Privacy Policy

1. Who we are

Edvix365 (the “App”) is a teacher assistant application developed and operated by Prompt system Ltd., 313 moo 4 Thawangtan Saraphi Chiangmai 50140. Contact: sarayootmail@gmail.com.

This policy explains what the App collects, how it is used, and with whom it is shared. It is written to meet Thailand’s Personal Data Protection Act B.E. 2562 (PDPA) as well as the App Store and Google Play privacy requirements.

2. Roles

Student data in the App is entered by the teacher or imported from the teacher’s own files.

• The school and the teacher are the data controller for student data — they decide what is recorded, for what purpose, and on what legal basis.
• We provide the tool and act as a data processor only for data that leaves the device (section 4.2). If a teacher uses the App offline only, no student data ever reaches us.

3. Local-first by design

4. What the App collects

4.1 Stored on your device only

This data lives in the App’s private storage. The operating system prevents other apps from reading it. We have no access to it and cannot see it.

4.2 Edvix365 account (optional)

A teacher may create an account (optional — the App works fully without one) to back up data, use several devices and keep the Pro entitlement with the account. We store the name, email address, and which sign-in providers are linked (Google / Apple / email).

• Google or Apple sign-in: we receive only the name and email from the provider, never a password. If you use Apple’s “Hide My Email”, we receive only Apple’s relay address.
• Email sign-in: we send a one-time verification code to your address.

Cross-device sync (Pro subscribers who are signed in only) — the App uploads the data you record in it (classrooms, student lists, attendance, scores, timetable, school settings) and images (student photos, school logo, teacher photo) to our server so that other devices signed in to the same account can download them. Sync runs automatically when you open the App while online, or when you tap “Sync now”. While offline the App keeps working and your changes are uploaded on the next sync. Synced data is stored against your account, used only to provide the sync service, and deleted when you delete the account (see “Data deletion”). If you are not a Pro subscriber or not signed in, no student data is sent to our server.

4.3 Payments

Edvix365 Pro subscriptions are processed entirely by the App Store or Google Play. We never see or store card numbers or any payment details. The App only receives whether the subscription is active, which is cached on the device.

If you are signed in to an Edvix365 account, the App sends the store purchase proof (App Store transaction reference / Google Play purchase token — no card data) to our server, which checks it with Apple/Google to link the Pro entitlement to your account so it works on every device. We keep only the transaction reference, status and expiry date of the subscription.

5. What we do not do

• ✕ No third-party analytics or crash-reporting SDKs
• ✕ No advertising and no cross-app or cross-site tracking
• ✕ No access to location, device contacts, microphone or camera
• ✕ We never sell, rent or trade personal data

6. Purposes and legal bases

7. Disclosure

We disclose data otherwise only when required by a lawful order.

8. Retention

• On-device data remains until you erase it (“Erase all data”) or uninstall the App. Uninstalling deletes everything permanently and irreversibly.
• Edvix365 account data and synced data are kept until you delete the account; we then remove them within 30 days, except where law requires retention.

9. Security

• On-device data sits in the App sandbox, access-controlled by the operating system.
• Access tokens are kept in the Keychain / Keystore, never in plain text.
• All server communication uses HTTPS (TLS).
• No system is perfectly secure. Because student data lives on the device, a screen lock or biometric lock on the phone is the single most important protection.

10. Your rights

Under the PDPA you may access, rectify, erase, object to, port, or withdraw consent for your personal data.

Requests from parents or students about data a teacher recorded should go to the school, which is the data controller. We cannot access data held on a teacher’s device.

11. Requesting deletion of your data

You can ask us to delete your data at any time, without giving a reason, through any of these channels:

Deleting your account removes the account and profile (name, email, avatar), every linked sign-in method (Google / Apple / email), sign-in sessions on all devices, the link between your Pro subscription and the account, and all data and images synced to our server. We also revoke the authorisation held with Apple, as Apple requires.

What account deletion does not cover

• Data on your device (students, attendance, scores) — it lives only on your device; we cannot access it, so we cannot delete it for you. Erase it in the App or uninstall.
• Paid subscriptions — the contract is between you and App Store / Google Play. Cancel it in the store’s account settings, otherwise it may keep renewing after the account is gone.
• A record that a deletion request was made — we keep only a hash of the email, a partially masked email, the date and the channel (never the plain email) so we can prove the request was honoured, plus anything the law obliges us to retain (e.g. accounting records) for the statutory period.

Server backups rotate and are purged within 30 days after deletion; data in backups is not restored to live systems in the meantime.

12. Children’s data

The App is for teachers and school staff; it is not designed for students to use, and we do not collect data from children directly.

Student data — mostly relating to minors — is recorded by teachers under the school’s authority. The school is responsible for establishing an appropriate legal basis, including parental consent where the law requires it.

13. International transfers

If the Edvix365 account service is enabled, account data is stored on servers located in Thailand. Apple and Google may process data across borders under their own policies.

14. Changes to this policy

For material changes we will notify users in the App or by email before they take effect, and update the date at the top of this document.

15. Contact

If you believe your data has been processed unlawfully, you may lodge a complaint with Thailand’s Personal Data Protection Committee (PDPC).