Privacy Policy

Introduction

This Privacy Policy of LEARNSPRING LIMITED ("Schoolea") explains how we collect, use, disclose, and protect your personal information when you use our event scheduling platform. By using any Schoolea website or service, you consent to the data practices described in this policy.

Schoolea operates as a data processor on behalf of schools and educational institutions (our customers, who act as data controllers). This policy applies to:

• School staff and administrators
• Event attendees (parents, guardians)
• Students whose information is provided by parents or school administrators

We are committed to protecting your privacy and handling your information responsibly. This policy may be updated from time to time, and we will post the most recent version on our website.

What Information We Collect

Information You Provide Directly

Account Information:

• Name
• Contact information (optional)
• Communication preferences and email opt-in status
• Two-factor authentication settings (if enabled)

Student Information:

• Student names (provided by parents/guardians)
• Custom information as configured by your school or organization

Event Registration and Bookings:

• Appointment time slot selections
• Booking preferences and priorities
• Staff member selections
• Comments or notes for specific bookings
• Custom form responses (registration, booking, and feedback forms)

Payment Information for Customers:

• Payment method details (stored securely by Stripe, not on our servers)
• Billing contact information
• Transaction history

Information Collected Automatically

Usage Data:

• IP address, browser type, and operating system
• Pages visited and features used
• Login/logout times and session duration
• Browser user agent

Technical Data:

• Session identifiers
• Error logs and crash reports
• System performance metrics
• API access logs

How We Use Your Information

We use your information to:

Provide Our Services:

• Create and manage user accounts
• Process event registrations and bookings
• Generate schedules and timetables
• Send booking confirmations and event reminders
• Provide calendar exports (.ical files)

Communicate With You:

• Send transactional emails (confirmations, password resets, account notifications)
• Send event reminders (only to attendees who have opted in)
• Request feedback after events (only to opted-in attendees)
• Respond to support inquiries
• Send service updates and announcements

Improve Our Services:

• Analyze usage patterns to enhance features
• Generate aggregated and anonymized statistics and reports for schools and organizations
• Monitor system performance and identify issues

Ensure Security and Compliance:

• Maintain audit logs for security purposes
• Detect and prevent fraud or abuse
• Comply with legal obligations
• Enforce our Terms of Service

How We Share Your Information

We do not sell your personal information. We share information only in these circumstances:

With Your School or Organization

Your event registration, booking, and form response data is shared with your school or organization, as they are the data controller requesting this information for event management.

With Service Providers

We use trusted third-party service providers to help operate our platform. All service providers are contractually obligated to protect your data and use it only to provide services to us.

See List of Subprocessors for more information.

For Legal Reasons

We may disclose information if required by law, court order, or government request, or to:

• Comply with legal obligations
• Protect our rights, property, or safety
• Prevent fraud or security threats
• Respond to emergencies

Business Transfers

If Schoolea is acquired or merged with another company, your information may be transferred to the new entity, subject to the same privacy protections.

Data Retention and Automatic Anonymization

How Long We Keep Your Data

To protect your privacy, we automatically anonymize event data 90 days after an event's last active date. This irreversible process removes all personally identifiable information (names, emails, phone numbers, students, booking forms, registration forms) Once anonymized, data cannot be recovered. Please export any needed information before this occurs.

Data Security

We implement robust security measures to protect your information:

• All data encrypted in transit using TLS/HTTPS
• Data encrypted at rest in our database and file storage
• Passwords hashed and never stored in plain-text.
• Role-based access controls with strict permission hierarchies
• Multi-tenant data isolation
• Two-factor authentication available for staff accounts
• Single sign-on (SSO) support for enhanced security
• Comprehensive audit logging of sensitive operations
• All uploaded files scanned for viruses before storage

While we use industry-standard practices to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to protecting your information.

Your Privacy Rights

You have the following rights regarding your personal information:

Access and Portability

• Access your personal information at any time
• Export your event timetable as PDF
• Request a copy of all data we hold about you

Correction and Updates

• Update your account information, student details, and preferences
• Correct any inaccurate information
• Access these features through your account settings

Deletion

• Request deletion of your account and associated data
• We will process deletion requests within 30 days
• Note: Some data may be retained as required by law (e.g., billing records)

Communication Preferences

• Opt out of non-essential communications at any time
• Update email preferences in your account settings
• Click "unsubscribe" links in emails

Children's Privacy

Our service is designed for use by parents, guardians, and school staff. We do not knowingly collect personal information directly from children under 13 without parental consent.

Student information (names) is provided by parents or guardians during event registration. If you believe we have inadvertently collected information from a child without proper consent, please contact us, and we will take steps to remove that information.

International Data Transfers

Our services are primarily hosted in AWS data centers in Australia. By using our services, you acknowledge and consent to the transfer, storage, and processing of your information in Australia and potentially other countries where our service providers operate.

We ensure appropriate safeguards are in place for international data transfers, including:

• Using cloud providers with global compliance certifications
• Implementing standard contractual clauses where required
• Following data protection regulations applicable to our customers' locations

Cookies and Tracking

We use cookies and similar technologies for essential platform functionality:

• Authentication and session management
• Security features and fraud prevention
• Core platform functionality

You can control browser cookies through your browser settings, but disabling them may affect platform functionality. Essential cookies required for authentication cannot be disabled while using the service.

We do not use third-party advertising or tracking cookies.

Third-Party Links

Our platform may contain links to external websites (such as virtual meeting rooms or school websites). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any information.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, new features or services, legal or regulatory requirements, or security improvements. Your continued use of our services after changes are posted constitutes acceptance of the updated policy.

Data Protection and Contact Information

For Privacy Inquiries:

• Email: Contact our support team
• Response Time: Within 5 working days

To Exercise Your Rights (access, deletion, correction):

1. Use the Account/Settings page to edit information relating to your account
2. Attendees: Use the Account/Settings page to delete your account
3. Contact your school or organization
4. Contact our support team

To Verify Your Identity: To protect your privacy and the privacy of others, we may need to verify your identity before providing access to or changing information about you.

List of Sub-Processors

We use sub-processors to provide our services. All sub-processors are reviewed for compliance with data privacy regulations, and we have data processing agreements in place.

Sub-Processor	Purpose	Country
Amazon Web Services (AWS)	Cloud infrastructure, database, file storage, sessions	Australia
Stripe	Payment processing and subscription billing	United States
Mailgun	Transactional email delivery	United States
Xero	Invoicing and accounting	New Zealand
Raygun	Error tracking and monitoring	United States
Cloudflare	Content delivery network and bot protection	United States

Consent and Agreement

By using Schoolea services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your information as described herein.