Privacy Policy
Last updated: [DATE]
DRAFT. This text is a starting template and must be reviewed by a lawyer before it goes live. Replace everything in brackets: [LEGAL NAME], [COUNTRY], [ADDRESS] and [EMAIL].
Space Mission ("we") is an app that helps teachers take attendance in class. This policy explains what data we process, why, and what rights you have. The data controller is [LEGAL NAME], [ADDRESS], [COUNTRY]. Privacy contact: [EMAIL].
The short version
- Only teachers have accounts. Students never sign up, never log in and never give us any data.
- For students we keep the minimum: the first name (or nickname) the teacher types, the character picked, and attendance (present, late or absent) by date.
- We never ask for student photos, emails, ID numbers or birth dates.
- We don't sell data, show ads, train models on your data or build profiles.
- You can delete a class or your whole account at any time from "My account".
What we process
| Data | Whose | Why | Legal basis (GDPR) |
|---|---|---|---|
| Email and, if you use Google, name and profile picture | Teacher | Create the account and sign in | Contract |
| Class names, student first names or nicknames, chosen character and attendance records | Entered by the teacher | Provide the attendance service | Contract. For schools: we act as processor on the school's behalf |
| Subscription status (plan, renewal dates) | Teacher | Know which plan you have | Contract |
| Payment details | Teacher | Charge the subscription | Handled by Lemon Squeezy as Merchant of Record. We never see or store your card number |
| Technical logs (IP address, browser, errors) | Teacher | Security and operations | Legitimate interest |
Preferences such as language or sound are kept in your own browser (local storage) and are not sent to our servers. We use no advertising or third-party tracking cookies.
Children's data
The service is meant to be used by the teacher, not by children. We recommend entering only a first name or nickname. When a school subscribes, the school controls its students' data and we process it only on its instructions.
- United States (COPPA and FERPA): we do not collect personal information directly from children under 13. When a teacher or school uses the service, we act as a provider under FERPA's "school official" exception: we use records only to provide the service, under the school's direct control, and do not disclose them to anyone except the service providers listed below. We do not use student data for advertising and do not sell it, consistent with state student-privacy laws such as California's SOPIPA.
- European Union and United Kingdom (GDPR / UK GDPR): on the school plan we sign a data processing agreement (DPA) under Article 28.
- Latin America: we follow the principles of applicable data protection laws, including Colombia's Law 1581 of 2012, Mexico's LFPDPPP, Brazil's LGPD, Argentina's Law 25.326 and Chile's Law 19.628, including the best interests of the child.
If you are a parent or guardian and believe we hold your child's data, email [EMAIL] or contact their school.
Use of artificial intelligence
AI disclosure: Space Mission (its code, text, translations and artwork) was created with the help of artificial intelligence tools, with human review. The app does not use artificial intelligence to analyze your students' data, does not send it to AI services, and makes no automated decisions about anyone.
Who we share data with
Only with providers we need to run the service, under contracts that require them to protect the data:
| Provider | Role | Location |
|---|---|---|
| Supabase Inc. | Database and sign-in | Project region: [REGION, e.g. EU (Frankfurt) or US] |
| Lemon Squeezy (Stripe) | Payments, invoicing and tax | USA |
| [Vercel / Netlify] | Website hosting | Global (CDN) |
| Sign in with Google (optional) | USA |
When data leaves the European Economic Area we rely on the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. We may also disclose data when the law requires it.
How long we keep data
- While your account is active.
- When you delete a class, its data is removed from the live database immediately.
- When you delete your account, we delete your data within 30 days. Backups are overwritten within [90] days.
- Billing records are kept as long as tax law requires.
Security
We use encrypted connections (HTTPS), our database provider's encryption at rest, and row-level access rules: each teacher can only read and write their own data.
Your rights
You can ask to access, correct, delete or port your data (the app already lets you download attendance as CSV), to restrict or object to processing, and to withdraw consent. Email [EMAIL] and we will answer within 30 days. You can also complain to your data protection authority.
California residents: we do not sell or share personal information as defined by the CCPA/CPRA.
Changes
If we make a material change to this policy, we will tell you by email or in the app before it takes effect.