Privacy, in plain language.
Your school owns its data and decides what happens to it. We hold and process it on your school's instructions, and nothing here is written to be clever.
This page explains our practices in plain language. It is a summary for schools and families, not a substitute for the data processing agreement that governs our contract with your school.
Your school is the data controller. Tavech is the processor: we hold and process student, staff and family data on your school's instructions, and we do not decide what is collected or why.
This matters practically. If a parent asks us to correct or delete a record, we direct them to the school, because the school — not us — decides what its records should say.
Whatever your school puts into Tavech. Typically that means student records and guardians, staff records, attendance, assessment results, fee and payment records, messages and announcements, and documents your school uploads.
We also keep operational data of our own: sign-in times, IP addresses and an audit log of actions taken in the system. That exists so a school can answer “who changed this record” and so we can investigate security incidents.
We do not sell personal data. We do not share it with advertisers. We do not use student data to train machine-learning models. We do not use it for any purpose beyond running the service for your school.
Access follows the roles and permissions your administrators configure, and nothing outside your school can reach your school's records at all. That boundary is not a setting somebody has to remember — it is checked on every single request.
Within Tavech, access to production data is limited to the small number of staff who need it to operate or support the service, and every such access is logged.
For as long as your school asks us to. Schools have their own retention obligations for student records, so we do not impose a schedule. When your school ends its contract we provide a full export and then delete the data on the timetable agreed with you.
Backups are retained for thirty days, after which deleted data ages out of them too.
Your data is encrypted in transit and at rest, passwords are stored so that nobody — including us — can read them, and your school's records stay inside your school. The security page sets out what that means in practice.
Parents, students and staff may ask to see, correct or delete their data. Those requests go to your school, which will action them and instruct us where our involvement is needed. We will always support a school in responding.
Questions about this page can be sent to privacy@tavech.com. Requests about a specific person's data should go to the school that holds the record — they decide what it says, and we act on their instruction.
Questions about this document go to privacy@tavech.com. A person reads them.