Privacy Policy

1. What we collect

• Account data: name, email, role (teacher or parent), language and password (stored hashed by Firebase Authentication; we never see it).
• What you enter: school name, logo, header picture, saved worksheets, teaching plans and the text you give the AI.
• Class and child data: if you use My Class or the portfolio, the names, numbers and scores of the students or children you enter.
• Purchases: item, price, date and payment status. Payments go through Stripe; we never store card or bank details.
• Usage: worksheets made, AI credits used, and anonymous page-view statistics (Vercel Web Analytics, no cookies).
• Browser storage: some settings, such as edited exam sets, stay on your device (localStorage) and are not sent to us.

2. How we use it

• To provide the service you signed up for: sign-in, making, saving and printing worksheets (contract).
• To unlock what you bought, issue receipts and handle refunds (contract and legal obligation).
• To prevent abuse, keep AI use fair and fix problems (legitimate interest).
• To improve the site from aggregate usage statistics (legitimate interest).

We do not sell personal data or use it for third-party advertising.

3. Children and students

Eduora is used by adults (teachers and parents). Children do not create accounts. Any child data in the service is entered by a teacher or parent, who must be entitled to use it.

We use student data only to show rosters and scores and to print worksheets for that user. Student names are never sent to the AI or shown to other users. A child's assignment link shows only the assigned work, without answers or other children's data.

4. Service providers

These providers store or process data for us; some have servers outside Thailand. We choose providers with appropriate data-protection standards.

• Google Firebase: accounts, database and image storage.
• Vercel: website hosting and anonymous visit statistics.
• Stripe: card and PromptPay payments.
• OpenAI: generating worksheets, exams and lesson plans from the text you type (via the API, which OpenAI states is not used for training).
• Google Drive: only when you export a portfolio to your own Drive. We ask for access to files the site creates only, and do not keep that access on our servers.

5. How long we keep it

We keep your account and content while your account is active. When you ask us to delete your account, we delete your data within 30 days, except purchase records we must keep for tax and accounting law.

6. Your rights

You may ask to access or copy your data, correct it, delete it or your account, restrict or object to its use, port it, and withdraw consent. Contact us using the details below; we reply within 30 days.

You may also complain to Thailand's Personal Data Protection Committee (PDPC).

7. Security

Data travels over encrypted connections (HTTPS), the database lets each account see only its own data, and system keys stay on the server. If a breach affects you, we will tell you and notify the authorities as the law requires.

8. Changes

If we change this policy materially, we will announce it on the site before it takes effect. The last-updated date is at the top of this page.