Privacy policy

On the website: the information you enter in a form (name, email, optional phone, school, role, country, school size, message), the language, the page of origin and, where present, campaign parameters in the address (utm, click identifiers) and the referring site.

On the portal: account data (name, email, role, school, language, notification preferences, push notification subscription), and the educational content created by the school and its users: posts, messages and attachments, homework and submissions, grades and report cards, attendance and excuse notes, events, points and skills, portfolio.

For a pupil, data is limited to name, class and school work. We collect no home address, no national ID number, no health or biometric data, no location data. The avatar is an illustration, never a photo by default.

Technical logs: IP address, browser, timestamps of sign-ins and sensitive actions, for security purposes.

Replying to your requests (contact, demo): pre-contractual measures and legitimate interest.

Providing the service to schools and their users: performance of the contract signed with the school.

Securing the service (abuse prevention, audit log): legitimate interest and legal obligations.

Meeting our legal and accounting obligations.

We never use data for advertising, commercial profiling or resale.

Within a school: only people authorised by their role — a teacher sees their classes, a parent their linked children, the head teacher their school. These rules are verified on the server.

At AJ SRL: the technical team, for support and maintenance, with a justification recorded in the audit log.

Our technical processors: Supabase (hosting of the database and files, eu-west-1 region, Ireland), Vercel (hosting of the website and execution of the forms), Resend (sending of transactional emails; data transmitted: email address, name and message content). [to be completed: Resend sending region and applicable transfer safeguards]

No data is sold, rented or passed on to third parties.

Portal accounts and data: for the duration of the school's contract, then 12 months, before deletion or anonymisation.

Messages: according to the retention period chosen by the school in its settings.

Technical and security logs: 12 months.

Requests received through the website (contact, demo): 24 months after the last exchange.

Report cards and documents the school must keep under its own obligations remain its responsibility; it can export them at any time.

A pupil account is always created by the school, never by the child. Parents or legal guardians can view their child's data from their space and exercise their rights on their behalf.

Linking a parent to a child is never automatic: it is approved by the school. No child profile is visible outside their school and there is no ranking between pupils.

You have the rights of access, rectification, erasure, restriction, objection and portability of your data, as well as the right to withdraw your consent where processing is based on it.

To exercise them: write to hello@monschool.app or contact your school, which remains the controller for the portal. We reply within one month.

You can lodge a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be). In Cameroon, Law No. 2010/012 on cybersecurity and cybercrime applies in addition; the National Agency for Information and Communication Technologies (ANTIC) is the reference authority.

Hosting in the European Union, encryption of exchanges (TLS) and of data at rest, role-based access verified on the server, private files served through one-hour signed links, audit log of sensitive actions, account lock-out after several failed sign-ins.

We do not claim any certification we have not obtained. In the event of a data breach likely to result in a risk to your rights, we inform the school concerned and, where the law requires it, the supervisory authority within 72 hours.

Only technical cookies are used: the chosen language and, on the portal, the authentication session. No advertising cookie or third-party tracker. The website may load a tag management tool only if the publisher configures it; in that case, this policy and the website will be updated to collect your prior consent.

This policy may evolve with the product. The last update date is shown at the top of the page; significant changes are announced to schools.

For any question: hello@monschool.app — AJ SRL, [to be completed — registered office address], Belgium.