Privacy policy

In short, for pupils

• Your school decides how iDoceo Connect is used for your classes. Your teachers can see the work you hand in, your marks and your attendance.
• We keep a few technical records, such as when you signed in and from which browser, to keep the service safe. We delete them after 30 days. Simple statistics about which features are used are deleted after 13 months.
• We never sell your information or use it for advertising. We never send your work, marks or name to an artificial intelligence (AI) service.
• If you have an account, you can download a copy of your data in Settings. If something is wrong or you want something deleted, ask your teacher or write to privacy@idoceo.net.

Who is responsible

iDoceo Connect is provided by iDoceo Labs Ltd. For classroom records, the school or education authority normally decides why the data is used and is the controller; iDoceo Labs processes it on that organisation’s instructions. For our own account administration, service security and business records, iDoceo Labs is the controller. Contact privacy@idoceo.net about either role and we will direct school-controlled requests to the relevant school.

Purposes and legal bases

• Schools use class rosters, work, grades and attendance to provide education under the lawful basis identified in their own notice. iDoceo Labs handles those records as their processor, not for advertising or independent student profiling.
• We use educator account and subscription details to provide the requested service (GDPR Article 6(1)(b)); records needed for tax or other legal duties are kept under Article 6(1)(c).
• We use limited security, access and operational records to protect the service and investigate abuse, and usage statistics to measure and improve it, under our legitimate interests (Article 6(1)(f)), subject to a balancing assessment. School-controlled activity is handled only as needed to deliver and secure the school service.
• Optional integrations and AI features operate when an authorised educator enables or uses them. The school must decide whether personal data may be entered into a selected AI provider.

Information used by the platform

The information involved depends on how you access iDoceo Connect.

• Teachers and other authorised staff may sign in through Google, Microsoft or Apple. The platform stores the account and session information required to identify them and provide the correct role and access.
• Students may sign in with an email-based account, or enter with a temporary class PIN without creating an account. A sign-in provider may supply a display name for the account.
• For email-based class enrollment, we use the student’s email address to identify the roster entry and support account access. Teachers need not enter a real name in the class roster; they may use an optional class pseudonym to recognise PIN submissions. A pseudonym linked to a roster entry or work remains personal data.
• Work submitted for a task—including answers, files, assessments or rubrics—is stored so it can be delivered to the teacher who requested it.
• Limited technical and activity information is recorded to protect assessment integrity and keep the service reliable, such as browser details, repeated submissions, leaving an assessment window, account activity and security events.
• Each request to the service is logged with the IP address, the approximate location derived from it (country and city), the browser and the time. Signed-in sessions are summarised in the same way so that iDoceo Labs administrators can detect account sharing, misuse and attacks.
• Usage statistics record which features signed-in users open and use, together with their role and school, so that we can measure adoption and plan the service. They are not used for advertising.
• Classroom Radar shows a teacher students who may need attention, for example after several low grades, a falling trend or overdue work. It uses only grades and deadlines already in that class, applies rules the teacher can see and change, and never changes a grade, access or standing. The teacher decides what to do.
• Authorised iDoceo Labs administrators can open the service as a particular student sees it, to provide support or resolve a reported problem. Each such access is recorded in an audit log.

Other services and recipients

Authorised staff and the relevant school can see information needed for their roles. Service providers receive only the data needed for their function. The current subprocessor register is available from privacy@idoceo.net.

• Leaseweb Netherlands hosts the application and database. Private Cloudflare R2 storage may hold assessment documents and student files in the EU jurisdiction. A separate private bucket is used temporarily to move selected files from the previous service; transition copies are deleted after the retained files are moved into the new service and verified.
• Resend handles transactional email when configured. Paddle acts as merchant of record for paid purchases and handles buyer and payment data under its own notice.
• Google, Microsoft and Apple provide sign-in. Google Classroom, Microsoft Teams for Education and Moodle are optional integrations that a teacher can connect to import rosters and coursework and to publish grades the teacher selects.
• AI features use OpenAI, Anthropic, Google (Gemini) or another AI provider that an administrator or school configures. Only the prompt is sent: the educator’s written instructions and the assessment content being created or edited, such as questions, answer keys and explanations. iDoceo Connect never sends student names, email addresses, submissions, answers, grades, attendance, class rosters, account details or any other personal data from its records to an AI provider. Educators should not type personal data into their instructions.
• We do not sell student or Google Workspace data or use it for advertising. We may disclose information where legally required.

Locations and international transfers

The application database is hosted in the Netherlands; configured private object storage uses the EU jurisdiction. iDoceo Labs is based in the United Kingdom, which currently benefits from an EU adequacy decision. Email, identity, payment and AI services may involve other countries. Before enabling a service that transfers personal data outside the EEA, we or the school, as applicable, must identify its destination and use an applicable adequacy decision or appropriate safeguards such as standard contractual clauses. Ask privacy@idoceo.net for the current provider and transfer details.

Google user data accessed by iDoceo Connect

If a teacher chooses to connect Google Classroom, iDoceo Connect requests only the Google Workspace permissions needed for the Classroom features the teacher activates.

• Course data: course identifiers and names for courses the connected Google account teaches, so the teacher can choose and link a Classroom course.
• Roster and profile data: student Google identifiers, names and email addresses, so the teacher can review the roster, import students and match them to the correct iDoceo Connect class members.
• Coursework and submission data: assignment identifiers, titles, links, dates, maximum points, submission state, late status and grades, so the teacher can add selected Classroom assignments as gradebook columns.
• Data written to Classroom: when the teacher explicitly publishes results, iDoceo Connect creates an assignment in the selected course and writes the selected students’ final grades.
• Authorization data: the Google account identifier, granted scopes, OAuth access and refresh tokens, token expiry information and the connected account label, so the connection can operate and be renewed.

How Google user data is used

Google user data is used only to provide the visible Classroom features requested by the teacher: connecting a course, reviewing and importing its roster, importing selected gradebook items, checking the connection and publishing teacher-selected final results.

iDoceo Connect does not use Google Workspace user data for advertising, credit decisions, data brokerage, or to create, train or improve generalised artificial intelligence or machine-learning models. iDoceo Connect does not sell Google user data.

The use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Who can access student work

Student submissions are available only to the teacher who requested the task and, where applicable, other authorised members of the relevant school or department. Students should never use a class PIN that was not provided for their class.

Sharing and disclosure of Google user data

Google user data is not shared with advertisers, data brokers or unrelated third parties. It is disclosed only in the limited circumstances below.

• Google receives the API requests needed to read or write the Classroom data selected by the teacher.
• Leaseweb Netherlands B.V., Luttenbergweg 8, 1101 EC Amsterdam, Netherlands, hosts the application and database. Other service storage and recipients are described above.
• Authorised iDoceo Labs personnel may access data only when necessary to provide support requested by the user, investigate security or abuse, or comply with applicable law. Such access is limited to personnel who need it.
• Data may be disclosed when required by applicable law or, with the user’s explicit prior consent, as part of a merger, acquisition or sale of assets.

Protection of sensitive data

iDoceo Connect uses technical and organisational safeguards appropriate to the sensitivity of Google user data.

• Data is encrypted in transit using HTTPS/TLS.
• Google OAuth access, refresh and ID tokens are encrypted at rest using authenticated encryption. Application secrets and encryption keys are kept outside the source code repository.
• Role-based access checks, ownership checks and school controls restrict Classroom operations to authorised educators and the classes they are permitted to manage.
• Access to production systems is restricted, and security-relevant activity is logged and monitored. The application applies origin checks, bounded external requests and other controls to reduce unauthorised access and misuse.

Retention

Classroom records are kept for the period instructed by the school and then returned or deleted, subject to legal obligations. A school manager can download all of the school’s records at any time from the school settings. Account information is kept while the account is active and for any applicable legal or dispute period afterward. Connected-provider tokens are kept while the connection remains active. Backups expire on their controlled rotation schedule; restored data remains subject to the same deletion instructions. The school can provide its educational record periods.

• Request logs, security records and detailed session activity: 30 days.
• Request statistics without personal details: 90 days.
• Usage statistics and email delivery records: 13 months.
• Credit and payment ledger entries: kept for accounting; they are detached from the person when an account is erased.

Retention and deletion of Google user data

Google authorization tokens are retained while the teacher keeps the Google connection active. Linked course identifiers, titles, student matches, selected coursework metadata, imported grades and publication records are retained while the corresponding Classroom course remains linked, so the requested integration continues to work.

Unlinking a Classroom course deletes that link and its stored Google course identifier, title, student-ID matches, imported Classroom gradebook columns and grades, and result-publication metadata. Students already added to the iDoceo Connect class remain because they are then part of the teacher’s iDoceo Connect class, not a live copy of the Google roster.

A user may revoke iDoceo Connect from the Google Account permissions page at any time. To request deletion of stored Google authorization, imported Google-derived data, or an account, email privacy@idoceo.net. We verify the request, coordinate school-controlled records with the school and respond within the period required by law. Backup copies expire through the controlled rotation schedule.

Children

Pupils use iDoceo Connect for school activities under the school’s instructions, including through a class PIN without an account. Ordinary teaching and assessment in Spain generally does not rely on a pupil’s or parent’s consent. Where a separate use does rely on consent, the school must apply the relevant local age and parental-authorisation rules; in Spain, consent for a child under 14 generally comes from a parent or guardian. We do not use pupils’ information for targeted advertising.

Your rights and choices

You may ask for access, correction, deletion, restriction or objection, and portability where it applies. You may also complain to your data protection authority. Any signed-in user can download a machine-readable copy of their personal data from Settings. For other requests contact privacy@idoceo.net; for school-controlled records we will work with the school, which decides the request under its legal duties. We may need to verify identity and may retain records when law requires it. iDoceo Connect does not make solely automated decisions that determine a pupil’s educational standing; teachers review and control grades and classroom actions.

We use only storage and cookies needed for sign-in, security, language and requested interface preferences. We do not use nonessential advertising or analytics cookies.

Questions and requests

This is a living document. If a privacy concern is not answered here, or you want to make a request about your information, contact privacy@idoceo.net.