Privacy Policy

1. Who we are

Vinta Automations ("we," "us," or "our") operates the VintaOS school management platform. We are based in Algiers, Algeria. When we say "personal data" in this policy, we mean any information that identifies or can identify a natural person, as defined by the Ordonnance n° 03-18 of May 26, 2018 on the protection of individuals in the processing of personal data (as amended).

2. What data we collect

2.1 Data you provide directly

When you register an account or use VintaOS, you or your staff may enter the following types of data into the platform:

• Academy information: Academy name, phone number, email, physical address.
• Owner and Staff profiles: Full names, email addresses, phone numbers, profile pictures, and hashed 4-digit PINs.
• Student records: Full names, ages, phone numbers, parent/guardian phone numbers, enrollment details, notes.
• Teacher records: Full names, phone numbers, subjects, contract types, pay rates.
• Billing data: Payment amounts, payment dates, payment status, billing plan details.
• Class and scheduling data: Class names, room assignments, schedules, session records.
• Attendance records: Check-in and check-out times, the staff member who logged each entry.
• Activity logs: Timestamps and descriptions of actions performed in the system, attributed to the staff member who performed them via PIN.

2.2 Data collected automatically

• Essential cookies: We store your theme preference (light/dark) and cookie consent choice in your browser's local storage. These are essential for the Service to function and are not transmitted to us.
• Server logs: When you access the Service, our servers may record your IP address, browser type, operating system, and the pages you visit. This data is used for security and debugging purposes and is retained for a maximum of ninety (90) days.

2.3 Data we do not collect

• We do not collect payment card numbers or banking details. All payments are handled manually (cash, bank transfer, etc.).
• We do not use tracking cookies, analytics cookies, or advertising cookies.
• We do not collect biometric data.
• We do not collect data from children directly — all student data is entered by academy staff.

3. How we use your data

We use personal data for the following purposes:

• To provide the Service: Processing student records, generating schedules, calculating billing and payroll, recording attendance.
• To authenticate users: Verifying PINs and managing access control.
• To communicate with you: Responding to inquiries sent via our contact form, sending service-related notifications (such as billing reminders or maintenance updates).
• To maintain security: Monitoring server logs for unauthorized access attempts.
• To improve the Service: Analyzing aggregate, anonymized usage patterns to identify bugs and areas for improvement.

We do not use your data for profiling, automated decision-making, or targeted advertising.

4. Legal basis for processing

Under the Ordonnance n° 03-18, we process personal data based on:

• Contractual necessity: Processing is necessary to perform our contract with you (providing the Service).
• Legitimate interest: For security monitoring and service improvement, where these interests do not override your rights.
• Consent: For the contact form, where you explicitly consent by checking the consent checkbox before submitting your message.
• Legal obligation: Where we are required to retain data by applicable law.

5. Data sharing

We do not sell, rent, or trade your personal data. We may share data only in the following circumstances:

• Service providers: We may use third-party infrastructure providers (such as cloud hosting services) to operate the Service. These providers are bound by contractual obligations to protect your data and process it only on our instructions. Current providers: [list your hosting provider here].
• Legal requirements: We may disclose data if required by a valid legal order from a competent Algerian court or government authority.
• Business transfer: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, with notice provided to you.

6. Data security

We implement the following measures to protect your data:

• All data is transmitted over encrypted connections (HTTPS/TLS).
• PINs are stored as hashes, never in plaintext.
• Access to production systems is restricted to authorized personnel only.
• Server infrastructure is maintained by our hosting provider with industry-standard security practices.

No system is completely secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and PINs.

7. Data retention

• Account data: Retained for the lifetime of your active account plus thirty (30) days after deletion to allow for export.
• Server logs: Retained for ninety (90) days, then deleted.
• Contact form submissions: Retained for twelve (12) months after the inquiry is resolved, then deleted.
• Cookie consent record: Retained in your browser's local storage until you clear it or until the consent version changes.

Academy owners can export their data as CSV at any time from the Service's Settings panel.

8. Your rights

Under the Ordonnance n° 03-18, you have the following rights regarding your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request correction of inaccurate or incomplete data.
• Right to erasure: You may request deletion of your personal data, subject to our legal retention obligations.
• Right to object: You may object to processing based on legitimate interest.
• Right to data portability: You may request your data in a structured, commonly used format (CSV).

To exercise these rights, contact us at contact@vintautomation.com. We will respond within thirty (30) days of receiving your request.

9. Children's data

VintaOS is used by academies to manage student records. We do not collect data from children directly. All student data is entered by academy staff. Academy owners are responsible for ensuring they have the appropriate legal basis (such as parental or guardian consent) to collect and process student data under applicable Algerian law, including the Code de la famille and any education-related regulations.

10. International data transfers

Your data is stored on servers located in [insert server location — e.g., the European Union or Algeria]. If data is transferred outside Algeria, we ensure that appropriate safeguards are in place, such as standard contractual clauses or equivalent protections required by the Ordonnance n° 03-18.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by displaying a notice on the Service at least fifteen (15) days before the changes take effect. The "Last updated" date at the top reflects the most recent revision.

12. Contact

For questions about this Privacy Policy or to exercise your data rights, contact us at:

Vinta Automations
Email: contact@vintautomation.com
Website: vintautomation.com

If you are not satisfied with our response, you may file a complaint with the Algerian data protection authority (Commission Nationale de l'Informatique et des Libertés — CNI), as established by the Ordonnance n° 03-18.