Privacy Policy

1. Data Controller and Contact

Scholly is a school management platform provided by Nawrec Edtech OÜ (established under Estonian e-Residency). For any privacy-related matter, contact us:

Email: kilinc.metin@hotmail.com

WhatsApp: +90 532 208 4394

Address: Nawrec Edtech OÜ, Estonia

2. Our Roles: Controller or Processor

Scholly acts in two distinct roles. As a processor: for student, parent, and academic data entered by schools, the school/institution is the data controller; Scholly processes this data only on the school's instructions, to provide the service.

As a controller: for account information, technical/usage data, and our direct communications with you, Scholly is the data controller.

3. Data We Collect

Student data (entered by the school): name, date of birth, ID number, grade, academic records, attendance, assessments and development reports (Pusula), and any guidance/psychological assessment results (Guidly).

Parent data: name, contact details, ID number, contract and payment information.

Staff data: name, contact, role, HR and evaluation data.

Technical data: device information, IP, session and app usage logs (for security and service improvement).

4. Purposes and Legal Bases

We process data to provide the school management service, perform the contract, meet legal obligations, and ensure service security. Legal bases include performance of a contract, legal obligation, legitimate interest, and where required explicit consent (especially for minors and special-category data).

5. Children's (Minors') Data

Student data may belong to children. This data is processed only on the school's instructions and for educational purposes; it is never used for advertising or marketing and is never sold to third parties. Processing of minors' data is based on parental/school consent.

6. AI Features (Pusula and Guidly)

Features such as the Development Compass (Pusula) and Guidly use artificial intelligence (Anthropic Claude API) to generate student development/guidance reports.

In this processing: data is processed solely to produce the relevant school's report; data is not used to train AI models; psychological/guidance assessments are treated as special-category data and processed with additional care on a consent/contract basis. They are not diagnostic and do not replace professional judgment.

7. Data Sharing and Sub-processors

We do not sell data. To provide the service we work with a limited set of sub-processors: Supabase (database and hosting, Asia Pacific — Seoul, South Korea); Anthropic (AI features via API, not used for training); Vercel (web hosting); Expo/EAS (mobile distribution); and authorities where legally required.

8. International Transfers

Data is hosted in the Asia Pacific — Seoul, South Korea region. Where cross-border transfer is necessary, appropriate legal safeguards (e.g. standard contractual clauses) are applied.

9. Retention

We retain data for the duration of the service agreement and for 90 days, after which it is deleted or anonymized. Schools may request deletion of their data.

10. Security

We apply row-level security (RLS), role-based authorization, encryption in transit and at rest, and regular access audits.

11. Your Rights

You have rights of access, rectification, erasure, restriction, and objection. Requests concerning student/parent data can be made through the relevant school or via kilinc.metin@hotmail.com.

12. Cookies

On our website we use necessary cookies for sessions and language preference (NEXT_LOCALE). We do not use third-party advertising/tracking cookies.

13. Changes

We may update this policy; significant changes will be announced appropriately. The current version is always available on this page.

14. Contact

Questions: kilinc.metin@hotmail.com · WhatsApp: +90 532 208 4394 · Nawrec Edtech OÜ, Estonia.