Data privacy

Who is responsible for your data

Sophyra Limited is the data controller for your account and billing data: a company registered in Ireland (company number 817595), operating under its registered business name Education Options (business name number 787480). Our registered office is 1st Floor, Penrose 2, Penrose Dock, Cork, T23 YY09, Ireland.

For the school information you enter into the product, including any staff records, training records and governance documents, your school is the data controller and Sophyra Limited acts as a data processor on your instructions. We process that information only to provide the service to your school, and never for our own purposes.

For any privacy matter, contact privacy@sophyra.ie.

What personal data we collect

• Account data you provide at sign up: your name, email address, and your school's name, type, address, country and website.
• The information you enter into the product as you use it: obligation statuses and owners, policy and publication records, governance meeting and activity records, uploaded documents, staff names and their training records, and your readiness self-evaluation.
• Billing data when you subscribe: handled by our payment processor, Stripe. We receive confirmation of your subscription status; we do not see or store your full card details.
• Technical data needed to run the service securely: IP address, browser and device type, and authentication session data.

Legal bases for processing

• Contract for providing the service to you and your school, including the free trial and any subscription.
• Legitimate interests for operating the service securely and preventing fraud.
• Legal obligation for retaining billing records required by tax and accounting statute.
• Consent where we ever rely on it, which you may withdraw at any time.

Who we share data with (processors)

We use a small number of trusted service providers to run the product. Each acts as a processor under written terms and applies appropriate technical and organisational measures:

• Supabaseprovides the database, authentication and document storage. Each school's data is isolated by row-level security so a school can only ever see its own data.
• Stripe processes subscription payments under its own terms as merchant of record.
• Vercel Inc. hosts the application and stores the technical data necessary to serve it.

We do not sell or rent personal data. International transfers outside the UK or EEA are made under Standard Contractual Clauses or an equivalent Article 46 safeguard.

How long we keep your data

We keep your account and the school data you enter for as long as your account is active. If you close your account, we delete the school data within 30 days, except where we must retain billing records for six years to meet statutory tax and accounting requirements. You can ask us to delete your data sooner, subject to those legal retention obligations.

Your rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Request deletion of your personal data
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw consent at any time, where consent was the basis
• Complain to a supervisory authority. Our lead supervisory authority is the Data Protection Commission of Ireland; if you are in the UK you may also complain to the Information Commissioner's Office.

Cookies

We use only the cookies necessary for the service to function, such as the cookie that keeps you signed in. We do not use advertising cookies.

Contact for data requests

To exercise any of the rights above, or for any other privacy question, write to privacy@sophyra.ie. We aim to respond within ten working days and in any event within the statutory month.