1. Who is responsible for your information
For the website, contact inquiries, account registration, billing, and our own business records, AcademyTempo decides how and why personal information is processed (we are the “controller” or “organization” under applicable law).
For records that an academy enters or generates in its workspace, such as students, guardians, teachers, lessons, attendance, learning records, finances, messages, and coaching material (“Customer Data”), the academy is the controller and we process that data only on its instructions as its processor or service provider, under our Data Processing Addendum. If you are a student, guardian, or teacher and have questions about how an academy uses your information, contact the academy first; we will help it respond.
2. Information we collect
Website visits
Our hosting provider processes ordinary request metadata (requested page, time, browser type, and network address) to deliver and protect the site. Our own application logs use a strict allowlist and do not store network addresses, message content, identities, tenant identifiers, or secrets. We measure website traffic with Vercel Web Analytics, which counts page views in aggregate without cookies, cross-site identifiers, or personal profiles. We do not use advertising trackers, and we do not sell or share personal information for cross-context behavioral advertising.
Contact inquiries
When you submit the contact form we collect the inquiry type, your name, work email, role, organization name, approximate academy size, primary need, timeline, your message, the time of submission, your consent record and the version of this notice you accepted, and one-way keyed hashes used to prevent duplicate and abusive submissions. Do not include student or guardian information in the form. If you choose to book a call through our scheduling link, Calendly collects the name, email address, and meeting time you enter on its own pages under its own privacy notice, and we receive those booking details to hold the call.
Accounts
When your academy gives you access we process your name, email address, role, academy membership, sign-in events, and security events. Authentication is provided by Supabase Auth and, if your academy enables it, Google sign-in; those providers process credentials and tokens. We never see your password.
Workspace records (Customer Data)
Academies enter and generate records about students (name, grade, enrollment, attendance, learning notes, approved reports), guardians (name, relationship, contact channels, consent and delivery records), teachers and staff (name, subjects, availability, compensation and payroll records), schedules and locations, finances (invoices, payment evidence, reminders), and communications the academy approves for delivery. Card numbers are entered directly with Stripe and never reach our systems.
Lesson coaching
If an academy enables coaching, teachers may record or upload lesson audio of adults with the consent the academy is responsible for obtaining. Audio is sent to a speech-to-text provider for transcription, the provider’s copy is deleted after processing, and we keep the transcript, speaker mapping, evidence excerpts, and coaching drafts. We do not retain raw audio by default.
Billing
If your academy subscribes, Stripe processes payment details and we store the plan, status, and Stripe references needed to run the subscription.
3. How we use information and on what basis
- To provide, operate, secure, and support the Service and respond to inquiries (performance of a contract; our legitimate interest in running the business).
- To run AI Features that interpret requests, draft content, classify, or summarize. Before any request leaves our systems for a model provider, we minimize it: full names become first names, contact details and sensitive numbers are removed from free text, and only the task’s scoped context is included. Model providers are contractually prohibited from using our inputs or outputs to train their models (performance of a contract; legitimate interest; consent where required).
- To send transactional messages about your account, security, and the Service, and, where you have asked us to, to follow up on an inquiry. We do not send marketing email without consent, and every commercial message includes an unsubscribe mechanism as required by Canada’s Anti-Spam Legislation and the CAN-SPAM Act (consent; legitimate interest).
- To detect, prevent, and investigate abuse, fraud, and security incidents, and to enforce our Terms (legitimate interest; legal obligation).
- To keep business, tax, and audit records and to comply with law and lawful requests (legal obligation).
- To produce aggregated or de-identified statistics that do not identify any person (legitimate interest).
We do not use Customer Data, inquiry content, or account data to train artificial-intelligence models, and we do not make automated decisions that produce legal or similarly significant effects about a person without human review.
4. Who we share information with
We share personal information only with: service providers who process it for us under written contracts (hosting, database and authentication, email and SMS delivery, model inference, speech-to-text, payments), listed on the Subprocessors page; third-party integrations your academy chooses to connect, such as Google Workspace, which then process data under their own terms; professional advisers under confidentiality; authorities where required by law or to protect rights, safety, or the integrity of the Service; and a successor in a merger, acquisition, or asset sale, under this notice. We do not sell personal information and have not sold it in the preceding twelve months.
5. International transfers
We are a Canadian company and our infrastructure is hosted in the United States (Vercel edge and serverless runtime; Supabase managed Postgres and authentication). Personal information may therefore be processed in the United States and in the countries where our service providers operate, and may be subject to lawful access by authorities there. Where required, transfers rely on contractual protections such as standard contractual clauses or an equivalent lawful mechanism, and our providers commit to appropriate safeguards. By using the Service you acknowledge these transfers.
6. Cookies and similar technologies
The website and Service use only strictly necessary cookies and browser storage: a session cookie that keeps you signed in, security tokens that protect forms and sign-in, and interface preferences. We do not use analytics or advertising cookies. If we add non-essential cookies in the future we will update this notice and, where required, ask for consent first.
7. How long we keep information
- Contact inquiries: up to 24 months after the last contact, then deleted unless a business relationship follows.
- Account data: for the life of the academy’s subscription and up to 12 months after it ends, to allow reactivation and to maintain audit records.
- Customer Data: for the life of the academy’s subscription. Within 30 days after termination we delete it from live systems on the academy’s instruction, and backup copies expire on a rolling schedule within 90 days.
- Audit and security logs: up to 24 months.
- Billing and tax records: as long as tax and accounting law requires, typically seven years.
We may keep information longer where law requires it or where it is needed to resolve a dispute or enforce our agreements.
8. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to withdraw consent, to object to or restrict certain processing, and to lodge a complaint with a supervisory authority such as the Office of the Privacy Commissioner of Canada, a provincial commissioner, or a state attorney general. Residents of California and other U.S. states with comprehensive privacy laws may also ask us not to sell or share personal information (we do not) and will not be discriminated against for exercising their rights.
To exercise a right, email usajaysim@gmail.com. We will verify your identity and respond within the time the applicable law allows, normally within 30 days. If your request concerns Customer Data held for an academy, we will refer it to that academy and assist it.
9. Children and student information
The website and the Service are directed to adults who work for or with academies. We do not knowingly collect personal information directly from children, and we do not offer accounts to children. Information about students and other minors enters the Service only as Customer Data provided by an academy, which is responsible for having the required authority, notices, and parental or guardian consent, and for honoring parents’ and guardians’ rights to review and delete their child’s information. We process student information solely to provide the Service to the academy, never for advertising, profiling unrelated to the academy’s educational purpose, or training models, and we delete it as the academy instructs. If you believe a child has provided information to us directly, contact us and we will delete it.
10. Security
We protect information with server-side identity and role verification, tenant isolation enforced by database row-level security, encryption in transit and at rest, application-layer encryption of integration tokens, a minimized logging allowlist, append-only audit trails, signed provider webhooks, and human-approval gates before any external action. Our current controls and their limits are described on the Security page. No service can guarantee absolute security; if we learn of a breach affecting your information we will notify you and the relevant authorities as the law requires.
11. Changes to this notice
We will post any change here with a new effective date and version. For material changes we will also notify account holders by email or in the Service before the change takes effect. The version you accepted through the contact form is recorded with your inquiry.
12. Contact
AcademyTempo, a corporation incorporated in Canada. Privacy questions, requests, and complaints: usajaysim@gmail.com. If we cannot resolve your concern you may contact the privacy regulator where you live.