Legal and compliance
Privacy Policy
Last updated 18 October 2026.
1. Our roles
A school normally controls the learner, guardian, staff, academic, attendance, and school-finance records it enters. Qavona processes those records to operate, secure, and support the school portal. Qavona is responsible for its own public-site, account, billing, security, partner, support, and legal-compliance records.
2. Information processed
We process school configuration, member identity and contact data, admissions, attendance, assessments, report cards, invoices and payment evidence, communications, support requests, device and authentication events, usage counters, consent choices, and audit records. Payment card or bank credentials are handled by the selected payment provider; Qavona stores provider references and reconciliation evidence rather than raw card details.
3. Children and sensitive information
Learner records may relate to children. Schools must provide required notices, establish a lawful basis, limit access, and obtain guardian authority where applicable. Public result access is PIN-gated and does not create a portal session. Users must not disclose credentials, safeguarding records, health details, or results outside authorized workflows.
4. Why information is used
Information is used to provide requested school functions, authenticate users, enforce roles and entitlements, process and reconcile payments, prevent fraud and abuse, deliver authorized communications, support users, maintain reliable backups, meet legal duties, and improve service reliability using minimized operational telemetry.
5. Providers and international transfers
Qavona may use vetted hosting, storage, monitoring, email, SMS, support, payment, and optional AI providers. They receive only the information needed for their service and are subject to contractual and security controls. Where information crosses borders, appropriate contractual, technical, and organizational safeguards are used. Optional assisted features may send user-submitted content to the configured AI provider; users must avoid unnecessary personal or sensitive data and review generated material.
6. Security
Controls include tenant-schema isolation, role-based authorization, password hashing, step-up protection for sensitive platform actions, audit logging, private-media controls, rate limiting, monitoring, backups, and incident response. No online service can promise absolute security, and schools remain responsible for accurate role assignments, trusted devices, and prompt reporting of compromise.
7. Retention, recycle bin, and deletion
Temporary exports expire on schedule. An operator-deleted school enters a restricted 45-day recycle period before active tenant data is purged if not restored. Backup copies age out under a separate protected schedule and are not ordinary active records. Financial, fraud-prevention, security, and audit evidence may be retained or pseudonymized where law, disputes, or legitimate security obligations require it.
8. Choices and rights
Depending on applicable law, a person may request access, correction, export, restriction, objection, or erasure through the relevant school administrator or Qavona. Identity and authority are verified before action. Marketing preferences can be withdrawn without disabling necessary service or security messages.
9. Cookies and contact
We use cookies needed for sign-in, security, language, timezone, and saved preferences. Privacy enquiries may be sent to contact@qavona.com.