Privacy Policy

This policy explains which personal data the Unify Edu platform processes, what it is used for, who it is shared with, how long it is kept, and how to exercise the rights over it. It applies to the web application (app.unifyedu.net), the Unify Edu mobile applications for Android and iOS, and the unifyedu.net website.

1. Who is responsible

Unify Edu is a service of UnifyEdu, located in Heredia, Costa Rica. Privacy contact: info@unifyedu.net

Unify Edu is a school management platform contracted by schools. Responsibilities are therefore divided as follows:

• The school is the controller of its community’s data: it decides which data it records about students, families and staff, and for which educational purposes.
• UnifyEdu acts as the data processor: it stores and processes that data on behalf of the school, following its instructions and only to provide the service.

For data from anyone who writes directly to UnifyEdu (for example, to info@unifyedu.net), UnifyEdu is the controller.

2. What data is collected

Account data. Name, email address, role (administration, teacher, family or student), school, and group or section. Accounts are created by the school; the platform does not allow open sign-up.

Academic and school data. Grades and assessments, attendance and absence justifications (which may include health reasons when the family provides them), behavior records, daily reports, class materials and school calendar events.

Student record. The student’s photo, family contact details, emergency contacts and, when the family chooses to add it, the location of the home on a map.

Communications. Messages, chat conversations, announcements, wall posts, form responses and any files attached to them, as well as read receipts.

Help assistant (web application). Questions written to the AI-powered help assistant and support requests.

Technical data. An identifier used to send notifications to the device, the application version, error logs from the web application, and technical server logs (such as IP address and access time) generated by infrastructure providers.

Emails. Emails sent by the platform (account activation, reports, notices) include an open indicator that records whether the email was opened.

The platform does not use third-party analytics tools, does not display advertising, and does not track users’ activity across other apps or websites.

3. How data is collected

• The school records most of the data (accounts, groups, grades, attendance, behavior).
• Families, teachers and students provide data when using the platform: messages, forms, photos, emergency contacts and home location.
• The mobile applications only access device features with the operating system’s permission and when the person uses the feature that needs it:

These permissions can be withdrawn at any time from the device settings. Denying them only disables the corresponding feature.

4. What the data is used for

• Providing the school management service contracted by the school.
• Enabling communication between the school, its staff and families.
• Sending notifications and emails related to the service.
• Answering questions and support requests.
• Keeping the platform secure, preventing misuse and fixing errors.
• Complying with legal obligations.

Data is not sold, not used for advertising and not used to build commercial profiles. Data collected for one purpose is not reused for another without new authorization, unless the law allows it.

5. Who the data is shared with

Within the school. Each person only sees what their role allows: authorized staff see their school’s data; each family sees data about its own students; each student sees their own. One school’s data is not visible to other schools.

Service providers. UnifyEdu uses external providers to operate the platform. All of them process data only to provide their service and are contractually bound to protect it at a level equal to or higher than this policy. They fall into these categories:

• Cloud infrastructure: hosting, database, file storage, authentication and notification delivery. They process all platform data.
• Maps: display the map used to place the home. They receive the home location.
• Artificial intelligence: process questions written to the web application’s help assistant to generate the answer.
• Email delivery: deliver the platform’s emails. They receive the email address, name and message content.
• Error logging: receive technical data about web application errors so they can be fixed.

The current list of providers is available on request at info@unifyedu.net.

Authorities. When required by law or by an order from a competent authority.

International transfers. Some of these providers store or process data on servers located outside Costa Rica, including the United States. The same safeguards described in this policy apply in every case.

6. Minors

Most students are minors. Their data is recorded by the school, which is responsible for obtaining the consent of their mothers, fathers or legal guardians, as required by Costa Rican Law No. 8968. Unify Edu does not display advertising, does not share student data for commercial purposes, and limits what each student can see and do on the platform.

7. Security

• All information travels encrypted (HTTPS/TLS) and is stored encrypted on the providers’ servers.
• Access is controlled by role and by school, with server-side security rules.
• Only UnifyEdu staff who need it to operate the platform or provide support can access the data.

No system is infallible. If an incident affects personal data, UnifyEdu will notify the school and the affected people as required by law.

8. How long data is kept

• Data is kept for as long as the school keeps the contracted service.
• Message threads and their attachments are deleted automatically 18 months after the last message.
• When a school ends the service, its data is deleted within the following 90 days, unless the school requests a copy beforehand or the law requires keeping it longer.
• Technical and error logs are kept only for the period defined by the providers of those services.

9. Rights over the data

Under Costa Rican Law No. 8968 on the Protection of Individuals with regard to the Processing of their Personal Data, and its regulations, every person may:

• Access their personal data.
• Rectify inaccurate or incomplete data.
• Delete their data when it is no longer necessary.
• Withdraw consent previously given.
• Object to a specific processing activity.

For students who are minors, these rights are exercised by their mothers, fathers or legal guardians.

Since the school is the controller of school data, the fastest route is to send the request to the school. Requests can also be sent to info@unifyedu.net; UnifyEdu will coordinate the response with the school within the time limits set by law. Exercising these rights is free of charge.

If the response is not satisfactory, a complaint can be filed with Costa Rica’s Data Protection Agency (Agencia de Protección de Datos de los Habitantes, PRODHAB).

10. Account deletion

Accounts are created and managed by the school. To request deletion of an account and its personal data:

1. Ask the school, or
2. Write to info@unifyedu.net from the account’s email address, stating the name and the school.

UnifyEdu will delete the account and the associated personal data. Only records the school must keep by legal obligation (for example, the academic history) will be retained, and only for as long as that obligation requires.

11. Local storage and cookies

The web application stores the signed-in session and some preferences (such as the visual theme) in the browser. The mobile applications store equivalent data on the device. No advertising or tracking cookies are used.

12. Changes to this policy

When this policy changes, the new version will be published on this page with its update date. If the change is significant, it will also be announced within the platform.

13. Contact

UnifyEdu — Heredia, Costa Rica info@unifyedu.net