1. Who we are and what this policy covers
This Privacy Policy explains how EDSKED.APP, MOROCCO (“Edsked”, “we”, “us”), collects and uses personal data when you visit https://edsked.app and use the Edsked timetable scheduling service (the “Service”). You can contact us at [email protected].
2. Our role: controller and processor
- As a controller, we decide why and how we use your account data (email, name, password), billing status and security data, so that we can run the Service and meet our legal duties.
- As a processor (or “service provider”), we host and process the timetable data you enter, such as staff names, class names and subjects, on your behalf and on your instructions. For that data, you (the school or organisation) are the controller. Our Terms of Service, section 8, contains the data processing terms that apply.
3. What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | Your email address, the name you give us, a salted and hashed password (we never store your actual password), the time you created the account, and a record of when you accepted these terms and which version. | You |
| Institution details | Asked at sign-up and editable in your account: your institution’s name, its type (for example school or university), your role, your country, and, optionally, the approximate number of instructors and how you heard about Edsked. | You |
| Team and sharing data | The email addresses and roles of people you invite as collaborators, the status of invitations, which of your timetables and library items you share with your team, and who last changed a shared timetable. | You |
| Timetable data | Everything you enter to build timetables: school name and term label, an optional logo image you upload for printouts, subjects, instructor names and their availability, class group names, weekly lesson requirements, and the timetables generated or edited from them. | You |
| Billing data | Which plan you have, subscription status, renewal and cancellation dates, the customer email used at checkout, and links to the billing portal. Payments are handled by Lemon Squeezy; we never see or store your card number. | You and Lemon Squeezy |
| Technical and security data | Your IP address and request details while you use the Service, used in memory to limit abuse such as repeated login attempts. Our hosting infrastructure may also keep standard server logs. We store a session token, in hashed form, to keep you logged in. | Your device |
| Beta applications | If you apply for a beta trial code: your name, email address, institution, type of institution, job position and country, whether you ticked the optional box for product news, and whether and when you used your code. | You |
| Anonymous usage statistics | Which pages are opened, how long a page stays open and in use, a few named actions (for example “generated a timetable”), your approximate country, device type, browser name and the website you came from. We do not store your IP address in these statistics, and we use a random visit identifier that is not linked to you across days. They are not collected if your browser sends a Do Not Track or Global Privacy Control signal. | Your device |
| Messages | Emails you send us, and our records of transactional emails we send you (confirmation, password reset). | You and us |
4. What we do not collect
- We do not need or ask for student personal data. Please do not enter it (see our Terms).
- We do not use advertising trackers, social-media pixels, session-replay tools or third-party analytics on the Service. Our own anonymous usage statistics are described above and in section 6.
- We do not knowingly collect special categories of personal data (such as health or biometric data).
- We do not make decisions about you using automated profiling. The scheduling engine only arranges the lessons you describe.
5. How and why we use personal data
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Creating and securing your account, confirming your email, logging you in, resetting passwords | Performance of a contract with you; our legitimate interest in keeping accounts secure |
| Providing the Service: storing your timetables, running the scheduling engine, letting you export or delete your data | Performance of a contract. For timetable data we act on your instructions as your processor |
| Managing your plan and subscription, renewals, and applying the instructor limit that comes with your plan | Performance of a contract; legal obligations (tax and accounting records) |
| Tailoring the Service to your institution (for example using the word “cohort” instead of “class” in higher education), helping us understand who uses Edsked, and giving relevant support | Performance of a contract; our legitimate interests in running and improving the Service |
| Inviting collaborators by email, and letting your team see what you share with it | Performance of a contract with you; our legitimate interests |
| Preventing fraud, abuse and attacks, enforcing our Terms, keeping the Service reliable | Our legitimate interests in protecting the Service and its users |
| Replying to your questions and giving support | Performance of a contract; our legitimate interest in helping customers |
| Sending service emails (confirmation, password reset, important notices about your account or these terms) | Performance of a contract; legitimate interests. These are not marketing emails |
| Understanding how the website is used (visitor numbers, popular pages, timetables generated, country) so we can improve it, using anonymous statistics only | Our legitimate interests in running and improving the Service |
| Handling beta trial applications: emailing your personal code and tying it to your email address | Steps at your request before entering a contract; our legitimate interests |
| Sending product news and tips by email, only if you ticked the optional box | Your consent, which you can withdraw at any time |
| Complying with the law and responding to lawful requests | Legal obligation |
We only send marketing emails (product news and tips) to people who ticked the optional box when they applied for the beta or created an account. You can withdraw consent at any time by emailing us or using the unsubscribe option once we offer it.
6. Cookies and similar technologies
We use only what is strictly necessary to provide the Service you asked for. Because of this we do not show a cookie consent banner. If we add anything non-essential in future, we will ask for your consent first.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
sid | Cookie (first-party, HttpOnly, SameSite=Lax, Secure on HTTPS) | Keeps you logged in | Up to 30 days, or until you log out |
ed_sid | Session storage in your browser tab | A random visit identifier for our anonymous usage statistics. It is not linked to your identity and is deleted when you close the tab | Until the tab is closed |
tt_project | Local storage in your browser | Remembers which timetable you opened last | Until you clear your browser data |
7. Who we share data with
We do not sell your personal data and we do not share it for cross-context behavioural advertising. We share it only with service providers who help us run the Service, under contracts that limit what they may do with it:
| Provider | Purpose | Data involved |
|---|---|---|
| SELF (MOROCCO) | Hosting, database and backups | All data stored in the Service |
| Lemon Squeezy | Payments, invoicing, tax handling and the customer billing portal, acting as merchant of record. It is an independent controller of the payment data it collects, under its own privacy notice | Email, billing details, payment data, subscription records |
| People you invite and your team | When you share timetables or library items with your team, collaborators you invited can see them, and they can see your name or email as the owner. We do not share anything with them that you have kept private | Shared timetables, library items, your email address |
| Resend | Delivering transactional emails | Email address, name where used in the message, email content |
If we use additional providers for things such as DNS, content delivery or secure connections to our servers, they may process technical data like IP addresses in transit. We will update this list when providers change in a way that matters for your data. We may also disclose data where the law requires, to protect rights, safety or security, or as part of a merger or sale of our business (in which case the new owner must honour this policy).
8. International transfers
Some of our providers, including Lemon Squeezy and Resend, operate in or access data from countries outside your own, such as the United States. Where personal data is transferred from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards such as the Standard Contractual Clauses and the UK addendum, or on the provider’s participation in an approved data transfer framework. You can ask us for details at the contact address below.
9. How long we keep data
| Data | Retention |
|---|---|
| Account data | While your account exists. Deleted when you delete your account or ask us to. |
| Timetable data | Until you delete the timetable or your account. If a paid plan ends we keep it so you can export or resubscribe, and we may delete accounts that have been inactive for more than 12 months after at least 30 days’ notice by email. |
| Anonymous usage statistics | Up to 13 months, then deleted automatically. |
| Beta applications | Until you ask us to delete them, or until we stop running the beta programme and no longer need them for follow-up. |
| Invitations | Invitation links expire after 14 days. Collaborator records are removed when you remove the person or delete your account. |
| Login sessions | Up to 30 days, or until you log out or change your password. |
| Email confirmation and password-reset links | 24 hours and 1 hour respectively, then they stop working. |
| Billing and tax records | For as long as the law requires us and Lemon Squeezy to keep them. After you delete your account, these records are no longer linked to a login but may be retained. |
| Backups | Deleted data may remain in routine backups for a limited period, which is not longer than 35 days, after which it is overwritten. |
| Support emails | Up to 3 years after the matter is closed, or longer if needed to deal with a legal claim. |
10. How we protect data
We use measures appropriate to the risk, including encrypted connections (HTTPS) to the Service, salted and hashed passwords, hashed session tokens, strict access controls so each account can reach only its own data, rate limiting against password guessing, protective browser security headers, separation of the scheduling engine and its code from the browser, and regular backups. No online service can be perfectly secure. If a breach affects your personal data in a way that creates a risk to you, we will notify you and the relevant authorities as the law requires.
11. Your rights
Depending on where you live, including under the GDPR and UK GDPR, you may have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate data (most of it you can edit yourself in the dashboard);
- erase your data. You can delete your account yourself from Account & billing, or ask us to do it;
- restrict or object to certain processing, including processing based on our legitimate interests;
- data portability: you can export your timetables in a structured JSON file from the dashboard at any time;
- withdraw consent where we rely on it, without affecting earlier processing;
- complain to your local data protection authority. We would appreciate the chance to resolve your concern first.
To use these rights, email [email protected] from the address on your account. We may need to verify your identity, and we will respond within one month (extendable by up to two further months for complex requests, in which case we will tell you). We will not charge a fee unless a request is clearly unfounded or excessive. If your data is timetable data that your school or organisation controls, we may need to refer your request to them, and we will help them respond.
12. Additional information for California residents
Under the California Consumer Privacy Act (as amended), California residents have the right to know what personal information we collect, use and disclose, to request deletion or correction, to opt out of the “sale” or “sharing” of personal information, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights.
- In the past 12 months we have collected the categories listed in section 3: identifiers (email, name), commercial information (subscription status), internet or network activity (limited technical data), and professional or employment-related information you choose to enter (such as staff names and school name). We collect it for the purposes in section 5 and disclose it to the service providers in section 7.
- We do not sell or share personal information as those terms are defined by California law, and we do not knowingly sell or share the personal information of anyone under 16.
- We do not collect sensitive personal information as defined by California law.
- To make a request, email [email protected]. We will respond within 45 days (extendable once by a further 45 days where reasonably necessary). You may use an authorised agent, and we may need to verify your identity and their authority.
13. Other regions
If the data protection law where you live gives you rights that are not listed above, we will honour them. Contact us and tell us which law applies.
14. Children
The Service is for adults who plan timetables for educational organisations. It is not directed at children, and we do not knowingly collect personal data from anyone under 18 or any student data. If you believe a child has given us personal data, please contact us and we will delete it.
15. Changes to this policy
We may update this policy as the Service or the law changes. We will change the date at the top and, for material changes, tell you by email or in the dashboard before they take effect.
16. Contact us
EDSKED.APP
MOROCCO
Email: [email protected]
If you are in the European Economic Area or the United Kingdom and are not satisfied with our response, you also have the right to lodge a complaint with your national data protection authority.