Privacy Policy

1. Data we collect

Account data: name, email, password (stored as a one-way hash), language, and the school's name and country.

Timetable data the school enters: teacher names, subjects, classes, rooms, lessons, absences, cover and duties.

Student data (only when electives are used): name and class.

Technical data: IP address and sign-in attempts to protect accounts, plus the school's activity log.

2. Why we use it

To provide and run the service, protect accounts and prevent fraud, send service emails (password reset, invites, notifications), and improve the platform with aggregated statistics that identify no one.

We never use your data for advertising and never sell it.

3. AI assistant

When you use the assistant, a summary of the timetable (teacher names, subjects, classes and lessons) is sent to the AI model provider to generate the answer. Student names are never sent.

The model provider may be outside Kuwait; we choose providers that commit not to train their models on your data.

"AI learning" is on by default, so conversations are stored unless the school's administrators turn it off (which deletes them immediately). Teacher and school names and any emails or phone numbers are removed before any training use, and conversations are deleted automatically after the retention period the school sets.

4. Who we share it with

Service providers acting only on our behalf: hosting (Hostinger — data centre in Frankfurt, Germany (European Union)), email delivery and the AI model provider. All are contractually bound to protect the data.

Authorities, when we receive a binding legal request from a competent authority in the State of Kuwait.

Timetables published with a public link are visible to anyone with the link; the school can unpublish at any time.

5. Transfers outside Kuwait

Where data is processed outside the State of Kuwait (for example hosting or the AI assistant), we apply the safeguards the rules require and send only the minimum data needed.

6. Retention

We keep school data for the life of the account and 30 days after it is closed, then delete it. Sign-in attempt records are deleted after two days, and password reset links once used or after one hour.

7. Security

Encrypted connections (HTTPS), hashed passwords (bcrypt), temporary lockout after repeated failed sign-ins, separation of each school's data, role-based permissions and an activity log for administrators.

If a breach affects personal data, we notify the affected school and the competent authorities within the periods the rules set.

8. Your rights

You can access, correct, export and ask us to delete your data, and withdraw consent for optional features. Most of this can be done in the app, or email us at support@gadwaly.com and we will reply within 30 days.

For teacher and student data entered by a school, requests go to the school's administration as the party responsible for that data, and we help it carry them out.

9. Cookies

We use one essential cookie to keep you signed in, and local storage for language and theme preferences. We use no advertising trackers.

10. Children

The platform is for school administrations and teachers. Students do not create accounts, and families view published timetables without signing in.

11. Updates and contact

We will tell you about any material change to this policy. For questions or to exercise your rights: support@gadwaly.com — [Address], State of Kuwait.