens with Face ID or a fingerprint. We do not receive this data. Removing a School from the list or deleting the app deletes it.
13.3 Finding a School. To find a School, the app sends the Hub what you entered: the School's address, a link to it or its code. When you scan a QR code, the app sends only the School's address or code read from it. The content of any other QR code, such as a Wi-Fi password or a contact card, is not sent. The Hub returns the School's name, address and icon. Like any request to the Hub, this request is recorded in the Hub security and access logs (Section 8).
13.4 Camera, microphone and photos. The app itself uses the camera only to scan a QR code after you tap "Scan QR code". That image is processed on your device and is not stored or sent anywhere. Pages of your School may ask to use the camera, the microphone or your photos, for example to join a live class or to attach homework. Your phone asks for your permission first, and you can withdraw it in the phone settings. What you send to the School this way is data of the School's installation (Section 13.1).
13.5 Face ID and fingerprint. If you turn on opening the app with Face ID or a fingerprint, your phone checks your face or fingerprint itself. The app receives only the result, whether the check passed. Neither we nor the School receive biometric data. Your School password does not change.
13.6 Crash reports. If the app crashes or stops responding, it sends us a crash report so that we can fix the error. A report contains the app version, the device model, the operating system version, the time and technical details of the error. It also contains a random identifier of the app installation, so that we can tell how many installations an error affects; the identifier is not linked to you or to your School account. A report does not contain your name, email address, School account, the content of School pages, screenshots or your IP address. We process crash reports on our servers in Germany on the basis of our legitimate interest in keeping the app working, and keep them for 90 days.
13.7 No purchases, advertising or tracking. Nothing can be bought in the app. The app shows no advertising, does not track you across other companies' apps or websites, and turns off the analytics counters of School websites. We do not sell data collected through the app.
13.8 Deleting your account. To delete your account at a School, open the School in the app or in a browser, sign in and go to "My profile" → "Your data" → "Delete account". The School keeps orders and payments without your name for its accounting. See also the "App" page of these documents. Deleting the app removes the data kept on your device (Section 13.2) but does not delete your account at the School.
13.9 The app may be used by students of any age whom a School admits. The School is responsible for its notice to students and, where needed, for consent of parents or guardians (Section 12).
14. Changes to this Policy
This Policy is versioned. We will notify Account Owners of material changes at least 30 days in advance, by email and in the Hub. Previous versions are available on request.
15. Contact
Scholaxy · privacy@scholaxy.com · EU representative: not yet appointed · UK representative: not yet appointed