Privacy Policy

Last updated: September 13, 2026

Read this first if You are a parent: the SMART Academy app is used by parents, teachers, and school administrators — all adults — but most of the Personal Data it handles is about the enrolled students, who are usually minors. Students are not users of the App and never create an account or accept these terms. Their data is entered and managed by the School and by the teachers and parents the School has given access, under the enrollment relationship between the family and the School. See Children’s and Students’ Data below for how this works in detail.

This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information — and, where applicable, Your child’s information — when You use the Service, and tells You about Your privacy rights and how the law protects You.

By using the Service, You agree to the collection and use of information in accordance with this Privacy Policy.

Interpretation and Definitions

Interpretation

The words whose initial letters are capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

Account means the unique login (phone number and password) created for a Parent, Teacher, or Admin to access the Service. Accounts are created by the School; the App has no self-service sign-up.
Application or App refers to SMART Academy, the software application provided by the School.
School, Academy, Company (referred to as “the School”, “We”, “Us” or “Our” in this Privacy Policy) refers to ENGLISH FUN WITH MONA SRL, trading as SMART Academy of Languages, a company registered in Romania with registration number (CUI) 28242098, Trade Registry no. J2011000457037, registered address Str. Banu Maracine nr. 1, Pitești, Argeș, 110194, România. The School is the data controller for Personal Data processed through the Service, including data about enrolled Students.
Developer refers to RYA DEV TECHNOLOGY SRL, Romania, Arges, Pitesti, str. Episcop Grigorie Leu nr. 97, VAT 51415258, the software company that built and technically operates the App and its backend on the School’s behalf. The Developer acts as a data processor, processing Personal Data only on the School’s instructions and for the purpose of providing the Service.
Student means a child or young person enrolled at the School whose attendance, evaluations, photos, or other academic records are managed through the App by the School, teachers, and the Student’s Parent. A Student does not hold an Account and does not use the App directly.
Parent means the parent or legal guardian of a Student who holds an Account to view that Student’s records.
Teacher means School staff who hold an Account to record attendance, evaluations, and student work for the group(s) they teach.
Admin means School staff who hold an administrator Account to manage Students, Parents, Teachers, groups, and academy-wide settings.
Device means any device that can access the Service, such as a phone or tablet.
Personal Data (or “Personal Information”) is any information that relates to an identified or identifiable individual, including a Student, whether or not that individual holds an Account.
Service Provider means any natural or legal person who processes data on behalf of the School, including the Developer and the third-party providers listed under Third-Party Service Providers.
Service refers to the Application.
Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself.
You means the individual Parent, Teacher, or Admin accessing or using the Service.

Collecting and Using Your Personal Data

Types of Data Collected

Account and Profile Data

To create Your Account, the School registers the following information on Your behalf:

Phone number (Your login; no SMS is ever sent — the School creates and verifies the Account server-side)
Password (stored hashed; never visible to the School or the Developer)
Display name, and for Teachers, first and last name
Role (Parent, Teacher, or Admin)
For Teachers only: a free-text biography and contract start/end month and year, editable by the Admin
For Teachers only: private notes an Admin may keep about the Teacher; these are never visible to the Teacher themselves

Student Data (Collected and Managed by the School, not by the Student)

While using the Service, the School, Teachers, and Admins enter and view the following data about Students, as part of the School’s own academic records:

Name, age, and enrollment/group information (which language group(s) and level(s) a Student is enrolled in — a Student may be enrolled in more than one group at a time)
Attendance records (present/absent per session)
Evaluations: a grade and written feedback per test, recorded by the Student’s Teacher, dated and tied to a specific group
Photographs: only where the School has recorded that the Student’s Parent has given photo consent. Where consent is recorded, Teachers and Admins may use the App’s camera to capture a Student’s profile photo and photos of a Student’s submitted work. Where consent is not recorded, the App’s database rules technically prevent any photo of that Student from being captured, stored, or viewed — this is enforced at the database level, not only in the App’s interface.
Announcements and messages sent by the Admin to Teachers and/or Parents about the Student’s group

This data is collected and controlled by the School as part of operating the Student’s enrollment, in the same way a paper gradebook or attendance register would be. See Children’s and Students’ Data for how consent and control work for this category.

Voice Dictation and AI-Assisted Feedback

When a Teacher records evaluation feedback by voice instead of typing, the audio is sent directly to Our transcription provider (OpenAI) and converted to text. The App also offers an AI-assisted drafting feature for evaluation feedback, which sends the grade and any notes the Teacher provides to OpenAI to produce a draft the Teacher can edit before saving. See Third-Party Service Providers for details. Only the resulting text is stored by the Service — the audio recording itself is not retained on the School’s or the Developer’s servers after transcription.

Usage Data

Usage Data is collected automatically when using the Service, such as Your Device’s IP address, device and operating system information, the time and date of Your use of the Service, and diagnostic/error data. This is limited to what Supabase (Our hosting and backend provider) and standard mobile operating system logging collect to operate and secure the Service; the App does not include any third-party advertising or analytics SDK.

Information Collected while Using the Application

While using the App, in order to provide its features, We may collect, with prior consent recorded at the Student level as described above:

Photos and camera access, used by Teachers and Admins to photograph a Student’s submitted work or profile photo (subject to that Student’s recorded photo consent)
Microphone access, used by Teachers to dictate evaluation feedback

You (as a Parent, Teacher, or Admin) can review or withdraw Device-level camera and microphone permissions at any time through Your Device settings; withdrawing them only affects features that require them going forward.

Use of Your Personal Data

The School may use Personal Data for the following purposes:

To provide and maintain the Service, including managing Your Account and the Student records associated with it.
For the performance of the enrollment or employment relationship: as part of the contract or arrangement between You (or the Student’s family) and the School — recording attendance, evaluations, and communications is part of how the School delivers language teaching.
To contact You: to send announcements, messages between Admin and Teachers or Parents, and account-related notices through the App.
To manage Your requests: to respond to questions or requests You send Us.
For safety and record-keeping: to maintain accurate, auditable academic and attendance records, including where required by Romanian education or labor record-keeping obligations.
To improve the Service: for example, using aggregated or anonymized Usage Data to understand how the App is used.

We do not use Personal Data for advertising, do not sell Personal Data, and do not share it with business partners for marketing purposes.

We may share Your Personal Data in the following situations:

With Service Providers: as described under Third-Party Service Providers, so they can host the Service and, for the AI features described above, process audio and text on Our behalf.
Within the School, by role: a Parent can only see data about their own Student(s); a Teacher can only see data for Students enrolled in the group(s) they teach (a Teacher of a Student’s English group cannot see that Student’s German group records); Admin can see all School data. This is enforced by database-level access rules, not only by the App’s interface.
For legal reasons: as described under Disclosure of Your Personal Data.
With Your consent: We may disclose Your Personal Data for any other purpose with Your consent.

Third-Party Service Providers

We use the following service providers to operate the App. They process Personal Data on Our behalf as data processors, under instructions limited to providing the Service:

RYA DEV TECHNOLOGY SRL (the Developer) — builds and technically operates the App and its backend on the School’s behalf, and has the technical ability to access data solely to maintain and support the Service.
Supabase, Inc. — provides authentication, database hosting (Postgres), file storage (for consented Student photos and Teacher-captured work photos), and the backend functions the App calls. Supabase’s data processing terms and subprocessor list are available at supabase.com/legal. The Service’s database and storage are hosted in Supabase’s eu-west-1 (Ireland) region, within the European Economic Area.
OpenAI, L.L.C. — processes audio for voice-to-text transcription of evaluation feedback, and processes grade/feedback text for the AI-assisted feedback drafting feature. Audio and text are sent for this specific purpose only; under OpenAI’s API terms, data submitted through the API is not used to train OpenAI’s models by default. OpenAI’s privacy practices are described at openai.com/privacy and its API data usage policy at openai.com/policies/api-data-usage-policies.

We select service providers only where their contractual terms and security commitments provide protections for Personal Data equivalent to those described in this Privacy Policy and required by applicable law.

Where GDPR applies, We rely on the following legal bases under Article 6:

Processing purpose	Legal basis (Art. 6 GDPR)
Providing and maintaining the Service; managing Accounts; recording attendance and evaluations as part of the enrollment/employment relationship	Contract performance — Art. 6(1)(b)
Account and service communications (announcements, messages)	Contract performance — Art. 6(1)(b)
Capturing, storing, and displaying a Student’s photos	Consent — Art. 6(1)(a), given by the Student’s Parent and recorded by the School; revocable at any time by contacting the School
Voice dictation and AI-assisted drafting of evaluation feedback	Legitimate interests — Art. 6(1)(f), in efficiently producing feedback for Students; a Teacher may always type feedback instead
Academic and attendance record-keeping required by Romanian education law	Legal obligation — Art. 6(1)(c)
Service security, diagnostics, and improvement	Legitimate interests — Art. 6(1)(f)
Responding to legal obligations and law enforcement requests	Legal obligation — Art. 6(1)(c)

Where processing is based on consent, You (or, for a Student’s photos, the Student’s Parent) may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Retention of Your Personal Data

The School retains Personal Data only for as long as necessary for the purposes set out in this Privacy Policy, applying the following retention periods by default:

Account data (Parents and Teachers): retained for the duration of Your relationship with the School, and deleted from Our systems when You delete Your Account (see Delete Your Personal Data).
Student academic records (attendance, evaluations, enrollment history): retained for the duration of the Student’s enrollment and for up to 24 months afterwards, consistent with the School’s record-keeping obligations, then deleted or anonymized unless a longer period is required by Romanian law.
Student photos: retained for as long as the Student’s photo consent is in effect and the photo is in active use (profile photo or a specific piece of submitted work); deleted promptly once consent is withdrawn or, at the latest, when the associated Student record is deleted.
Voice recordings for dictation: not retained; only the resulting text is kept, as part of the evaluation record it was written into.
Server logs and Usage Data: retained for up to 24 months for security monitoring and troubleshooting.

We may retain Personal Data beyond these periods where required by law (for example, tax or labor record-keeping), to establish or defend a legal claim, at Your explicit request, or where data exists only in backup systems pending routine, scheduled deletion.

Transfer of Your Personal Data

Your Personal Data is processed in Romania and, through the Service Providers named above, may be processed on servers located in other countries, including outside the European Economic Area. Where that happens, We rely on appropriate safeguards recognized under GDPR (such as the Service Provider’s Standard Contractual Clauses) to protect Your data during and after the transfer.

Delete Your Personal Data

Parents and Teachers can delete their own Account at any time from within the App: open your profile, then “Ștergere cont” / “Delete account”, and confirm. This permanently deletes Your login and profile. It does not delete the Student’s own academic records (attendance, evaluations), because those belong to the School’s own records of the Student’s enrollment, independent of any one Parent’s or Teacher’s Account — deleting Your Account only removes the link between You and that record. To request deletion or correction of a Student’s own records, a Parent or the School should contact Us using the details below.

Admin accounts are managed directly by the School and are not self-deletable from within the App; contact Us to request deletion of an Admin account.

Please note We may need to retain certain information where We have a legal obligation or lawful basis to do so, as described under Retention of Your Personal Data.

Disclosure of Your Personal Data

Business Transactions

If the School is involved in a merger, acquisition, or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data becomes subject to a different Privacy Policy.

Law enforcement

Under certain circumstances, We may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Other legal requirements

We may disclose Your Personal Data in the good faith belief that such action is necessary to:

Comply with a legal obligation
Protect and defend Our rights or property, or those of the School
Prevent or investigate possible wrongdoing in connection with the Service
Protect the personal safety of a Student, User, or the public
Protect against legal liability

Security of Your Personal Data

The security of Your Personal Data is important to Us. Access to Student, Parent, and Teacher data is restricted by role at the database level, not only in the App’s interface, as described under Use of Your Personal Data. However, no method of transmission over the Internet or method of electronic storage is 100% secure. While We strive to use commercially reasonable means to protect Your Personal Data, We cannot guarantee its absolute security.

Children’s and Students’ Data

This section explains, specifically, how the App handles the fact that most of the Personal Data it processes belongs to Students who are minors and are not App users themselves.

Students do not use the App and do not accept these terms. Only Parents, Teachers, and Admins — all adults — hold Accounts. A Student’s data is entered by the School, Teachers, and the Student’s Parent, as part of the enrollment relationship between the family and the School, which sits outside the App itself.
Enrollment is the basis for processing a Student’s academic data (attendance, evaluations, group membership). By enrolling a Student, a Parent enters into a relationship with the School under which this record is necessarily kept, in the same way it would be if the School used a paper register.
Photos require a separate, specific consent recorded by the School at the Student level, as described under Student Data. Without that consent recorded, the App’s database rules prevent any photo of that Student from being captured or viewed by anyone, including Teachers and Admin. A Parent may withdraw this consent at any time by contacting the School; withdrawal stops new photos and We will delete existing photos of that Student promptly.
A Parent’s rights over their Student’s data. A Parent may ask the School, as controller of the Student’s data, to access, correct, or delete information the School holds about their Student, in the same way they could exercise these rights over their own data under Your Data Protection Rights (GDPR). Contact Us using the details under Contact Us.
Age eligibility for Accounts. Only adults hold Accounts. The App does not knowingly let a person under 18 register or hold an Account; because Accounts are created only by the School, this is controlled at enrollment rather than by a self-service age check.

You have the following rights under the General Data Protection Regulation (GDPR) over Your own Personal Data, and — as described above — may exercise equivalent rights on behalf of Your enrolled Student:

Right of Access (Art. 15): request a copy of the Personal Data We hold.
Right to Rectification (Art. 16): request that We correct inaccurate or incomplete Personal Data.
Right to Erasure (Art. 17): request that We delete Personal Data, subject to the legal exceptions described in this Policy.
Right to Restriction of Processing (Art. 18): request that We restrict processing under certain conditions.
Right to Data Portability (Art. 20): request that We transfer Personal Data We have collected to another organization, or directly to You, in a structured, commonly used, machine-readable format.
Right to Object (Art. 21): object to processing where We rely on legitimate interests as the legal basis.
Right to Withdraw Consent (Art. 7): where processing is based on consent (such as Student photos), withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact Us at mona.serban@gmail.com. We will respond within 30 days.

If You believe We have not addressed Your concern adequately, You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) at www.dataprotection.ro.

Links to Other Websites

The Service may contain links to other websites that are not operated by Us. If You click on a third-party link, You will be directed to that third party’s site. We strongly advise You to review the privacy policy of every site You visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify You of material changes by posting the new Privacy Policy on this page, updating the “Last updated” date above, and, where the change is significant, through a notice inside the App before it takes effect.

You are advised to review this Privacy Policy periodically for any changes. Changes are effective when posted on this page.

Contact Us

If You have any questions about this Privacy Policy, or wish to exercise any of the rights described above on Your own behalf or Your Student’s behalf, You can contact Us:

The School, ENGLISH FUN WITH MONA SRL: mona.serban@gmail.com / (+40) 764 407 245
The Developer, RYA DEV TECHNOLOGY SRL, for technical/App-operation matters: support@ryadev.com