Privacy Policy — edooview
Version 1.5 · Effective from 06-10-2026
Written 23-08-2026 from an audit of what edooview actually stores; checked against the code again 04-10-2026. Not legal advice; a lawyer has not reviewed this text. This policy is written in one voice, and this text is the binding one.
1. Who is responsible
Data controller: We make AI work s.r.o., IČO 29697115, Nové sady 988/2, Staré Brno, 602 00 Brno, contact support@edooview.com. edooview is our product; this policy covers only it.
2. Our default: minimise
We collect as little as we can get away with, technically and legally (our internal rule: minimise → hash → encrypt). We do not sell data. We do not run third-party advertising or cross-site tracking. If you decline optional data, the service keeps working — with the honest trade-offs listed in §7.
3. What we collect and exactly why
| What | Why (purpose) | Legal basis | Kept for | Where |
|---|---|---|---|---|
| Your email address | sending sign-in links, and nothing else — no newsletters | contract (Art. 6(1)(b)) | account lifetime | Scaleway (EU); the request passes through the Bunny edge first |
| Sign-in tokens (stored only as a SHA-256 hash) and the IP that requested them | letting you sign in without a password; spotting abuse of the sign-in form | contract / legitimate interest (6(1)(f)) | 15 minutes to use, rows purged after 24 hours | Scaleway (EU) |
| Your Edookit school login (username + password, encrypted with a key unique to your family) | reading your own school portal on your behalf — the service cannot work without it | contract | until you disconnect the school or delete your account | Scaleway (EU); the master key lives only in the host's secret store, never in the database |
| Trial fingerprint: a one-way SHA-256 hash of your school's Edookit address and your Edookit username (never the password), and the date the free trial started | one free 30-day trial per school account: when the same school login is connected again — also under a new e-mail address — no second trial is given | legitimate interest (6(1)(f)): keeping the free trial from being abused | without a time limit, also after you delete your account — then linked to no account. The login cannot be read back from the hash, but someone who already knows a login could compute the same hash, so we treat it as personal data | Scaleway (EU) |
| Your children's names, class and school person-id, as shown in your portal | attributing messages, homework, exams and lessons to the right child | contract | until you disconnect or delete | Scaleway (EU) |
| The content of your school portal: messages, homework, exams, grades, records, timetable lessons, consents, payments — including sender and addressee names | showing it back to you, translated and sorted; that IS the service | contract | until you delete the item or your account | Scaleway (EU) |
| AI translations and summaries of that content | making a Czech portal readable for a parent who does not read Czech | contract | with the item | Scaleway (EU); generated by Anthropic (see §4) |
| Push subscription (browser endpoint + keys, browser user-agent string) | delivering the notifications you switched on | consent (6(1)(a)) | until you turn notifications off or the browser drops it | Scaleway (EU) + your browser's push service |
| Notification preferences (time of day, timezone) | sending the daily summary when you asked for it | consent | until changed or account deleted | Scaleway (EU) |
| Calendar feed (Premium): the secret feed address, stored only as a SHA-256 hash, with when a calendar app last fetched it and how many times | so your calendar app can subscribe to your children's lessons and events, and so Settings can show you that the feed is in use and let you revoke it | contract (Art. 6(1)(b)) | until you revoke the feed (that also resets the time and the count) or delete your account | Scaleway (EU) |
| Audit log: who changed what, and when | so no change to your data is silent, and problems can be traced | legal obligation / legitimate interest | 12 months | Scaleway (EU) |
| Error log: technical message, a run id, an account id | keeping the service working and diagnosing failures — never message content | legitimate interest | 90 days | Scaleway (EU) |
| Rate-limit counters: per one-hour window, a count stored under a shortened SHA-256 hash of what is being limited — your IP address (sign-in requests, guest checkout, calendar-feed fetches, error reports), the e-mail address of a guest checkout, your account id (translation feedback, data export, coupon attempts) or the calendar-feed hash; never the address or e-mail itself | protecting sign-in, checkout, the calendar feed and error reporting from abuse and overload | legitimate interest (6(1)(f)) | one row per hash, reused for every new hour; rows are kept without a time limit. An IP address could be recovered from its hash by trying every address, so we treat these as personal data | Scaleway (EU) |
| Premium payments: which plan, for how many children, the amount, when it was paid, Mollie's customer, payment and subscription ids, a coupon code if you used one | so your Premium switches on, renews or stops as you asked, and so a payment can be traced or refunded; after your account is deleted, only so our receipts can be matched to the money received | contract (Art. 6(1)(b)); after account deletion legal obligation (Art. 6(1)(c)): Czech Accounting Act No. 563/1991 Coll. | a paid or still-open payment (plan, amount, status, dates, Mollie's payment id): as long as Czech accounting law requires, also after you delete your account — then detached from it and used only for our accounting; a failed, expired or cancelled payment, the Mollie customer and subscription ids and the coupon record: deleted together with your account. Mollie keeps its own record of the payment (§4) | Scaleway (EU); the card or bank details themselves only ever at Mollie |
| Receipts: the receipt number, your email address at the moment you paid (kept as it was, even if you change it later), the plan, the amount and currency, a coupon code if you used one, the language, when you paid and when the receipt was mailed, Mollie's payment id | a numbered receipt for every paid payment, mailed to you — the seller's record of the sale that Czech accounting law asks for (we are not VAT-registered, so it is a receipt, not a VAT invoice) | legal obligation (Art. 6(1)(c)): Czech Accounting Act No. 563/1991 Coll. | as long as Czech accounting law requires, also after you delete your account — then detached from it (linked to no account) and used only for our accounting; the copy we mailed you is yours to keep; included in "Download my data" | Scaleway (EU); mailed through Scaleway's mail service |
| Page counts: when the landing page or the inbox opens, your browser sends only the page's name, and we add 1 to that page's total for the day — no cookie, no IP address, no account id and no web address is stored with it | knowing how often the app's main pages are used, and nothing finer | legitimate interest (6(1)(f)); the daily total itself identifies no one | the daily totals are kept without a time limit | Scaleway (EU) |
Not collected: no tracking analytics (the page count above is an anonymous daily total, without cookies), no advertising, no tracking cookies, no profiling, no location, no payment card data. edooview has no ads, no third-party analytics and no third-party trackers.
4. Who else touches the data (processors)
Scaleway SAS (Paris, France — hosting, the PostgreSQL database and the sending of sign-in and alert emails, all in the EU; the mail service receives your email address and the message) · BunnyWay d.o.o. (Ljubljana, Slovenia — the content delivery network and DNS in front of the site: your browser talks to its edge first, so it sees your IP address and the page you request, nothing more; EU visitors are served from EU nodes) · Anthropic (USA — AI translation and categorisation: the subject and body of your school items are sent for translation under zero-retention API terms and standard contractual clauses; they are not used to train models) · your browser vendor's push service (Google, Apple or Mozilla — receives an opaque endpoint and the notification text, which is why notification text stays short and never contains grades or medical detail) · Mollie B.V. (Amsterdam, the Netherlands — payment processing for Premium: your card or bank details go to Mollie directly and never to us; Mollie is an independent controller for the payment itself under its own privacy policy, and we receive back only the payment's status, amount and ids). Google Ireland Ltd. (Dublin, Ireland — Google Workspace hosts our support mailbox: when you write to support@edooview.com, or reply to a mail from us, your message and address are stored there; nothing else from the product goes to Google) · Each is bound by a data processing agreement; none may use the data for its own purposes.
5. Your rights
Access, rectification, erasure, restriction, portability, objection — write to support@edooview.com, we act within 30 days. You can complain to the Czech supervisory authority: ÚOOÚ, https://uoou.gov.cz. Erasure is real: our systems are built to delete (see §2) — except the receipts and Premium payment records in §3, which the law makes us keep, and the trial fingerprint in §3, which stops a second free trial for the same school account.
6. Cookies and consent
Strictly necessary cookies/storage run always (session, security — consent-exempt). edooview uses exactly one cookie: the sign-in session cookie, which is strictly necessary and set only after you sign in. There is no analytics cookie, no advertising cookie and no third-party cookie, so there is no cookie banner to click away — because there is nothing optional to consent to.
The service worker stores the app's icons and code in your browser so it can be installed as an app. It also keeps the last inbox and calendar page you opened, on your own device only, so they can still be read without a connection — always under a banner that says you are offline and when that copy was loaded, never as if it were current. Signing out deletes that copy; no other page is stored.
The one optional thing we ask for is push notifications, which your browser asks you to allow explicitly and which you can switch off at any time under Settings → Notifications.
7. If you decline everything — the honest trade-off
Declining costs you no core functionality and we hold no grudge. edooview has no tracking analytics, no advertising and no tracking cookies to decline in the first place (the anonymous page count in §3 stores nothing about you) — the only optional thing we ask for is push notifications, and refusing them changes nothing else. What you give up: you will not be told about tomorrow's lessons or an urgent message; you will see them the next time you open edooview.
We will not pretend we then hold nothing: to sign you in and read your school portal we still need your email address and your encrypted Edookit login, plus the portal content itself — exactly the rows in §3 and nothing beyond them. If that is not acceptable, the honest answer is that edooview cannot work for you, and you can delete your account at any time.
8. Changes
Changes to the service that touch data (new feature, new cookie, new processor, new price flow) update this policy in the same release — the version and date above always tell you where you stand. Material changes are announced in the service.