Privacy policy

Who is responsible for your data

Ummia is a school platform. Each school that uses Ummia decides what data it records about its students, families and staff, so the school is the controller of that data.

Ummia, built and run by Alphabet (alphabet.iq), stores and processes that data for the school as its processor, only to run the service the school uses. Each school's data is kept separate from every other school's.

What we collect

• Account details: your name, phone number, account type (for example student, parent, teacher, driver or manager) and your chosen language. Your password is stored only as a secure hash.
• Student records the school enters: personal details, class and section, enrolment, attendance, exam marks, reviews, homework, fees, bills and payments.
• Profile photos and documents: a photo and any documents you or the school add to a profile, such as identity papers or certificates.
• Attendance and check-in location: when a teacher, staff member or student checks in from the app, the app reads the phone's location at that moment only, with its accuracy, to check it is within the school's distance. Ummia does not track anyone's location in the background.
• Driver location: a driver's phone shares its location only while the driver has a trip running, so the school and the parents of the children on that trip can follow it. Location sharing stops when the trip ends. The route points are deleted 90 days after the trip ends; the pick-up and absence marks are kept.
• Chat messages and files sent in the app's chat and groups.
• A push notification token (Firebase Cloud Messaging) for each phone you sign in on, so the school can send you notices and alerts.
• Requests sent from the public website or the app's job application: the name, phone and details you type in, and an attached CV.

Who can see it

• Your school's staff see what their account type allows, for example an accountant sees fees but not marks.
• Parents see their own children's records. Students see their own.
• The school manager can read every chat in the school from the chat dashboard. The app tells each user this before their first chat.
• Ummia's support staff only when the school asks for help or to keep the service working.

What we never do

• The app shows no advertising from third parties and has no advertising trackers.
• We never sell personal data or share it with advertisers or data brokers.
• We do not use your data for anything except running the school's service.

Services we use

Push notifications are delivered through Google Firebase Cloud Messaging, which receives the notification and your phone's push token. Data is stored on Ummia's own servers. No other third party receives your personal data.

Children

Children's accounts are created by their school, with their parent's knowledge, never by self sign-up. A parent's account covers all their children in that school, and parents can see what the school records about their child.

How long we keep it

Data is kept while the school uses Ummia and the account exists. Past study years stay with the school's records. Driver route points are deleted 90 days after each trip. When an account is deleted, see the account deletion page for what is removed and what the school must keep.

Security

All traffic is encrypted (HTTPS). Passwords are hashed. Each school's data is separated so no other school can reach it, and staff see only what their role allows.

Your rights and contact

You can ask to see, correct or delete your data. Ask your school first, since it holds your records; you can also contact Ummia support by phone or WhatsApp from the support page. If this policy changes, the date at the top of this page changes with it.