Privacy Policy

1. Who we are

SmartEduTrack is operated by Edusoft-BG Ltd., a company registered in Bulgaria with its address at ul. Lunna Nosht 4, Sofia, Bulgaria (“we”, “us”, “our”). We are the data controller for the personal data described in this policy, except where we act as a processor for schools and teachers as explained in section 2.

This Privacy Policy applies to:

• our website at smartedutrack.com;
• the SmartEduTrack web application at my.smartedutrack.com;
• the SmartEduTrack mobile applications for iOS and Android (together, the “Services”).

You can contact us about privacy at any time at hello@smartedutrack.com.

2. Our role for student data

SmartEduTrack is used by teachers and educational organisations. Students do not create accounts and do not use the apps. Teachers may enter information about their students, such as names and answers recorded during classroom activities.

For this student data, the school, kindergarten, or teacher who enters it is the data controller, and we act as a data processor. We process student data only to provide the Services on their behalf and according to their instructions, and never for our own purposes. A data processing agreement (DPA) is available to schools and organisations on request at hello@smartedutrack.com.

3. Information we collect

Information you provide

• Account information: your name, email address, password (stored only in hashed form), and optionally your school or organisation name.
• Sign in with Google: if you choose to sign in with Google, we receive your name, email address, and profile picture from Google. We do not receive your Google password.
• Student data entered by teachers: student names, student numbers, avatars, class membership, and answers and results from classroom activities.
• Content you create: classes, question sets, slides, uploaded images, audio, and video, and prompts you enter for AI image generation together with the generated images.
• Payment information: paid plans are purchased on our website and processed by Stripe. Stripe collects your card details directly; we never see or store your full card number. We keep your plan, billing status, and invoice records.
• Messages to us: your name, email address, organisation, and message when you use our contact form or email us.

Information collected automatically

• Device and usage data: IP address, browser type, device model, operating system, app version, language, and technical logs such as error reports and access times. We use this to operate, secure, and improve the Services.
• Website analytics: our website and web app may use Google Analytics cookies to understand how visitors use them. See section 12.

The mobile apps do not contain advertising and do not use third-party analytics or advertising SDKs.

4. Device permissions

The mobile apps ask for the following permissions only when you use the related feature:

• Camera: used to scan printed answer cards (ArUco markers) during classroom activities. Scanning happens entirely on your device. Camera images are not recorded, stored, or sent to our servers or to anyone else; only the detected answers are saved to the activity.
• Photo library: used only when you choose to upload an image, for example for a question or an avatar. We access only the images you select.

Both permissions are optional. You can refuse or revoke them at any time in your device settings; the rest of the app will continue to work.

5. How we use your information and legal bases

We use personal data only for the purposes below, based on the following legal grounds under the GDPR:

• To provide the Services (creating and managing your account, storing your content, running activities, generating reports, AI image generation, customer support) — performance of our contract with you (Art. 6(1)(b) GDPR).
• To process payments and keep accounting records — performance of a contract and compliance with legal obligations (Art. 6(1)(b) and (c)).
• To keep the Services secure and working (preventing fraud and abuse, fixing errors, maintaining logs) — our legitimate interests (Art. 6(1)(f)).
• To send service messages such as account confirmations, password resets, and important changes — performance of a contract.
• To understand website usage with analytics — your consent where required by law (Art. 6(1)(a)), which you can withdraw at any time.
• To comply with the law and respond to lawful requests from authorities — legal obligation (Art. 6(1)(c)).

We do not use personal data for advertising, we do not sell personal data, and we do not make decisions based solely on automated processing that produce legal or similarly significant effects.

6. Children’s privacy

The Services are intended for adults (18 years or older) acting as teachers, educators, or staff of educational organisations. They are not directed to children, and children may not create accounts or use the apps.

Teachers may enter limited information about their students, who may be children. When they do, we act as a processor for the school or teacher (see section 2) and:

• use student data only to provide the Services to the teacher or school;
• never use student data for advertising, marketing, or profiling, and never sell it;
• never contact students directly;
• delete student data when the teacher deletes it or deletes their account.

Schools and teachers are responsible for having a lawful basis and, where required, parental consent before entering student data. We recommend entering only the minimum information needed, such as first names or student numbers. If you are a parent or guardian and believe your child’s data has been entered into SmartEduTrack, please contact the school or teacher, or email us at hello@smartedutrack.com and we will help.

7. How we share information

We do not sell, rent, or trade personal data, we do not show ads, and we do not track you across apps or websites owned by other companies. We share personal data only with the service providers below, who process it on our behalf under contracts that require them to protect it:

• Cloud hosting providers located in the European Union — to host our servers and databases.
• Google — to provide Sign in with Google and, on the website and web app, Google Analytics.
• OpenAI — to generate images from the text prompts you enter. Only the prompt is sent; under OpenAI’s API terms, this data is not used to train its models.
• Stripe — to process payments and manage subscriptions purchased on our website.
• SparkPost — to deliver emails, such as account messages and replies to contact requests.

We may also disclose personal data:

• when required by law, court order, or a lawful request from a public authority;
• to protect the rights, safety, and security of our users, the public, or us;
• as part of a merger, acquisition, or sale of assets, in which case the data will remain protected by this policy and we will notify you;
• with other users when you choose to share content, for example sharing a class with a colleague or publishing a question set in the Marketplace. Public Marketplace sets must not contain student data.

8. International data transfers

Our main servers are located in the European Union. Some service providers (Google, OpenAI, Stripe, and SparkPost) may process data in the United States or other countries outside the European Economic Area. When this happens, we rely on appropriate safeguards, such as the EU-U.S. Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

Please do not include personal data, especially student names, in AI image generation prompts.

9. Data retention

• Account data and content (including student data) are kept while your account is active. Teachers can delete individual students, classes, and content at any time.
• When you delete your account, your account data, content, and student data are deleted from our live systems immediately. Copies in encrypted backups are permanently removed within 90 days.
• Billing and invoice records are kept for as long as required by Bulgarian accounting and tax law, even after the account is deleted.
• Contact form messages and support emails are kept for up to 24 months after the conversation ends.
• Technical logs are kept for a limited period for security and troubleshooting and then deleted.

10. Deleting your account and data

You can delete your account and all associated data at any time:

• In the mobile app or web app: open your account settings and choose Delete account. Deletion happens immediately after you confirm.
• By email: if you cannot access the app, email hello@smartedutrack.com from the email address registered to your account and ask us to delete it. We will confirm your request and complete the deletion within 30 days.

Deleting your account removes your profile, classes, student data, question sets, uploaded media, generated images, and activity results. Billing records are retained as described in section 9. Question sets you previously published to the Marketplace and that other users have copied into their own libraries remain in those users’ libraries.

Full instructions are also available on our account deletion page.

11. Your privacy rights

Under the GDPR and other applicable data protection laws, you have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate or incomplete data;
• have your data deleted;
• restrict or object to certain processing, including processing based on legitimate interests;
• receive your data in a portable, machine-readable format;
• withdraw your consent at any time, without affecting processing that happened before.

To exercise these rights, email hello@smartedutrack.com. We will respond within one month. If your request concerns student data, we will forward it to, or assist, the school or teacher who controls that data.

You also have the right to lodge a complaint with a data protection authority. In Bulgaria this is the Commission for Personal Data Protection (www.cpdp.bg). You may also contact the authority in the EU country where you live or work.

12. Cookies and analytics

Our website and web app use strictly necessary cookies, for example to keep you signed in. These do not require consent.

Where we use Google Analytics, it sets cookies that collect information such as pages visited, time spent, and approximate location based on a shortened IP address. Where required by law, we only set analytics cookies after you consent. You can withdraw consent, block cookies in your browser, or install the Google Analytics opt-out browser add-on.

The mobile apps do not use analytics or advertising cookies.

13. Data security

We use appropriate technical and organisational measures to protect personal data, including encryption of data in transit (HTTPS/TLS), hashed passwords, access controls limited to staff who need access, and regular backups. No method of transmission or storage is completely secure, but we work to protect your data and will notify you and the relevant authorities of a personal data breach where required by law.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will change the “Last updated” date at the top of this page, and if the changes are significant we will notify you by email or in the app before they take effect.

15. Contact us

If you have any questions about this Privacy Policy or how we handle personal data, contact us at:
Edusoft-BG Ltd.
ul. Lunna Nosht 4, Sofia, Bulgaria
Email: hello@smartedutrack.com