← Back to SchoolTools
Privacy Policy
Last updated: October 2025
1. Introduction
SchoolTools, operated by BELMUTI XXI SL ("we," "our," or "us"), is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, store, and share information when you use our school management platform and related services (collectively, the "Service").
By using our Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use our Service.
2. Information We Collect
2.1 Personal Information
We collect information that you provide directly to us, including:
- Account Information: Name, email address, school affiliation, and role (teacher, administrator, staff)
- School Data: Student names, class schedules, teacher assignments, and academic information
- Menu Information: Lunch menu items, nutritional information, and types of dietary options offered by a school
- Communication Data: Messages, feedback, and support requests
2.2 Google Account Information
When you connect your Google account to SchoolTools or share your google sheets with our service account, we may access and store:
- Google Sheets Data: Student names, class lists, and scheduling information from your Google Sheets
- Basic Profile Information: Name and email address associated with your Google account
- Authentication Tokens: Secure tokens to maintain your login session
Limited Use Disclosure: Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
2.3 Automatically Collected Information
We may automatically collect certain information when you use our Service:
- Usage Data: Pages visited, features used, and time spent on the platform
- Device Information: Browser type, operating system, and device identifiers
- Log Data: IP address, access times, and error logs
3. How We Use Your Information
We use the information we collect to:
- Provide and maintain our school management services
- Process and manage lesson schedules and teacher assignments
- Create and manage lunch menus with multi-language support
- Integrate with Google Sheets for data import and export
- Communicate with you about your account and our services
- Improve our platform and develop new features
- Ensure security and prevent fraud
- Comply with legal obligations
4. Information Sharing and Disclosure
4.1 Limited Sharing
We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following limited circumstances:
- With Your Consent: When you explicitly authorize us to share information
- Service Providers: With trusted third-party providers who assist us in operating our platform (e.g., hosting, analytics)
- Legal Requirements: When required by law or to protect our rights and safety
- School Administration: With authorized school personnel as needed for educational purposes
4.2 Google Integration
When you use Google Sheets integration:
- We access only the specific Google Sheets you authorize by giving our service account access
- We use this data solely to provide scheduling services
- We do not share your Google data with third parties without your explicit consent
- You can revoke access to your Google account at any time by revoking access by our service account from your Google Sheets
5. Data Security
We implement appropriate technical and organizational measures to protect your personal information:
- Encryption: Data is encrypted in transit and at rest using industry-standard protocols
- Access Controls: Strict access controls limit who can view and modify your data
- Regular Audits: We regularly review and update our security practices
- Data Isolation: Complete data separation between different schools
- Secure Infrastructure: Our platform is hosted on secure, enterprise-grade infrastructure
6. Your Rights and Choices
You have the following rights regarding your personal information:
- Access: Request a copy of the personal information we hold about you
- Correction: Request correction of inaccurate or incomplete information
- Deletion: Request deletion of your personal information (subject to legal and operational requirements)
- Portability: Request a copy of your data in a structured, machine-readable format
- Withdrawal of Consent: Withdraw consent for data processing where applicable
To exercise these rights, please contact us using the information provided in the "Contact Us" section below.
7. Data Retention and Account Deletion
How Long We Retain Your Data
We retain your personal information for as long as necessary to:
- Provide our services to you and your school
- Comply with legal obligations (e.g., financial records, audit trails)
- Resolve disputes and enforce our agreements
- Maintain the integrity of historical school schedules and records
Your Right to Request Account Deletion
You may request deletion of your account at any time by contacting us via email: schoolmenuseu@gmail.com
We will process your request within 30 days of verification.
What Happens When You Request Deletion
Upon receiving your deletion request, we will:
If You Have Teaching History:
To preserve the integrity of school schedules and ensure continuity of service, we will
anonymize your account rather than delete it:
- Your name will be changed to "Deleted User"
- Your email address will be permanently removed from our systems
- All profile information will be deleted
- Your login credentials will be permanently deleted
- You will not be able to access your account
- Historical lesson schedules will be preserved (with anonymized teacher references)
If You Have No Teaching History:
We can permanently delete your account and all associated data:
- All personal information will be completely removed
- All account data will be permanently deleted
- This action cannot be undone
Understanding Anonymization
When we anonymize your data:
- You cannot be identified: All personally identifiable information is permanently removed
- You cannot be contacted: Your email and contact details are deleted
- Not personal data: Under GDPR and similar laws, truly anonymized data is no longer
considered "personal information" and can be retained for business purposes
- Cannot be reversed: The anonymization process is permanent and irreversible
Why We Retain Anonymized Data
We retain anonymized scheduling data for legitimate business purposes:
- Schedule Integrity: Schools require accurate historical records of when lessons
occurred for administrative and planning purposes. Schools may keep a record linking anonymized data to your personal information, however this will not be facilitated by our service.
- Operational Continuity: Ensures current schedules and reports remain accurate
- Service Improvement: Helps us understand usage patterns to improve our platform
(aggregate data only)
Legal and Regulatory Retention
Some data may be retained beyond 30 days where required by law, including:
- Financial records: Payment and subscription information (typically 7 years for tax purposes)
- Audit logs: Security and compliance records as required by law
- Legal holds: Data subject to ongoing legal proceedings or investigations
Verification Process
To protect your account from unauthorized deletion requests, we will verify your identity
before processing any deletion request. This may involve:
- Confirming the request came from your registered email address
- Asking security questions
- Requiring you to log into your account to confirm the request
Questions About Data Deletion?
If you have questions about our data retention or deletion practices, please contact us at
schoolmenuseu@gmail.com.
8. International Data Transfers
Where Your Data is Located
Your personal information is stored and processed in the United States:
- Database: Stored on servers in the United States (AWS us-west-1 region, Northern California) operated by Supabase
- Application: Hosted on a global content delivery network operated by Vercel
- Payments: Processed by Stripe (if you make payments)
What This Means
If you are located outside the United States, your personal information will be transferred to and processed in the United States. The United States may have different data protection laws than your country.
How We Protect Your Data
We use the following technical measures to protect your information:
- Encryption in transit (TLS/HTTPS for all connections)
- Encryption at rest (data encrypted in our database)
- Access controls (only authorized personnel can access data)
- Data isolation (each school's data is kept separate)
Third-Party Service Providers
We use the following services under their standard terms of service:
These service providers operate globally and may process your data in various locations as described in their privacy policies.
Your Rights
You have the right to:
- Know where your data is stored
- Request a copy of your data
- Request deletion of your data
- Object to international data transfers
Questions?
If you have questions about where your data is stored or processed, please contact us at
schoolmenuseu@gmail.com.
9. Children's Privacy
Our Service is designed for use by educational institutions and their authorized personnel. We do not knowingly collect personal information directly from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by:
- Posting the new Privacy Policy on this page
- Sending you an email notification (if you have provided an email address)
Your continued use of our Service after any changes constitutes acceptance of the updated Privacy Policy.
11. Compliance with Google API Services User Data Policy
SchoolTools's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We only access Google user data that is necessary for our application's functionality
- We do not use Google user data for advertising purposes
- We do not sell or transfer Google user data to third parties
- We provide clear disclosure about our data practices
- We implement appropriate security measures to protect Google user data