Privacy notice

Last updated 10 October 2026

TeachFolio helps schools collect, review and organise teachers’ professional work. This notice explains what we hold, why, where it is kept and the rights you have, in line with the Saudi Personal Data Protection Law (PDPL) and, for international schools, the GDPR.

Our role

For the work a school’s staff hand in, the school is responsible for the data (the controller). TeachFolio processes it on the school’s behalf and only on its instructions (the processor); see Data processing. For your account itself (name, email, sign-in), and for people who sign up on their own, TeachFolio is responsible.

What we hold

• Account: name, email, profile picture from Google or Microsoft if you sign in with them, language, and (if you set one) a password stored only as a one-way hash.
• School and department: names, academic year, the people a Head of Department adds (name, email, subject) and their role.
• Work and growth: files handed in, notes, reflections, review decisions, comments and rubric scores, standards tags, goals, training records and lesson observations.
• Security records: sign-in times, IP address, browser type, a random browser identifier (to warn you about new sign-ins) and an activity log of important actions.
• Payments: plan, amount, invoice number and the payer’s PayPal email. We never see or store card numbers.

Why we use it

• To provide the service the school or department signed up for (contract).
• To keep accounts secure and prevent misuse (legitimate interest and legal obligation).
• To send service emails: invitations, reminders, weekly summaries, security alerts and receipts. Heads of Department can turn reminders and summaries off.

We do not sell personal data, show advertising, or use it to train AI models.

Students’ information

TeachFolio is for school staff, not students. Work samples can still contain students’ names, photos or marks. Please remove or blur them unless your school has a lawful basis and allows it. Schools can ask us to delete any file at any time.

Where data is kept

TeachFolio runs on servers in Germany (European Union). Encrypted copies of the database are kept with GitHub for 30 days. If a Head of Department connects Google Drive or OneDrive, new files are stored in the school’s own drive instead, and TeachFolio can only access the files it created there. Some providers listed under Data processing are outside Saudi Arabia; we transfer data only as the PDPL and its transfer regulations allow. Schools that need hosting inside Saudi Arabia can contact us.

How long we keep it

• Accounts: until deleted. You can delete your own on My account.
• Hand-ins: as long as the school chooses (for example 3 years), then deleted automatically. A school can ask for everything to be deleted when its contract ends.
• Backups: 30 days. Activity logs: 12 months. Payment records: as long as tax law requires.

Security

HTTPS everywhere, hashed passwords, two-step sign-in (required for school leaders), encrypted sessions, alerts for new sign-ins, checks on every upload, encrypted nightly backups and a log of administrative actions. See Security.

Your rights

You can ask to know what we hold, get a copy, correct it, delete it, or withdraw consent where we rely on it. My account lets you download your data and delete your account yourself. For work your school controls, ask your school first; we help it answer. You can also complain to the Saudi Data and Artificial Intelligence Authority (SDAIA) or your local data protection authority.

Cookies

Only cookies the service needs: your session, a security token, your language, a browser identifier for new-sign-in alerts, and (if you choose) “trust this browser” for two-step sign-in. No advertising or analytics cookies, so there is no cookie banner.

If something goes wrong

If a data breach affects personal data, we tell the affected schools without delay and notify the authorities within the time the law requires (72 hours under the PDPL where it applies).

Google and Microsoft data

Sign-in with Google or Microsoft is used only to confirm who you are. Drive and OneDrive access is used only to create, read and delete the files handed in through TeachFolio. TeachFolio’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Changes

We will post changes here and tell school managers by email about important ones.

Who we are

TeachFolio

Contact: hello@example.com