Privacy Policy

1. Who is responsible

• Controller for the processing described here: Daniel Vayman, E⁠a⁠s⁠y⁠O, Fridbachweg 9, 6300 Zug, Switzerland, contact@easyo.app (see Imprint).
• Student data: for student and scheduling data that teachers enter or collect through their public form, the teacher (or their Institution) is the controller. E⁠a⁠s⁠y⁠O processes this data only on their behalf under our Data Processing Terms. If you are a student, please contact your teacher about your data; we forward requests we receive to the teacher.

2. Data we process and why

• Account data (name, username, email address, password hash, language and accessibility settings, plan and subscription status, verification status, time and version of your acceptance of the Terms): to provide your account and the service. Legal basis: contract (Art. 6(1)(b) GDPR).
• Sign‑in with Google or Microsoft (only if you choose it): we receive your name, email address and an account identifier from the provider to create your account or sign you in. Legal basis: contract.
• Workspace data (students, availability, workplaces, timetables, attendance and calendar data): processed on behalf of the teacher as processor, see section 1 and the Data Processing Terms.
• Service improvement records (pseudonymised generation inputs, generated timetables and teacher corrections; names removed and student IDs replaced by keyed hashes): to develop and test our scheduling algorithms. Legal basis: our legitimate interest in improving the service (Art. 6(1)(f) GDPR). You can switch this off in Settings; details in section 7 of the Terms of Service.
• Emails (verification, password reset, account and inactivity notices, and schedule notifications that a teacher sends to students): to run the service. Legal basis: contract and, for messages to students, the teacher's instruction.
• Payments for individual plans: Paddle.com, as Merchant of Record, processes payment details as a separate controller under its own privacy notice. We receive the subscription status, plan and transaction references, not card numbers. Legal basis: contract and our legal accounting obligations.
• Institutions: contact details of administrators and contact persons, quote and invoice data, and seat counts. Legal basis: contract and our legitimate interest in managing the business relationship.
• Enquiries (for example by email or through the Institutions quote form): to answer you. Legal basis: legitimate interest and, where applicable, steps before a contract.
• Technical and security data (IP address, browser and device information, sign‑in sessions, error and security logs): to operate the service securely, to prevent abuse (including bot protection with Cloudflare Turnstile) and to fix errors. Legal basis: legitimate interest in secure operation.

Providing account data is necessary to use E⁠a⁠s⁠y⁠O; everything else is optional or arises from your use. We do not sell personal data, we do not use it for advertising, and we do not make automated individual decisions with legal or similarly significant effects (Art. 21 FADP, Art. 22 GDPR): the timetable generator makes proposals that the teacher checks and decides on.

3. Cookies and similar technologies

E⁠a⁠s⁠y⁠O uses only technically necessary cookies and browser storage: a session cookie for sign‑in and security, and browser storage for settings such as your language. We do not use analytics, tracking or advertising cookies, so we do not ask for cookie consent. Cloudflare Turnstile processes browser signals on pages with bot protection, and the Paddle checkout loads Paddle's scripts when you buy a plan. Our web font is served from our own server.

4. Recipients

• Render Services, Inc. (USA): hosting of the application and database in the Frankfurt (EU) region.
• Infomaniak Network SA (Switzerland): sending emails.
• Cloudflare, Inc. (USA): bot protection (Turnstile).
• Paddle.com Market Limited (United Kingdom): Merchant of Record for individual plans (separate controller).
• Google and Microsoft (USA and Ireland): only if you use their sign‑in (separate controllers).
• Authorities, courts or professional advisers where required by law or needed to establish, exercise or defend legal claims; a successor if the business is transferred (Terms of Service, section 20).

5. Transfers abroad

Our data is stored in the EU (Germany) and managed from Switzerland. Switzerland and the EU recognise each other's level of data protection as adequate, and both recognise the United Kingdom as adequate. Where a provider may access data from the USA, the transfer is covered by that provider's certification under the EU‑U.S. or Swiss‑U.S. Data Privacy Framework or by the EU Standard Contractual Clauses with the amendments required for Switzerland. You can request a copy of these safeguards at contact@easyo.app.

6. How long we keep data

• Account and workspace data: as long as your account exists. Inactive accounts are deleted after prior warning as described in section 12 of the Terms of Service (30, 90 or 120 days without a sign‑in, depending on the type of account). When an account is deleted, its data is removed from our live systems within 30 days and from backups in the regular backup cycle.
• Deleted students: 7 days in the trash, then deleted permanently.
• Service improvement records: until you switch them off or your account is deleted, and 24 months at the most.
• Sign‑in sessions: until you sign out, the session expires (after 30 days at the most) or a newer session replaces it.
• Record of an account deletion (username, email address, date and reason): 24 months, as proof that notice was given and the deletion was carried out.
• Server and security logs at our hosting provider: for a short period, usually a few weeks.
• Accounting records (for example invoices to Institutions): 10 years, as required by Swiss law (Art. 958f of the Swiss Code of Obligations).
• Emails and enquiries: as long as needed to deal with them, usually no longer than 2 years, unless they must be kept as business records.

7. Security

We protect data with appropriate technical and organisational measures, including encrypted connections (HTTPS), salted password hashes, separated workspaces, limited sessions, bot protection and restricted, logged administrative access. Details are in Annex 1 of the Data Processing Terms.

8. Students and minors

E⁠a⁠s⁠y⁠O accounts are intended for adults who teach (or minors with the consent of their legal representative). Students, who may be minors, only provide information through their teacher's form. The teacher is responsible for informing them and, where the law requires it, for obtaining the consent of their legal representative. Only data needed for scheduling should be entered.

9. Your rights

• Depending on the applicable law, you can request access to your data, correction, deletion, restriction of processing and a copy of your data in a common electronic format (data portability). You can object to processing based on legitimate interest (for example service improvement) and withdraw any consent with effect for the future.
• Write to contact@easyo.app. We may ask you to prove your identity. We reply within 30 days (FADP) or one month (GDPR).
• You can lodge a complaint with a supervisory authority: in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch), in the EU with the authority in your country of residence or work.

10. Changes

We update this Privacy Policy when our processing changes. The version published here applies; we inform registered users of significant changes by email.

11. Contact

Questions about data protection: contact@easyo.app. See also the Terms of Service, the Data Processing Terms and the Refund Policy.