1. Scope
This policy covers the personal data that [entity name] (the "Provider") handles as controller when running SingDesk: visitors of singdesk.com, the accounts of the schools' staff on the platform, the people who contact the Provider and the Provider's own operators.
It does not cover the data that each school keeps about its students, guardians, teachers and contacts. For that data the school is the controller and the Provider acts only on its behalf, under the Data Processing Agreement. Each school publishes its own privacy policy on its own address; questions about that data should go to the school.
2. Who is responsible
[entity name], tax number [tax number], registered at [registered address]. For any question about this policy or to exercise your rights: hello@singdesk.com.
The Provider has not appointed a data protection officer, as it is not required to under article 37 of the GDPR.
3. What data, and why
Visiting singdesk.com. The site has no forms, no analytics tools, no advertising and no social network buttons; its fonts are served by the site itself. The proxy that receives each request records a technical log (IP address, date and time, address requested, response and browser identification) to keep the service secure and to investigate faults. Basis: legitimate interest in the security of the service (art. 6(1)(f) GDPR).
Asking for access or writing to us. When you write to us, by the access-request link or directly, we receive your name, email address and whatever you tell us about your school. We use them to answer and, if a school is created, to set it up with you. Basis: steps prior to a contract (art. 6(1)(b)).
Signing up. When self-service signup is open, the form asks for the school's name, your name, your email address and a password. The password is stored only as an Argon2id hash. A school whose email is not confirmed within 7 days is deleted with everything it had. Basis: contract (art. 6(1)(b)).
Staff accounts. For the people who sign in to a school's backoffice we keep: name, email address, role, the password hash, if they turn it on the two-step verification secret (encrypted) and their recovery codes (hashed only), their sessions (with a device label such as "Chrome on Android", not the IP address) and the school's audit log of what was done. Inside a school, these accounts are part of the school's data and the school decides about them; the Provider uses them as controller only to authenticate, keep the platform secure and communicate with the school's owner about the service. Basis: contract and legitimate interest in security.
Sign-in attempts and anti-abuse counters. Each sign-in attempt and each public form submission is recorded with a keyed hash of the network address (not the address itself), to throttle repeated attempts. Basis: legitimate interest in security.
Error tracking. When the platform fails, it records the error itself — never on a third-party service: the type of error, a message with emails, identifiers, addresses, numbers and tokens removed, the page template (for example "/admin/students/:id", never the actual address, query, form content or cookies), the code location, the version and the school concerned. Basis: legitimate interest in keeping the service working.
Operators. The Provider's operators have their own accounts, with mandatory two-step verification; every support access to a school, which requires the owner's permission, is recorded.
Notifications on the device. If a person turns on notifications in the browser, the platform keeps the subscription the browser gives it to send them; it is deleted when they are turned off. Basis: consent, which can be withdrawn at any time in the browser or on the platform.
6. How long
- Proxy technical logs: about 30 days.
- Sign-in attempts and anti-abuse counters: 30 days.
- Error records: deleted when the error has not happened again for 90 days.
- Unconfirmed signups: 7 days.
- Messages and access requests: for as long as the conversation is useful, and no more than two years after the last contact unless a school was created.
- Staff accounts: while the school exists; when a school is closed, everything is deleted 30 days later, as described in the Terms of Service.
- Backups: deleted data disappears from the backups as they rotate, at the latest about 18 months later.
- Billing data, when it exists: for the period required by tax law.
7. Security
All traffic is encrypted (HTTPS), including between the proxy server and the platform's server; passwords are stored only as Argon2id hashes; two-step verification is available to every staff account and mandatory for operators; secrets of connected services are encrypted; each school's data is separated from the others' and every access is checked on the server; backups leave the server only encrypted. The Data Processing Agreement describes these measures in detail.
8. Your rights
You may ask for access to your data, its rectification or erasure, restriction of processing, portability, and object to processing based on legitimate interest, by writing to hello@singdesk.com. We answer within one month. If your request concerns data that a school keeps about you, we pass it on to that school, which is the one that decides.
You may also lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt).
9. Changes
When this policy changes in substance, the new version is published here with a new date, and the schools' owners are told by email.
This policy is written in Portuguese; this English version is a translation, and the Portuguese version prevails in case of difference.
This is a translation; the Portuguese version prevails.