Privacy Policy

Last updated: March 2026  ·  Effective date: March 1, 2026

1. Who We Are

EduPay ("we", "our", or "us") is a student payment management platform designed for private tutoring institutes. We are operated by the EduPay team and can be contacted at fragkeskouk@gmail.com.

2. Information We Collect

We collect the following categories of information:

• Account information: Email address and Firebase authentication data for institute administrators.
• Institute data: Your institute name, primary colour preference, and school year settings.
• Student records: Names, class/subject assignments, monthly fee amounts, and payment status records entered by you as an administrator.
• Payment metadata: Records of which months fees were marked as paid or unpaid, and timestamps of those actions. We do not process or store card details — all billing is handled by Stripe.
• Subscription and billing data: Stripe customer IDs, subscription status, and plan details. Your payment card information is stored exclusively by Stripe.
• Usage data: Basic browser information and access logs collected automatically by Firebase Hosting and Google Cloud infrastructure.

3. How We Use Your Information

We use collected information to:

• Provide and operate the EduPay platform for your institute.
• Manage your subscription and process payments via Stripe.
• Authenticate administrators and enforce access controls.
• Display payment status pages to parents via student QR codes.
• Send transactional emails related to your subscription (e.g. renewal reminders, payment failures).
• Improve platform performance and fix bugs.

We do not sell your data to third parties. We do not use student data for advertising.

4. Data Storage and Security

All data is stored in Google Firebase (Firestore and Firebase Hosting), running on Google Cloud infrastructure within the European Union where possible. Access is protected by Firebase Security Rules that ensure administrators can only access their own institute's data.

Stripe handles all payment card data under PCI-DSS compliance. We never store raw card numbers on our servers.

5. Student Data and Privacy

Student records (names, classes, payment status) are entered by institute administrators and belong to the institute. EduPay processes this data only as a data processor on behalf of the institute, which acts as the data controller.

The student QR code page displays only the student's name, class, and current month's payment status. No sensitive personal data (addresses, phone numbers, etc.) is shown on public QR pages.

6. Third-Party Services

We use the following third-party services:

• Google Firebase — database, authentication, hosting, and cloud functions.
• Stripe — subscription billing and payment processing.
• Google Fonts / Cloudflare CDN — font and icon delivery.

Each of these providers maintains its own privacy policy and security standards.

7. Data Retention

Your data is retained for as long as your institute has an active or recently cancelled subscription. If you cancel, data is retained for 30 days before being eligible for deletion. You may request earlier deletion by contacting us.

8. Your Rights

If you are in the European Union or European Economic Area, you have rights under the GDPR including the right to access, rectify, erase, and port your data, as well as the right to restrict or object to processing. To exercise any of these rights, contact us at fragkeskouk@gmail.com.

9. Cookies

We use only essential cookies required for authentication and session management via Firebase. See our Cookie Policy for details.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a notice within the admin panel. Continued use of EduPay after changes constitutes acceptance of the updated policy.

11. Contact

For any privacy-related questions or requests, please contact us at fragkeskouk@gmail.com.