Privacy policy

1Who is responsible

The data controller is «Çallı Məktəb». The system is built and maintained by Upp.az Agency, which processes data only on the school’s instructions and for technical support.

2What we collect

• Identity: first name, last name, patronymic, date of birth, gender, ID photo (if uploaded by the school).
• Contact: phone number, e-mail (optional).
• Education data: class, grades, attendance, homework and uploaded files, online test results, behaviour notes, documents and certificates.
• Payment records: tuition charges and receipts (no card data is collected).
• Communication: in-app messages, announcements, notifications.
• Technical: sign-in time, IP address, device/browser type, push subscription, devices where «Remember me» was chosen.

3How we use it

• Keeping the electronic journal and managing the learning process.
• Informing parents about grades, attendance and homework (notifications, SMS).
• Account security: verifying sign-ins and blocking suspicious attempts.
• Overall reports and analytics for school leadership.

4Who we share it with

Data is never sold, used for advertising or given to third parties, except where strictly needed to run the service:

• Hosting provider — data is stored on the school’s secured hosting server.
• SMS provider — only the phone number and message text, to send SMS.
• Notification services (Google, Apple, Microsoft) — to deliver push notifications; content is transmitted encrypted.
• When required by law — competent public authorities.

5Children’s data

Student accounts are created by the school with parents’ knowledge. Students see only their own data; parents see only their own children’s data. The app contains no ads, no paid content and no contact with outsiders.

6Retention

Account data is kept while the student/employee is at the school. Grades and attendance are official school records and may be kept for the period required by law. Backups are kept for at most 90 days.

7Security

• All traffic is encrypted with HTTPS.
• Passwords are stored as one-way hashes — nobody, including administrators, can see them.
• Two-factor sign-in (2FA), automatic blocking after failed attempts, revocation of suspicious sessions.
• Each user sees only the data their role allows.

8Cookies

Only cookies required for the system to work are used: session, language and theme, «Remember me» (only if you choose it, 30 days). There are no advertising, tracking or analytics cookies.

9Your rights

You may view your data, ask for corrections and request deletion of your account. Contact the school administration or use the «Account deletion» page.

Account deletion page →

10Changes

If this policy changes, the new version is published on this page. Last updated: 12.10.2026.