Privacy Policy

Who is responsible

Your school decides which students, parents and staff have accounts and what is recorded about them. The owner of elephantplanner.com provides the service and handles the data on the school’s behalf, following its instructions. For questions about your own data, contact your school.

What we hold

• Staff: name, school email address and username.
• Students: first name, last initial, year/grade, class or form, and username. We do not hold surnames, student email addresses, phone numbers or home addresses.
• Parents and guardians: the email address the school has on file for them.
• School activity: tasks and assessments set, the status teachers record for each student (such as on time, late or missing), grades and teacher notes where a teacher chooses to show them, study-session replies, parents-evening bookings, dismissal marks, and announcements and links.
• Technical: a sign-in cookie that keeps you signed in, and server logs used to find faults.

We do not use advertising or tracking cookies, and we do not sell data.

Location

Some dismissal options are limited to parents who are near the school. If you use one, your phone or browser asks permission to share your location. It is compared with the school’s pickup area at that moment to confirm you are close enough, and is not stored.

Why we use it

Only to run the service for the school: showing the right work and notices to the right people, letting teachers record progress, emailing parents about their child’s work, running dismissal and parents evenings, and keeping the service secure and working.

Who can see it

• Students see their own work and statuses.
• Parents see the work and statuses of their own children only.
• Teachers see the classes they teach.
• School administrators see the whole school. Dismissal assistants see only the dismissal, study-session and parents-evening tools.
• The owner of the site can access data only where needed to run or fix the service.

Service providers and where data is kept

We use trusted providers to run the service: Vercel (website hosting), Supabase (database and file storage) and Resend (sending email). The database and files are hosted in data centres in Asia. Where data is held outside Thailand, we rely on the safeguards the PDPA requires for transfers.

How long we keep it

While your school uses Elephant Planner. During the beta, data may be deleted when the beta ends. A school administrator can remove accounts at any time.

Security

Data is encrypted in transit. Passwords you choose are stored in hashed form. A temporary password issued by your school is kept until you choose your own, so the school can reissue a login slip; the service asks teachers and parents to choose their own password at first sign-in. Access is limited by role, and we are alerted when the service fails.

Children

Student accounts are created by the school. The school is responsible for having the permission it needs from parents or guardians to use the service. Parents can ask the school to see, correct or delete their child’s data.

Your rights

Under the PDPA you can ask to access or receive a copy of your data, have it corrected or deleted, object to or restrict how it is used, and withdraw consent where we rely on it. Ask your school, who can pass the request on. If you are not satisfied you can complain to Thailand’s Personal Data Protection Committee.

Changes

If we change this page in a way that matters, we will tell your school and update the date at the top.