Privacy policy

Who we are

Schedula operates the website schedula.school and the Schedula service. You can reach us at contact@schedula.school.

Two roles

For the data a school enters about its staff and its timetable, the school owns the data and decides how it is used. We hold and process it only to provide the service to that school, under our data processing agreement.

For data about visitors to this website and people who write to us, we decide how it is used, as described below.

What a school puts into Schedula

• Accounts: the name and email address of each person the school gives access to, and their role (admin, editor or viewer). Sign-in is by email and password.
• The school itself: year groups, classes, subjects, curriculum hours, rooms and the rules the timetable must keep.
• Teachers: name, an email address and phone number if the school enters them, the subjects and classes they teach, their weekly hours, the hours or days they cannot work, their timetable preferences and anything they write in a free-text request.
• Timetables, and on the day itself: teacher absences with an optional reason the school types, and which teacher covers which lesson.
• If the school connects one: read-only access to one Google Calendar, used to suggest absences that a person then confirms or dismisses.

Schedula does not ask for or store records about individual students. Classes are stored as groups, not as lists of students. Please do not enter health details or other sensitive information in free-text fields such as an absence reason.

What teachers send us themselves

A teacher who opens a sign-up or preferences link from their school enters their own details, hours and preferences. That information goes into their school’s account and is handled as the school’s data.

Website visitors and people who write to us

• Contact form: your name, school, email address and message, and if you choose, how you heard about us. With it we receive the page you first arrived on, including any campaign tags in its address, and the site that referred you. It reaches us by email, and we use it to answer you.
• Analytics: we count page views with Vercel Web Analytics, which does not use cookies and does not identify you.
• Advertising: if you arrive from one of our Google ads, Google’s advertising tag is loaded and may set a cookie so that we can tell whether the ad led to an enquiry. Visitors who do not arrive from an ad do not load it.
• Your browser keeps a few settings on your own device, such as your display theme, your signed-in session and, for the length of your visit, the page you arrived on. They are not sent to us except as described above.

Why we use it

• To provide the service the school signed up for: building and editing timetables, collecting teacher preferences, running the start-of-day board and answering questions in the assistant.
• To send the emails the service depends on: invitations, sign-in and password emails, and teacher links.
• To keep the service secure, fix faults and understand how it is used.
• To answer messages and enquiries.

We do not sell personal data, and we do not use school data for advertising.

AI features

Some features use Google’s Gemini models: the assistant that answers questions about your school, the setup assistant that reads text or files you give it, and absence suggestions from a connected calendar. When you use them, the school data they need, such as names, hours, preferences and calendar entries, is sent to Google to produce the answer. Files you give the setup assistant are read to fill in your school’s records and are not stored by us.

An AI suggestion changes nothing on its own. A person approves every record the setup assistant proposes, and every absence suggestion stays a question until someone confirms it.

[TO CONFIRM: once the production Gemini API key is confirmed to belong to a billed Google Cloud project, add: “We use Google’s paid service, under which Google does not use this data to improve its products.”]

Where data is stored and processed

• The school’s data is stored in Google Cloud Firestore in Israel (Tel Aviv).
• Timetables are computed on Google Cloud in the United States.
• The website and its servers run on Vercel, mainly in the United States.
• AI features use Google’s Gemini service.
• Emails are sent through Resend, in the United States.
• Sign-in is handled by Google Firebase Authentication.

This means some data is processed outside Israel. We use these providers only for the purposes in this policy. [TO CONFIRM: the legal basis for transfers abroad.]

Who helps us run the service

These providers process data for us: Google (Firebase, Cloud Firestore, Cloud Run, Gemini), Vercel (hosting and web analytics), Resend (email) and, for visitors who arrive from an ad, Google Ads. If a school connects Google Calendar, Google provides that access. We do not share school data with anyone else unless the law requires it.

How long we keep it

School data is kept while the school uses Schedula. An admin can delete the whole school at any time, which removes its data from our database. [TO CONFIRM: when a school stops using Schedula without deleting it, we delete its data within a set number of days, and how long backups, if any, are kept.]

Messages sent through the contact form stay in our mailbox for as long as we need them to answer and follow up.

Security

• Data travels encrypted (HTTPS) and is encrypted at rest by our cloud providers.
• Access is by role: viewers can read, editors can change school data, and admins also manage who has access. Every server request that touches a school’s data is checked against that school’s members.
• A connected calendar’s access token is stored where no user of the app can read it.

No system is perfectly secure. If we learn of a security incident affecting a school’s data, we tell the school without undue delay.

Your rights

Under Israeli privacy law you may ask to see the personal data held about you and ask for it to be corrected or deleted. For data a school entered, contact the school, which decides on such requests; we help the school carry them out. For anything else, write to contact@schedula.school.

Changes to this policy

If we change this policy, we update the date at the top. If a change affects how a school’s data is handled, we tell the school’s admins before it takes effect.

Contact

contact@schedula.school