Home
Privacy Policy

Last Updated: April 28, 2026

Data Controller: Muhammad Qumboz

Location: Girona, Spain

Contact: hi@mqumboz.com


Information We Collect

We only collect the minimum data necessary to provide the service:

  • For Teachers (App Users): Direct Registration: Name and mobile phone number.
  • Social Login: If using Google or Apple Sign-In, we only receive the access token and the basic profile information (email/name) provided by the service to authenticate your identity.
  • For Parents: Mobile Phone Number: Used exclusively to deliver photos via the WhatsApp API.
  • Visual Data (Images): We process images of children to facilitate sharing between teachers and parents via the WhatsApp API, images are permanently removed from our servers after delivery.
The "Privacy-First" Processing Model
  • Our architecture is designed so that we never handle "sensitive, unmasked" data of students other than the intended recipient:
  • On-Device Blurring: All face-blurring of "non-recipient" children occurs locally on the Teacher’s device. No unblurred photos of other children are ever uploaded to our servers.
  • Transient Transit: The blurred photo is uploaded to our EU-based servers solely to be handed off to the WhatsApp Business API.
  • Automatic Deletion: Once the photo is successfully handed to the WhatsApp API, it is deleted forever from our server cache. We do not offer a gallery or permanent cloud storage for images.
Purpose and Legal Basis

Service Delivery: To allow teachers to share educational moments with parents securely.

Legal Basis (GDPR Art. 6): Processing is based on the explicit consent provided by the Parent via the WhatsApp interface before receiving any images, and the contractual necessity to provide the service to the Teacher.

Data Retention & Logs
  • Images: 0 days. Deleted immediately after delivery.
  • Transactional Logs: We maintain logs of the transaction (e.g., Teacher A sent 1 image to Parent B at [Timestamp]). These logs are stored securely for [e.g., 12 months] for security auditing, debugging, and service usage stats. These logs never contain the actual images.
  • Account Data: Teacher and Parent contact info is stored as long as the account remains active.
Third-Party Service Providers

We use trusted partners to operate:

  • Hosting: EU-based servers (Compliant with GDPR).
  • Communication: WhatsApp Business API (Meta Platforms, Inc.).
  • Authentication: Apple Inc. and Google LLC (only for identity tokens).
Rights of the Data Subject

Under the GDPR, you have the right to access, rectify, or delete your personal data (Phone numbers/Names). Because we do not store images, we cannot provide "access" to past photos as they no longer exist on our systems. To exercise your rights, contact us at hi@mqumboz.com.

Made with