Groupe Scolaire Privacy Policy

This Privacy Policy describes how Groupe Scolaire processes personal data in connection with the Services.

Groupe Scolaire is designed for private schools, institutes, training centers, and similar educational organizations in Morocco. This policy is drafted to support alignment with Moroccan Law No. 09-08 relating to the protection of individuals with regard to the processing of personal data and with the guidance and supervision of the CNDP.

Groupe Scolaire is operated by Aymen Elgad, an individual entrepreneur (auto-entrepreneur) based in Morocco — not a registered company or corporate entity. Every reference to "Groupe Scolaire", "we", "us", or "our" in this Policy means Aymen Elgad, trading as Groupe Scolaire. You can reach the operator using the contact details in Section 22.

• Organizations subscribing to the Services;
• principals, assistants, teachers, students, and staff using a tenant;
• website visitors, demo contacts, and support contacts;
• personal data processed for platform operations, communications, billing, support, and security.

• Student data such as names, identifiers, attendance, class assignments, academic records, behavior notes, contact data, and payment-related records entered by the Organization.
• Staff data such as names, roles, branch assignments, schedules, credentials, contact details, and activity records for principals, assistants, teachers, and staff.
• Organization data such as organization name, branches, billing contact details, subscription information, and account configuration.
• Usage and device data such as IP addresses, browser data, device information, system logs, timestamps, access events, and security signals.
• Communications and support data such as support requests, email communications, and onboarding records.

• directly from the Organization, Principal, or Users;
• through manual entry, file imports, uploads, edits, and updates made within a tenant;
• automatically through platform logs, authentication events, security monitoring, and technical telemetry;
• from payment providers, email providers, hosting providers, and other service providers used to operate the Services.

• to provide, host, maintain, and secure the Services;
• to manage tenant accounts, authentication, and permissions;
• to enable class, staff, student, and payment workflows configured by the Organization;
• to communicate with Organizations and Users about the Services;
• to issue invoices, process subscriptions, and track payments owed to Groupe Scolaire;
• to provide technical support and resolve incidents;
• to detect misuse, fraud, suspicious activity, or security threats;
• to comply with legal obligations and protect rights and safety.

For tenant data, the Organization is generally responsible for determining the lawful basis or legal justification for processing personal data under applicable Moroccan law and CNDP requirements.

Groupe Scolaire processes such data on the Organization's instructions as a processor or service provider, except where Groupe Scolaire must process data for its own legal compliance, billing, fraud prevention, or security purposes.

Where required, the Organization must ensure that valid consent has been obtained, especially for minors or categories of processing for which consent or express authorization is required.

For personal data stored or processed within a tenant, the Organization is the Data Controller or responsable du traitement. The Organization decides what data is collected, why it is collected, which persons are concerned, how long it should be kept, and which users may access it.

Groupe Scolaire acts as the Data Processor, sous-traitant, or service provider for that tenant data. Groupe Scolaire processes tenant data to host, secure, maintain, organize, transmit, and support the Services in accordance with the Organization's instructions, contract terms, and applicable law.

Groupe Scolaire does not disclose tenant personal data except as needed to operate the Services, comply with law, protect rights, or act on the Organization's documented instructions.

• hosting, database, storage, and infrastructure providers;
• authentication, identity, and access-management providers;
• email, messaging, and notification providers;
• billing and payment processors;
• security, logging, monitoring, and customer support providers;
• auditors, insurers, legal advisers, and professional service firms;
• competent authorities, courts, regulators, or the CNDP where disclosure is required or legally justified.

If personal data is stored, accessed, or transferred outside Morocco, Groupe Scolaire and the Organization must evaluate whether Moroccan law, CNDP requirements, contractual safeguards, or prior authorization apply. Where needed, the Organization remains responsible for ensuring that required cross-border formalities are satisfied.

Groupe Scolaire uses reasonable technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, destruction, and loss. Measures may include role-based access controls, tenant segregation, credential protections, encryption in transit, logging, backups, and incident response procedures.

No system can guarantee absolute security. Organizations also remain responsible for their own credential management, internal permissions, endpoint security, and lawful access practices.

Groupe Scolaire retains personal data only for as long as reasonably necessary to provide the Services, fulfill contractual obligations, maintain security, preserve backups, resolve disputes, enforce agreements, and comply with law.

For tenant data, retention is generally driven by the Organization's instructions, contractual arrangements, and applicable legal obligations. After termination, data may be deleted, anonymized, or rendered inaccessible after a reasonable export or transition period, subject to backups, legal holds, and security requirements.

Groupe Scolaire may process student and minor data only as part of providing the Services to Organizations. The Organization is responsible for determining whether the collection and use of such data are lawful and for obtaining any parental, guardian, or institutional permissions required by Moroccan law or CNDP guidance.

The Organization must ensure that only data reasonably necessary for legitimate educational or operational purposes is uploaded and that required notices are provided to parents, guardians, students, and staff where applicable.

Groupe Scolaire may use cookies, local storage, session tools, and limited analytics or technical monitoring to maintain sessions, secure accounts, remember preferences, measure performance, and diagnose product issues. If non-essential tools are used, Groupe Scolaire will provide disclosures and controls as required by applicable law.

Where Groupe Scolaire uses non-essential analytics (currently PostHog), a cookie banner asks for your choice before any analytics cookie is set. Cookies required to sign in and remember your language are not affected by this choice. You can change your answer at any time from the "Cookie preferences" link in the site footer.

Depending on applicable law and Groupe Scolaire's role in the relevant processing, individuals may have rights of access, rectification, deletion, blocking, objection, or complaint.

Where a request relates to tenant data controlled by an Organization, the request should normally be directed first to that Organization. Groupe Scolaire may assist the Organization as a processor where appropriate.

Groupe Scolaire uses artificial intelligence, provided by OpenAI, in specific, clearly scoped features: (i) AI content-drafting tools used by teachers and principals to help create lesson and exercise material, and (ii) an AI tutor, offered as voice and text chat, that helps a student review one specific lesson or one finished exercise attempt.

When these features are used, the relevant lesson or exercise text, and the student's questions, messages, or spoken audio, are sent to OpenAI's API for processing. Groupe Scolaire does not use AI to make admissions, disciplinary, employment, or other decisions about a person, and does not use Organization Data to train AI models.

The AI tutor is restricted to the lesson or exercise content it is given and is instructed to never provide guidance related to self-harm. If a student's message suggests they may be in danger or considering self-harm, the AI tutor is instructed to stop tutoring, respond briefly and supportively, and direct the student to a trusted adult, school staff, or local emergency services. This is a safety instruction given to the AI model, not a substitute for human supervision — Organizations remain responsible for supervising students' use of the Services.

Groupe Scolaire does not sell personal data and does not use advertising networks or third-party marketing data brokers. To operate the Services, Groupe Scolaire relies on a limited set of named service providers, each processing only what is necessary for its function:

• Neon — database hosting for all platform data;
• Vercel — application hosting;
• OpenAI — AI-powered features described in Section 15;
• LiveKit — live video and audio sessions;
• Mux — hosting and streaming of uploaded lesson videos;
• Uploadcare — storage of uploaded files and images;
• Resend — transactional email delivery;
• Polar and its payment processor — card subscription billing;
• Sentry — error monitoring (inactive unless separately configured);
• Upstash — rate limiting and caching.

These providers act as processors for Groupe Scolaire and are contractually or technically limited to processing data only to provide their service to Groupe Scolaire.

Files, images, and videos uploaded to the platform (for example student documents, lesson media, library videos, and catalogue images) are stored with Uploadcare or Mux and served from a unique, unguessable web address. These addresses are not listed publicly, indexed, or searchable, but they are also not gated behind a login: anyone who obtains the exact address could view the file it points to.

Organizations and Users should treat any link generated or shared from the platform as sensitive, and should avoid posting such links somewhere public.

An Organization may request deletion of specific uploaded files, or of its Organization Data as a whole, at any time by contacting Groupe Scolaire using the details in Section 22. Groupe Scolaire does not currently offer a fully self-service "delete this file" control inside the product for every upload type; deletion requests are actioned manually, subject to the retention, backup, and legal-hold limitations described in Section 11.

Files may also be automatically removed by an over-the-cap storage reclaim process once an Organization exceeds its purchased storage quota, after advance notice to the Organization.

Groupe Scolaire does not publish customer testimonials, reviews, or endorsements on its marketing pages. If testimonials are introduced in the future, only real feedback from actual users, given with their consent, will be used — never fabricated or composite quotes.

Signing up for Groupe Scolaire and starting a paid subscription is immediate and self-service. Card-based subscriptions can also be cancelled at any time, immediately and self-service, through the payment provider's billing portal, without needing to contact anyone.

Subscriptions paid by bank transfer do not renew automatically — access simply is not extended if the next payment is not submitted, so no separate cancellation step is needed for those. Cancelling, or letting a bank-transfer subscription lapse, stops future billing but does not delete Organization Data; see Section 11 for what happens to your data after a subscription ends.

Groupe Scolaire may update this Privacy Policy from time to time. The updated version becomes effective when posted or otherwise communicated. Continued use of the Services after an update means the revised policy applies to future use, subject to applicable law.

For privacy questions, CNDP-related inquiries, or data rights requests, contact Groupe Scolaire by email at support@groupescolaire.app or by phone at 06 80 09 30 03.