• The school or school service centre remains responsible for student records.
• The establishment decides which digital tools are used in class and under what conditions.
• The establishment may manage access, retention, and requests related to privacy rights.

• Scolaro acts as a service provider and processes personal information only to deliver the agreed pedagogical features.
• We may enter into written agreements with schools to clarify confidentiality, security, and retention obligations.
• We limit our processing to what is necessary for the platform: generation, assisted grading, pedagogical follow-up, and technical support.

• We collect only the data that is necessary, such as name, email, role, classes, results, and submitted work.
• This data is used to provide the platform and generate or grade assessments. Scolaro may also use anonymized data to improve its features, their quality, and the user experience. This requires anonymization that meets applicable requirements: removing a name or replacing an identifier is not sufficient.
• We do not resell data and do not use it for advertising purposes.

• For students under 14 years old, Scolaro must be authorized according to the framework required by Law 25.
• A clear notice should explain what data is collected, why it is collected, and which providers may receive it.
• Scolaro can support institutions with notice templates or parent-facing communication materials.

• Data is hosted on secure infrastructure with encryption in transit and at rest.
• Access is role-based: students see their own data, teachers see their own groups, and administrators have limited access.
• Technical logs and access controls help limit and trace access to personal information.
• When legally permitted, we can delete an account, anonymize specific datasets, or provide a structured copy of the data.

• Some features may require sending content to technology providers such as OpenAI.
• We limit these transfers to what is strictly necessary and try to remove direct identifiers before sending data.
• Transfers outside Quebec require a privacy impact assessment and the necessary safeguards under the applicable framework. Our assessment is under review; this page does not certify that every transfer has been validated.
• Scolaro does not authorize third-party AI providers to use your content, including submitted work, instructions, and results, to train their models. This rule must be covered by the terms and settings of each provider, including providers accessed through an intermediary. Their verification is part of our review. No training does not mean no technical retention.

• AI can suggest questions, propose feedback, recommend an initial score, and help identify recurring difficulties.
• These features are decision-support tools, not final decisions.
• The teacher's professional judgment remains central at every stage.

• When a result or feedback comes from automated processing, that context may be indicated depending on the use case.
• Teachers can modify, validate, or reject AI suggestions at any time.
• Where a decision is based exclusively on automated processing, affected people may request an explanation and human review in accordance with the applicable framework.

A privacy impact assessment (EFVP) has been prepared to examine accounts, school records, submitted work, AI-assisted grading, Google Classroom connections, usage measurement, and data deletion. It considers data minimization, access, transfers, retention, and human review. It still requires completion and approval: processing locations, contractual commitments, retention periods, and responsibilities must be confirmed.

Identified services include Supabase for authentication, database services, and storage; OpenAI for certain AI features; OpenRouter as an intermediary to model providers; and Google Classroom for connections and imports authorized by the teacher. Recipients depend on the features used. The complete inventory of legal entities, subprocessors, and processing locations is being verified; this list does not constitute approval of each transfer.

Schools can ask about our approach and available documentation through the contact form. The full EFVP remains an internal document. A supplier agreement template has been prepared to address permitted uses, confidentiality, security, incidents, and deletion; it must be adapted and accepted by the parties. It is not a signed agreement with a school.