Draft for legal review. This notice describes how PassOver processes personal data. It must be reviewed by counsel and completed with the operator's legal name and contact details before launch.
Privacy notice
Last updated: October 2026
Who we are
PassOver is an assessment-readiness platform for Jamaican primary education. For school accounts, the school decides why student records are processed and PassOver processes them on the school's behalf. For independent teachers and family plans, PassOver decides and is responsible for the processing.
What we collect
- Account details: name, email address, sign-in identity (password sign-in or Google/Apple), and two-step sign-in settings for staff and administrators.
- School records: school, classes, enrollments, teacher assignments and verified parent–child links.
- Learning records: assessment answers, scores, topic progress, attendance and teacher feedback.
- Live classes: which sessions a student joined and when. Video and audio are handled by the video service the school chose; PassOver does not record them.
- Security records: an audit log of important actions (who did what and when) and security events.
We do not sell personal data, show advertising, or use learning records for marketing.
Why we use it, and on what basis
- To provide the service a school, teacher or family signed up for (contract, or the school's legitimate educational purposes).
- To keep the platform secure and investigate misuse (legitimate interests and legal obligations).
- To answer enquiries you send us (your consent, which you can withdraw).
Children
Most learners are children. Students join only through their school or a verified parent or guardian, and access is approved by an administrator. Parents see only results their child's school has released. AI-generated insights are guidance, not diagnoses.
Who we share it with
Only with service providers that run the platform for us, under contract: database and sign-in hosting (Supabase), application hosting (Vercel), email delivery (Resend), and the video service your school selects. Some providers store data outside Jamaica, including in the United States; we rely on contractual and technical safeguards for those transfers. We disclose data to authorities only where the law requires it.
How long we keep it
Learning records are kept while the school or account is active and then deleted or anonymised according to the retention settings agreed with the school, unless the law requires longer. Audit records are kept for security and accountability.
How we protect it
Encrypted connections (TLS 1.3) and encrypted storage (AES-256); access limited by role and school; two-step sign-in for staff and administrators; and a tamper-resistant audit log. See our security overview for details.
Your rights
You can ask to access, correct or delete your personal data, object to or restrict certain processing, and receive a copy of your data. Signed-in users can download their data at any time from My data & privacy. For students in a school account, the school handles these requests and we help them do so. You can also complain to the Office of the Information Commissioner (Jamaica) or, where the GDPR applies, your local data protection authority.
Contact
Privacy questions and requests: [privacy contact email to be confirmed].