01Who is responsible
Loghia is operated by [company legal name], [trade register number and tax ID], with its registered office at [registered office address] (“Loghia”, “we”). You can write to us about personal data at [privacy e-mail address].
Two roles apply, depending on the data:
- Your school is the controller of the data about its students, families and staff in the app. The school decides whom it enrols, what it records and how long it keeps it; we process that data on its behalf and only on its instructions, as its processor (GDPR Art. 28). Questions and requests about that data go to your school first — we help it answer.
- Loghia is the controller of the data we use for our own purposes: this website, keeping the service secure (sign-in protection, preventing misuse, the security log), crash diagnostics, and our relationship with the schools that use Loghia.
02What the app processes
What a school actually uses depends on how it works; nothing is collected “just in case”.
- Account and contact details — name, e-mail address, phone number, your role at the school (administrator, teacher, student, parent or guardian) and the school you belong to. Your password is handled by our sign-in provider and kept only as a one-way hash, so no one — neither we nor your school — can read it back. Children who sign in use a username set up by the school or their parent, not an e-mail address.
- Children and families — a child's name and date of birth (and gender, if the school records it), which parent or guardian the child belongs to, and when that parent gave consent, and to which version of the notice, before the child's profile was created.
- Details a school may add — an emergency contact (name and phone) and medical notes, such as an allergy. Medical notes are health data: a school records them only where they matter for the child's safety, with the explicit consent of the parent or the adult student.
- Lessons and learning — the timetable, individual and group lessons, attendance and lesson status (completed, cancelled, rescheduled), teachers' availability, which teacher teaches which student and subject, and the lesson notes and homework teachers write.
- Packages, credits and payments — the plans a student is enrolled in and their prices, lessons used and remaining, discounts such as a family discount, and whether the school has recorded a payment as received. The app takes no card payments and stores no card details.
- Contracts and school documents — for a service contract, what the school's contract form asks for: name, surname, personal identification number where the school's contract requires one (in Romania, the CNP), e-mail, phone, the service and its price, the signature drawn on the screen and the signed PDF. Also which version of the school's rules and privacy notice you accepted, and when.
- Notifications — the messages in your in-app inbox (for example, that a lesson was moved or cancelled, a contract was created or the school published a new document) and, if you allow notifications, your device's push token, its platform and the app version.
- Security data — when you sign in and, whenever the service refuses a request (for example, a screen your role may not open), a record of the account, school, what was requested, the time, the IP address and the app or browser identification (user agent). Our sign-in provider keeps its own security log of sign-ins.
- Crash reports — when the app crashes or hits an error, a diagnostic report with the app version, device model, operating system, the technical error, an internal account ID and your role. We do not attach your name or e-mail address.
The data comes from you, from your school (which creates profiles and may import its existing lists), from a parent for their child, from teachers (notes and homework) and from your device (push token, crash reports).
03Why it is used, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Running the school's service in the app: accounts, timetable, lessons, notes, homework, notifications | The contract between the school and the family, adult student or staff member (Art. 6(1)(b)); the school's legitimate interest in organising its teaching (Art. 6(1)(f)) |
| Creating a child's profile | The consent a parent gives in the app before the profile is created (Art. 6(1)(a) and Art. 8), together with the school's contract with the family (Art. 6(1)(b)) |
| Medical notes | Explicit consent (Art. 9(2)(a)) |
| Contracts, payments and accounting records | The contract (Art. 6(1)(b)) and the school's obligations under accounting and tax law (Art. 6(1)(c)) |
| Security: sign-in protection, preventing misuse, the security log | Legitimate interest in keeping the service and your data safe (Art. 6(1)(f)) |
| Crash reports | Legitimate interest in a reliable app (Art. 6(1)(f)) |
| Website statistics | Legitimate interest in knowing, in aggregate, how the site is used (Art. 6(1)(f)) |
| Answering your messages | Legitimate interest, or steps before a contract with your school (Art. 6(1)(f), 6(1)(b)) |
We do not sell personal data, show advertising or build marketing profiles. No decision with legal or similarly significant effects is taken by automated means alone: the app may suggest a discount, but school staff decide.
04This website
- No cookies, and no advertising or social-media trackers. Fonts are served from loghia.pro itself, so opening a page sends nothing to a font provider. See the cookie policy.
- Visitor statistics — Vercel Web Analytics counts page views from the page's address (without anything after “?” or “#”), the referring site, country, device type, browser and operating system. It sets no cookies and stores nothing on your device; Vercel tells visitors apart with an anonymous value derived from the request, which it discards after 24 hours.
- Server logs — our host, Vercel, processes technical data about each request (IP address, browser, the address requested, the time) to deliver and protect the site, and keeps it for a short time.
- The login-link page (/open) — invitation and password-reset e-mails open loghia.pro/open. The page runs in your browser: it reads the one-time sign-in details from the link, hands them to the app on your phone, removes them from the address bar and keeps them only in the open page. It stores nothing, sends none of them to us and is never counted in the statistics. To show your school's name it asks the Loghia service for that name, sending only the school ID from the link.
- E-mails you send us are used to answer you.
05Who can see it
- At your school — administrators see their school's data; teachers see the students, lessons, notes and availability they work with; parents see their own children; students see their own lessons, notes and homework. A school never sees another school's data.
- Our service providers, who process data only on our instructions and under data processing agreements:
- Supabase — database, sign-in and file storage (contracts and school documents). Data location: [data-centre region of the Supabase project].
- Vercel — hosting of the Loghia service and this website, and the website statistics;
- the e-mail delivery service our sign-in provider uses to send invitations and password-reset e-mails;
- Expo — delivery of push notifications, through Apple Push Notification service and Google Firebase Cloud Messaging;
- Sentry — crash reports from the app.
- Apple and Google distribute the app through the App Store and Google Play, under their own privacy policies.
- Public authorities, when the law requires it.
06Transfers outside the EU
Some of these providers are based in, or may access data from, the United States. Where personal data leaves the European Economic Area, the transfer relies on a European Commission adequacy decision — including the EU–US Data Privacy Framework for certified providers — or on the Commission's Standard Contractual Clauses, with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.
07How long it is kept
- While you belong to the school, your account and school records stay available to you and the school.
- Records the school must keep — contracts, payments and the lesson and credit history behind them — are kept for as long as accounting and tax law requires, even after you leave; once an account is deleted, they stay linked only to an anonymised profile.
- The security log of refused requests: 90 days.
- Push tokens: until you sign out, delete your account or the token stops working.
- Data kept on your phone for offline use: at most 24 hours, and it is wiped when you sign out or change school.
- Crash reports: kept by our crash-reporting provider for a limited period, at most 90 days.
- Login links work once and expire after a limited time.
- Website statistics are kept in aggregate only.
08Deleting your account
You can delete your account yourself, in the app: open Profile, scroll to the bottom and tap Delete account (under Sign out), then confirm.
- Deleted at once: your login; your name (replaced by “Deleted user”), e-mail address, phone number, date of birth, gender, emergency contact, medical notes and the acceptances recorded on your profile; your push tokens. Your membership of the school ends.
- Kept by the school: the records it is required or entitled to keep — lessons and attendance, lesson notes, contracts and signed documents, payment and credit history — linked only to the anonymised profile.
- A child's login: deleting it removes only the login; the child's profile stays with the parent and the school.
- Two exceptions: a school's last administrator must first make someone else an administrator, and a login shared by several schools is deleted by the school.
Can't use the app? Ask your school, or write to [privacy e-mail address] from the e-mail address linked to your account. We pass the request to your school and confirm once it is done, within one month.
09Your rights
Under the GDPR you can ask:
- to see the personal data held about you and get a copy;
- to correct it — much of it you can edit yourself in the app's Profile;
- to delete it, as described above, where the law does not require it to be kept;
- to restrict its use while a request is being checked;
- to receive the data you provided in a portable format;
- to object to uses based on legitimate interests;
- to withdraw consent at any time, without affecting what was done before.
For the data your school keeps in the app, contact your school; for this website or anything else, write to [privacy e-mail address]. We answer within one month — or, for complex requests, within two further months, in which case we tell you — and may ask you to confirm your identity. Parents and guardians can exercise these rights for their children.
You can also complain to a data protection authority: in Romania, the ANSPDCP (dataprotection.ro), or the authority where you live or work.
10Children
Loghia is built for schools that teach children. A child's profile is created by the school or by a parent, and the app records the parent's consent before the profile is created — in Romania, children under 16 need a parent's consent for online services. A parent can turn on a username login for their child; the child then sees their own lessons, notes and homework, while the parent keeps managing the profile.
11How the data is protected
- Every connection is encrypted (HTTPS).
- On your phone, your sign-in session is kept in the device's secure storage (iOS Keychain, Android Keystore).
- Passwords are kept by our sign-in provider only as one-way hashes.
- Every request is checked against your role and your school, so you see only what your role allows and each school's data stays separate.
- Refused requests are logged, and login links work once and expire.
No system is perfectly secure. If a breach puts your data at risk, the school and, where the law requires, the supervisory authority and the people affected are told without undue delay.
12What the app keeps on your phone
The app keeps your sign-in session, the school you chose, your settings and a short-lived offline copy of what you last loaded; the cookie policy lists each item and how long it stays. The app asks before sending notifications. It does not access your location, contacts, camera or photos, uses no advertising identifier and does not track you across other apps.
13Changes to this policy
When the app or this website changes how personal data is used, we update this policy and the date at the top. For significant changes we tell the schools that use Loghia in advance and, where the change affects you, let you know in the app or by e-mail.
14Contact
[company legal name], [registered office address] — [privacy e-mail address].