Privacy Policy

1. Who we are

Hawpol is provided by Hawpol, Erbil, Iraq ("we", "us"). For personal data that you give us directly, such as your account details, we are the controller.

When a school uses Hawpol, the school decides what records it keeps about its students and staff, such as grades and attendance. For that school data, the school is the controller and we act as its processor, following the school's instructions. Questions about school records can be sent to your school or to us.

2. Data we collect

Account data

Your name, email address, phone number, password (stored only in hashed form, never in plain text), role (student, teacher, school administrator or driver), preferred language and an optional profile photo.

School data

The school you belong to, your grade and class placement, and your subjects.

Educational content

Homework, assignments, tests, curriculum files, activities, submissions (text and images), grades, written reports and feedback, and attendance records.

Transportation

For students who use the school bus: the assigned bus and driver, the pickup address and the ride status set by the driver (for example "on the way" or "on the bus"). We do not track the location of anyone's device. The app does not use GPS.

Communications

School announcements and notifications you receive, and the push notification token of your device (from Google Firebase Cloud Messaging) so we can deliver notifications.

Technical data

Basic server logs, such as IP address, time of request and error details, which we need to keep the Service secure and working.

Website and contact form

If you use our contact form, we receive the details you enter: your name, email, optional phone number, role, subject, optional school name and message.

3. What we do not do

• We do not show advertising in the app.
• We do not sell or rent personal data.
• We do not use third-party advertising trackers or track you across other apps and websites.
• We do not use device GPS location.
• Our website does not use cookies or analytics. It only stores your language choice in your browser's local storage.

4. How we use data

• To create and manage your account and connect you to your school.
• To show homework, grades, attendance, schedules, announcements and bus status to the people allowed to see them.
• To send push notifications and service emails, such as verification and password reset codes.
• To keep the Service secure, prevent abuse and fix problems.
• To answer your questions and support requests.
• To meet our legal obligations.

5. Legal bases

Where data protection laws such as the GDPR apply, we rely on:

• Contract: to provide the Service you or your school signed up for.
• Legitimate interests: to keep the Service secure, prevent abuse and improve it, in ways that respect your rights.
• Consent: where required, for example for push notifications (which you allow in your device settings) and, through the school or a parent, for children's data where the law requires parental consent. You can withdraw consent at any time.
• Legal obligation: where we must keep or disclose data by law.

6. Children's privacy

Many Hawpol users are students under 18. Students use Hawpol through their school, which provides the account context and obtains parental consent where the law requires it.

• We collect only the data needed for school use, and we do not show ads to children or profile them for marketing.
• A parent or guardian can ask to see, correct or delete their child's data by contacting the school or us at help@hawpol.com.
• We intend to comply with the U.S. Children's Online Privacy Protection Act (COPPA) and the children's data rules of the GDPR (often called GDPR-K), including the age of digital consent in each country.
• If we learn that we hold a child's data without the required consent, we will delete it.

7. Who we share data with

We share personal data only:

• With your own school: its administrators and teachers see data according to their role. For example, a teacher sees the students in their classes, and a driver sees only the students assigned to their bus.
• With people in your school, as the app is designed: for example, classmates may see your name in a class, and students and parents see their own grades and attendance.
• Publicly, only for school content: school profiles, the school directory and posts a school publishes to the Explore feed can be seen by anyone using the app. Schools should not post students' personal data there without permission.
• With service providers that process data for us under contract: cloud hosting; Amazon Web Services S3 for storing files, which are served through short-lived signed links; Google Firebase Cloud Messaging for push notifications; an email provider for verification and password reset codes; and a form provider for messages sent through our website.
• When the law requires it, or to protect the safety of our users or the public.

If our business is transferred, for example in a merger, personal data may be transferred to the new owner under this policy, and we will tell you.

8. Storage and security

• All data is encrypted in transit using HTTPS.
• Access to data is limited by role, both in the app and within our team.
• Passwords are stored as one-way hashes.
• Files and photos are served through signed links that expire after a short time.
• We review our security regularly and fix issues promptly.

No system is perfectly secure. If a data breach affects you, we will notify you and the authorities where the law requires.

9. How long we keep data

We keep your account data while your account is active. When you delete your account, we delete your personal data as described below. School records are kept for as long as the school uses Hawpol or as the school instructs. Server logs are kept for up to 90 days. Contact form messages are kept for up to 12 months after we reply. Backups are overwritten within 90 days.

10. Account deletion

You can delete your account in the app under Settings → Delete account, or by asking us through our account deletion page or at help@hawpol.com.

When you delete your account, we delete your profile (name, email, phone number, password and profile photo), your sessions and your device push tokens. Your school may keep school records it is required to keep, such as grades, reports and attendance, under its own policies and the law. Content you published to a school may stay with the school without your name. Copies in backups are removed within 90 days.

11. Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your data;
• object to or restrict certain processing;
• receive your data in a portable format;
• withdraw consent at any time;
• complain to your local data protection authority.

To use these rights, contact us at help@hawpol.com or use our contact form with the subject "Privacy request". We will reply within 30 days and may ask you to confirm your identity. For school records, we may pass your request to your school.

12. International transfers

Our service providers may store or process data in other countries, including the United States and the European Union. Where the law requires it, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

13. Changes to this policy

We may update this policy. We will change the "Last updated" date above and, for important changes, tell you in the app or by email before they take effect. If we ever add website analytics, they will be privacy-friendly and listed here first.

14. Contact

Hawpol
Erbil, Iraq
Privacy questions: help@hawpol.com
Phone: +964 750 6721713
Or use our contact form.