Privacy Policy

1. Who this policy covers

The Service is used by school staff — teachers, coordinators and leadership. Accounts are created for adults in a professional capacity. The Service is not designed for, marketed to, or intended to be used directly by children.

2. What we collect

• Account data — name, work email, role, school, and approval status.
• Authentication data — securely hashed passwords and session tokens (handled by Supabase Auth).
• Content you upload — teaching resources, lesson plans, weekly plans, assessment materials and Welcome Hub content, plus file names and metadata.
• Usage data — basic logs such as pages accessed and timestamps, used for security and troubleshooting.
• Billing data — for paid plans, subscription status and the billing contact. Card details go directly to our payment provider; we never receive or store them.

3. Data about children

We ask schools notto upload sensitive personal information about identifiable children. Where teaching material incidentally contains a child's name or work, the school remains the data controller and is responsible for having a lawful basis and appropriate parental consent under its own local requirements.

4. Why we process it

• To provide the Service and keep your school's content available to authorised staff.
• To authenticate users and enforce role-based access.
• To provide support, and to detect and prevent abuse or security incidents.
• To process subscription payments and meet accounting obligations.

5. Where your data is stored, and who processes it

We use a small number of established sub-processors:

• Supabase — database and authentication (account data and content records).
• Cloudflare R2 — file storage for uploaded resources, served via short-lived signed URLs.
• Vercel — application hosting, serving and request logs.
• Anthropic — powers the AI assistant. Queries and the matched titles of your catalogued items are sent to generate answers. It is not used to train models.
• Paddle — our payment provider and Merchant of Record for paid plans. They collect billing details and card data directly; we never receive or store card numbers.

This involves transferring data across borders, including outside Thailand, where we and most of our users are based. We rely on our providers' contractual safeguards for those transfers.

6. Security

• All traffic is encrypted in transit (HTTPS).
• Database access is restricted by row-level security policies.
• Files are private by default and served only through expiring signed links.
• Access to the Service is invite-only and role-based; administrators can revoke access at any time.

7. How long we keep data

We keep account and content data for as long as your subscription is active. After cancellation, data is retained for a limited wind-down window so it can be exported or the account reactivated, and is then deleted — see the Refund & Cancellation Policy. Records we must keep for tax or accounting purposes are retained as required by law.

8. Your rights

You may request access to, correction of, export of, or deletion of your personal data. We honour rights available under the Protection of Personal Information Act (POPIA)in South Africa and Thailand's Personal Data Protection Act (PDPA), and we apply comparable standards to all users regardless of location. To exercise a right, email bradley@littlekoalaschool.com. Note that for content uploaded by your school, we may direct your request to your school as the data controller.

9. Cookies

We use only the cookies needed to keep you signed in and to keep the Service secure. We do not use advertising cookies or third-party tracking for marketing.

10. Changes

We may update this policy. Material changes will be notified by email or in-app, and the "last updated" date above will change.

11. Contact

Bradley Smith (sole trader), trading as Little Koala Teachers Hub, Bangkok, Thailand. Email bradley@littlekoalaschool.com.