Privacy Policy

1. Who controls the data?

NanoStudent operates the platform. When a school uses NanoStudent to manage its students, the school determines the purpose of educational records, while the platform processes data to provide the service according to the school’s instructions and account settings.

2. Data we process

Data may include name, email, role, date of birth when needed for minor protection, school and class information, subjects, homework, exams, answers, results, attendance, behavior, certificates, support messages, notifications, subscriptions, credits, school-fee records, user-uploaded files, and technical or security records such as sign-in time, request identifiers, and hashed network or browser fingerprints.

We do not store the original password; we store a one-way password hash. We do not ask users to enter full payment-card details into platform forms.

3. How we receive data

We receive data directly from users, from schools, teachers, and parents acting within their permissions, or automatically when the service is used for security and operation. Authorized users may import school data from reviewed CSV or XLSX files.

4. Why we process data

We use data to create and verify accounts, operate exams and autosave, manage attendance, homework, results, reports, and certificates, link students with approved parents and schools, deliver notifications and digests, manage subscriptions, credits, and school fees, provide support, prevent misuse, retain required records, and improve platform reliability and experience.

5. AI and human review

When an AI feature is used, user-selected text or files may be sent to an external processing provider to generate questions, summaries, or practice. We send only content needed for that operation and keep operational request records without copying source content into the usage log. Teacher-generated questions are created as drafts for human review before publication, and AI output may be inaccurate and must be reviewed.

Adult users can disable AI processing in the Privacy Center. A minor student account cannot use AI features until an approved linked parent grants both student-data and AI-processing consent.

6. Minors, schools, and parents

The platform uses date of birth to apply minor-protection settings. Schools and parents must ensure required authority and consent before adding student data and should avoid collecting unnecessary information. Parents see student information only after an approved link, and school or teacher permissions remain scoped to their school and classes.

7. Sharing and service providers

We do not sell student data. We may use hosting, email, sign-in, AI, and payment providers when enabled, only as needed to deliver the service. Information may be disclosed when legally required, to protect users or the platform, or in a legitimate business transaction with appropriate safeguards. Optional services such as advertising are loaded only after cookie consent.

8. Retention and deletion

We retain account data while the account is active and as needed to provide the service, resolve disputes, and meet applicable obligations. Sign-in, reset, and invitation tokens expire quickly; data-export files are deleted after expiry; and old operational records are cleaned periodically. When an account is deleted, credentials are disabled and personal information is anonymized where practical, while limited academic or financial records may be retained when necessary.

9. Your rights and choices

You can correct account details, change your password, manage consent and optional communications, request a downloadable copy of your data, and request account deletion from Settings. Parents can manage consent for linked children. Schools can request correction or export of records they administer within their permissions. We may verify identity before completing a request.

10. Security and data transfers

We use role-based access, school-data isolation, encrypted transport when HTTPS is enabled, password and token hashing, session protections, file-type checks, security logs, and recommended backup and recovery procedures. No system is completely secure. Data may be processed in countries where service providers operate, using appropriate arrangements where available and required.

11. Cookies

Essential cookies support sessions, security, and preferences. Optional advertising or measurement technology does not load before consent. See the Cookie Policy or open Privacy Settings from the footer.

12. Contact and updates

For privacy requests, use the Contact page or email support@nanostudent.com. We may update this policy when the service or requirements change. We will display the revision date and may request renewed consent for material changes.