School data privacy policy

1. Scope and important definitions

Schoolyi ("Schoolyi", "we", "our", or "us") provides cloud school management software for K-12 schools. This Privacy Policy explains how we handle personal information on the public Schoolyi website, in a demo or contact request, and in the Schoolyi application operated by a school or education group.

The words "school", "institution", or "customer" mean the school or education group that licenses and configures Schoolyi. "Schoolyi application data" means information entered into that customer environment, including student, guardian, staff, academic, attendance, fee, admissions, and payroll records.

This page is a public overview. A school customer agreement, data processing addendum, order form, or applicable local law may provide more specific terms. If those documents conflict, the applicable customer agreement controls for the relevant school application data.

2. Information collected on the public website

When you browse Schoolyi marketing pages, read a guide, use a public planning tool, or request a demo, we may collect information you choose to provide and technical information needed to operate and protect the website. We do not sell contact or demo-request information to third-party advertisers.

• Contact and demo details: name, email address, phone number when provided, school or organization, role, country, preferred contact details, and message
• Public admissions details: information a prospective family submits to a school through that school’s public application flow, which is handled for the school’s admissions process
• Technical and security data: IP address, browser or device metadata, request timestamps, referrer information, and security events
• Preferences and usage information: cookie choices, pages viewed, tool interactions, and campaign attribution where those features are enabled

3. School application data and responsibilities

For school application data, the school or education group is generally the data controller or equivalent decision-maker. Schoolyi acts as the service provider or processor that hosts, secures, and operates the application according to the customer’s instructions and configuration.

A school decides what it collects, why it collects it, how long it keeps it, which roles can access it, and when records are exported or deleted. Role-based access scopes workspaces for administrators, teachers, admissions, finance, students, and families. A parent or student normally sees only the records the school has linked and published to that account.

For access, correction, portability, restriction, or deletion requests about records in a live school tenant, contact the school that operates your account first. Schoolyi helps the school respond through application permissions, exports, audit-friendly workflows, and account controls; the school remains responsible for its notices, lawful basis, consent, and statutory record-keeping.

• Identity and relationship data: names, dates of birth where configured, student or staff identifiers, guardian relationships, class placement, and profile details
• Education and operations data: admissions applications, documents, attendance, timetable, homework, grades, exams, report cards, certificates, transport, library, and communications
• Finance and workforce data: fee structures, invoices, payments, receipts, waivers, payroll, leave, vendors, and related approvals where the school enables those modules
• Account and audit data: login identity, role, school membership, verification state, activity history, and records of important changes

4. Why information is used

We use personal information only for a specific operational purpose and only to the extent reasonably needed for that purpose. The exact purposes for school application data are set by the school’s configuration and instructions.

• Respond to questions, demo requests, quote requests, support requests, and procurement questionnaires
• Provide, authenticate, maintain, troubleshoot, and secure the Schoolyi application
• Create and manage school accounts, roles, invitations, linked family accounts, and permissions
• Run admissions, student records, classes, timetable, attendance, teaching, homework, grades, exams, fees, payroll, HR, transport, library, communication, and reporting workflows enabled by the school
• Monitor reliability, prevent abuse, investigate security events, maintain audit trails, and improve product usability
• Meet contractual, legal, regulatory, accounting, and safety obligations when applicable

5. Legal grounds and school notices

For website inquiries, we may rely on the steps needed to respond to your request, our legitimate interests in operating and protecting the website, consent where the law requires it, and legal obligations. We do not infer a single legal basis for every visitor or every country.

For school application data, the school determines the appropriate legal basis and gives families, students, staff, and other individuals the notices required by applicable law. Schools should configure collection, publication, retention, and access according to their local education and privacy requirements.

Where a school uses optional integrations, online payments, messaging, analytics, or other connected services, the school should explain those services in its own notices and configure them appropriately.

6. Sharing, service providers, and disclosures

We may disclose information to companies and people that help us provide the website and Schoolyi service, such as hosting, infrastructure, security, communications, support, analytics, document, payment, or other service providers. Those providers receive the information needed for their defined service and are expected to protect it under their agreement with us.

We may disclose information when required by law, legal process, or a valid governmental request; to protect the rights, safety, and security of Schoolyi, a school, or another person; to investigate fraud or abuse; or as part of a merger, acquisition, financing, or sale of business assets subject to appropriate protections.

We do not sell personal information from contact requests or school application data. We do not use student records from a school tenant to build advertising profiles.

• School personnel and authorized users, according to the school’s roles and permissions
• Contracted service providers acting on our or the school’s instructions
• Payment, messaging, identity, or other integrations enabled by the school
• Authorities, professional advisers, or transaction participants where a lawful disclosure is required or permitted

7. Retention, export, and deletion

We keep public inquiry information for as long as reasonably needed to respond, manage a business relationship, maintain records, resolve disputes, prevent abuse, and meet legal or accounting obligations. When it is no longer needed, we delete it, anonymize it, or securely restrict it where appropriate.

For school application data, the customer school controls retention periods, account provisioning, exports, and deletion subject to its legal and educational record obligations. Copies in backups, security logs, or disaster-recovery systems may remain for a limited period and are protected until they are overwritten or securely deleted.

A school or authorized administrator can request customer data export or account changes through the agreed support and contract process. Individuals should contact their school for a request about a school record.

8. Authentication and security controls

Schoolyi uses authenticated sessions and role-based access controls to limit what each account can view or change. Passwords are hashed; we do not store plain-text passwords. Schools provision staff, student, and parent accounts according to their policies.

Sensitive workflows such as fee adjustments, grade publishing, payroll, exports, and school settings are designed to respect role boundaries. Operational activity can be recorded for review. No online service can guarantee absolute security, so schools and users should use unique passwords, protect invitations, and report suspected account misuse promptly.

For a product-level explanation of access controls, audit practices, and deployment considerations, read the Security Overview and Student Data Privacy Guide linked below.

9. Cookies, analytics, and similar technologies

Schoolyi may use essential cookies or comparable storage for security, session continuity, preferences, and reliable form operation. Where optional analytics are enabled, they help us understand which public pages and guides are useful and improve the website.

You can manage cookies through your browser and, where available, the site’s consent controls. Blocking essential cookies can prevent secure forms or authenticated features from working. A school’s application may have additional cookie, logging, or monitoring settings described in the school’s own notices.

10. International processing and regional requirements

Schoolyi serves schools and education groups in multiple regions. Depending on the customer’s deployment, support model, and enabled integrations, information may be processed in a country different from the one where an individual lives or where the school operates.

Schools evaluating Schoolyi should confirm hosting region, subprocessors, transfer mechanisms, backup practices, and contractual data protection terms during procurement. Where applicable, customer agreements may include a data processing addendum and appropriate transfer terms. Regional requirements can differ, including GDPR or UK GDPR, FERPA-oriented school processes, COPPA considerations, and local education privacy laws.

References to a privacy or security framework describe support for relevant operational practices; they are not a promise that a school is automatically compliant. Compliance depends on the school’s configuration, contracts, notices, policies, and use of the service.

11. Children and family information

Schoolyi is a school-management service, not a child-directed advertising service. A school may enter or collect information about students and children as part of admissions, enrollment, education, safeguarding, attendance, fees, examinations, or family communications.

The school is responsible for the notices, permissions, consent, age-appropriate design, and lawful basis required for its students and families. Parents, guardians, and students should direct requests about records or account links to the school administrator.

12. Privacy rights and how to contact us

Depending on where you live and why your information is processed, you may have rights to request access, correction, deletion, portability, restriction, objection, or withdrawal of consent. Some rights are limited by law, educational record duties, security needs, or the school’s controller responsibilities.

For a Schoolyi website inquiry, submit a request through our Contact page and explain the email address or inquiry you want us to locate and the action you are requesting. For a student, family, staff, or other record in a school tenant, contact the school administrator or data protection contact first so the request can be verified and handled by the responsible controller.

Do not include passwords, identity documents, medical details, or other unnecessary sensitive information in a public contact form. We may need to verify identity or authority before completing a request.

13. Changes to this policy

We may update this Privacy Policy when our website, application, service providers, or legal obligations change. We will update the date at the top of this page and, where appropriate, provide additional notice through the website, application, or customer communication.

The current version is always available at /privacy. Schools should maintain their own current privacy notices for the data and workflows they operate through Schoolyi.

14. Contact Schoolyi

For questions about this website, a contact request, or Schoolyi privacy practices, use the Contact page. For data held in your school’s deployment, contact your school administrator or designated privacy contact first.

Related reading includes the Security Overview, Student Data Privacy Guide, Certifications and Compliance references, and role-based access guidance for school teams.