Privacy Policy

We collect three families of data:

• Identity data: first name, last name, email, phone and role (administrator, teacher, parent, student, accountant, front desk) of the users invited by the School.
• School data: information about students (student number, class, grades, attendance, remarks), about teachers (subjects, assigned classes) and about internal interactions (announcements, messages, leave requests).
• Technical data: IP address, device type, operating system, connection logs. We use this data solely to secure the platform and improve the quality of the service.
• Content and files: photos, documents and attachments the School and its users add (a profile photo, homework, a document).
• Payment data: amounts, receipts and the payment method used for school fees. Card numbers are entered with the payment provider and are never stored by Klavenn.
• Device data in the mobile app: a notification token, so the app can deliver the School’s notifications. It is removed from the account when the person signs out.

Data is processed solely in order to:

• provide and maintain the service;
• authenticate users and secure their sessions;
• generate the official documents the School requests (report cards, receipts, ID badges);
• enable communication within the School (announcements, messages, notifications);
• provide user support and technical maintenance;
• comply with legal and regulatory obligations.

Processing rests on performance of the contract between Klavenn and the School, on the consent of invited users, and on Klavenn’s legal obligations (fraud prevention, retention of connection logs).

School records: attendance, entries and exits, clock-ins, grades, payments, are attached to the academic year they belong to and are never expired, thinned out or aggregated away while the subscription is active. A record from ten years ago is read the same way as one from this morning.

That retention is tied to the subscription, and this is the important point: Klavenn is not the School’s archive. We hold the data so the platform can work. If the subscription ends, the data is kept for 30 days so it can be recovered or exported, and is then permanently deleted from our systems.

Long-term preservation is the School’s responsibility. A school register has to survive a change of provider, and often a legal retention obligation longer than any contract with us. The School can export its records at any time from the administration area, in an open format, and undertakes to keep its own archive of anything it must retain beyond the subscription.

Only purely technical logs (authentication and connection logs) are kept for 12 months for security purposes, then purged automatically. They contain no school records.

Klavenn does not sell, rent or share Schools’ data with third parties for commercial purposes. The only sharing that can occur is:

• with our technical sub-processors (database hosting, storage, email delivery, payment integrations), strictly to the extent needed to provide the service;
• under a court order or a duly justified legal request;
• with the School’s express, prior agreement.

Our sub-processors, each for one purpose only:

• Supabase: database and file storage;
• Vercel: hosting of the application;
• Resend: email delivery;
• Twilio: text messages and WhatsApp messages, when the School uses them;
• Stripe and MonCash (Digicel): payment of school fees;
• Anthropic: Klavenn AI, only when the School turns it on (see below);
• Google Firebase Cloud Messaging and the Apple Push Notification service: delivery of notifications to the mobile app;
• Upstash: protection against abuse (rate limiting by IP address);
• Jitsi (8x8): live video classes, when the School uses them.

Questions about our sub-processors: info@klavenn.com.

Klavenn AI is off unless the School turns it on, role by role, and pupils use it only if the School allows it. When it is on, the question a person types, and the school data needed to answer it, are sent to Anthropic, which provides the model, to produce the answer. Under Anthropic’s commercial terms this data is not used to train its models. The answer is generated by a machine and can be wrong: it is shown as such in the app.

Klavenn is used by schools, and pupils, including children under 13, can have an account that their School creates. The School obtains the consent of parents or guardians where the law requires it, and decides what pupils can use. A pupil’s data is used only to provide the school service: never for advertising, profiling or tracking, and Klavenn shows no advertising.

A parent or guardian can ask the School, or write to privacy@klavenn.com, to see, correct or delete their child’s data.

Adults who have a Klavenn account with an e-mail address of their own (school administrators, staff and parents), and people who subscribe on the website, receive the Klavenn newsletter: product news, training and webinars, a few times a month at most. It is sent through Resend, our e-mail provider.

Every message has a one-click unsubscribe link, and mail apps show an “Unsubscribe” button next to the sender. Unsubscribing is final: Klavenn never puts the address back on the list; only the person can, by subscribing again on the website. A pupil’s account never receives the newsletter.

Klavenn implements appropriate technical and organisational measures to protect data: TLS encryption in transit, bcrypt for passwords, logical multi-tenant isolation, daily backups, complete audit logs, and role-based access control (RBAC).

More detail on the Security page.

Anyone whose data is processed may exercise the following rights:

• the right of access and rectification;
• the right to erasure and to restriction of processing;
• the right to data portability;
• the right to object on legitimate grounds.

Every user can delete their own account in the app or on the website: Profile (or My account), then “Delete my account”. See Delete your Klavenn account.

Other requests should go first to the School that invited the user. Klavenn can be contacted directly at privacy@klavenn.com if that proves difficult.

Data is hosted in facilities that follow international security best practice. Where international transfers occur, they are governed by standard contractual clauses.

The platform uses cookies strictly necessary for authentication (a signed session cookie), for interface preferences (language, theme, dashboard configuration) and for aggregate analytics. No advertising or cross-site tracking cookies are used.

For any question about this Policy, or to exercise your rights, write to privacy@klavenn.com.