Privacy Policy

1. Data we collect

• Account data — email address, display name, optional avatar, password (stored only as a salted hash), language and theme preferences.
• Workspace content — courses, assignments, submissions, grades, schedules, certificates, reward history, and messages your organization creates in its workspace.
• Billing data — plan, subscription status, and payment references. Card details are collected and processed by Paddle, our merchant of record; we never see or store card numbers.
• Technical data — server logs (IP address, request metadata) kept for security and debugging, and error reports if our error-monitoring service is enabled.

We do not run advertising or cross-site tracking of any kind.

2. Students and minors

Student accounts are created and managed by the student’s school or organization, which decides who joins its workspace and remains responsible for obtaining any consent required from parents or guardians. We process student data solely to provide the Service to that organization, never for advertising, profiling, or sale.

3. How we use data

• to operate the Service: authentication, workspace features, support;
• to bill subscriptions through our payment provider;
• to send transactional email (verification, invitations, receipts) — never marketing without consent;
• to keep the Service secure: abuse prevention, rate limiting, audit trails;
• to provide AI-assisted features when a workspace uses them: the relevant content excerpt (e.g. an assignment being drafted, or the exercise a student requests a hint for) is sent to our AI provider to generate the response; AI providers are not permitted to use this data to train their models under the terms we rely on.

4. Cookies and local storage

There are no analytics or advertising cookies. Paddle sets its own cookies inside the checkout window it operates.

5. Who processes data for us

• Railway — cloud hosting for the application and databases;
• Amazon Web Services (S3) — storage of uploaded media files;
• Paddle — payments, taxes, and receipts as merchant of record;
• Google (Gemini API) — generation for AI-assisted features, only when a workspace uses them;
• Email delivery provider — transactional email;
• Sentry — error monitoring (technical error context only), when enabled.

Each provider receives only what its function requires and is bound by its own data-processing terms. Data may be processed in the EU and/or the United States under appropriate safeguards.

6. Retention and deletion

Account and workspace data is kept while the account or workspace is active. When an organization’s workspace is deleted, its content is removed from production systems within 30 days; encrypted backups expire on their own rolling schedule. Server logs are retained for a short operational window. Billing records are kept as long as tax law requires.

7. Your rights

You may request access to, correction of, export of, or deletion of your personal data at support@sashik.school. For data inside a school’s workspace we may redirect the request to the organization that administers it, since it controls that workspace. You may also lodge a complaint with your local data-protection authority.

8. Security

All traffic is encrypted in transit (TLS). Passwords are stored as salted hashes. Access to production systems is restricted and credentialed; payment card data never touches our infrastructure. No system is perfectly secure — if a breach affects your data, we will notify affected users and authorities as the law requires.

9. Changes and contact

We will announce material changes to this policy in the Service or by email before they take effect. Privacy questions: support@sashik.school.