How MySchool.Life handles personal information

Section 1Who we are and who is responsible

InterconX Limited ("we", "us") operates MySchool.Life. Our Privacy Officer is responsible for this policy and for answering questions and complaints about personal information: [email protected]. Pour le Québec : la personne responsable de la protection des renseignements personnels peut être jointe à la même adresse.

Two roles, stated plainly

When your school uses MySchool.Life

Your school, school board, division or service centre decides why information is collected and controls it under its own education and privacy laws. We process it only on the school's instructions, under a written agreement. Questions about why your school collects something are best answered by the school office or its privacy / access-to-information coordinator — we will help them respond.

When you deal with us directly

For information you give us yourself — a guest parent booking without a school account, a message to us, or a visit to this website — we are the organisation responsible under Canada's PIPEDA and, where they apply, Alberta's PIPA, British Columbia's PIPA and Quebec's private-sector Act.

Section 2What we collect, by role

We do not collect precise location, biometric identifiers or advertising identifiers. If a school buys optional AI processing credits, payment is handled by Stripe; we receive a confirmation and the last four digits of the card, never the full card number.

Section 3Why we use it

• To run the service for your school — scheduling parent–teacher interviews and events, issuing tickets, taking and reporting attendance, building, delivering and marking exams, sending school messages, and showing each person the information their role allows.
• To send transactional notices — booking confirmations, reminders, attendance alerts, exam results and account messages, by email, push notification or in the app, according to the school's settings and your preferences.
• To keep the service secure — authenticating users, detecting abuse, keeping audit logs.
• To support you — answering questions from schools, staff and families.
• To meet legal obligations — including record-keeping and responding to lawful requests.
• To improve the product — using de-identified, aggregated usage information only.

We do not use personal information for advertising or profiling, we do not build products from it that are unrelated to your school's use, and we do not sell or rent it.

Section 4Legal basis and consent

Public schools collect student and parent information under their provincial or state education and privacy laws — for example Alberta's Education Act and Protection of Privacy Act, British Columbia's School Act and FIPPA, Ontario's Education Act and MFIPPA, and Quebec's Education Act and Access Act. Independent schools rely on the consent they obtain at enrolment. In every case the school remains the right first contact for questions about the purpose of collection.

Where a use goes beyond core school operations — for example enabling AI-assisted exam features — the school's administrator makes that choice, and can reverse it. Where we collect from you directly (a guest booking, a message to us, this website), we rely on your consent, which you may withdraw at any time subject to legal or contractual limits.

Section 5AI-assisted features

Some features can use large-language-model services to read exam documents, extract questions, suggest marks for photographed answer sheets, draft event descriptions and import public holiday dates. This section describes how that works.

• Nothing is sent automatically. AI processing happens only when a teacher or administrator starts an AI action on a specific document or item. Routine use of MySchool.Life — bookings, attendance, messages — does not involve AI providers.
• What is sent: the exam text or page images concerned, or for Scan Marker the photograph of the answer sheet. Answer-sheet photographs can show a student's name and handwriting.
• Providers: depending on how a school's account is configured, processing may be performed by Anthropic (United States), OpenAI (United States), Google Gemini (United States), DeepSeek (China) or Zhipu AI / GLM (China). Document layout extraction for uploaded PDFs runs on our own servers first. A school administrator can turn AI features off school-wide or for individual users, and can supply the school's own API key so that usage runs under the school's own provider agreement. We recommend that Canadian public schools restrict AI to providers located in the United States, and we will configure this on request.
• Provider terms: we use business API terms under which providers do not train models on our data and retain it only for limited abuse-monitoring periods.
• Humans decide. AI-suggested marks, questions and text are suggestions. A teacher reviews and can change every suggested mark; no result is released to a student or parent without a staff member's action.

Section 6Service providers (sub-processors)

A small number of providers help us run MySchool.Life. Each is bound by contract to use the information only to provide its service to us.

We will update this list and notify school administrators at least 30 days before adding a provider that will handle student information. A dated copy of the current list is available from [email protected].

Section 7Where data is stored

One home, and it is in Canada. MySchool.Life runs as a single platform in DigitalOcean's Toronto data centre. The application servers, the database, uploaded files and the backups are all in Canada — for every school, whether it is in Canada, the United States or Australia. We do not keep regional copies of your data, and it is not moved between countries to serve traffic.

Why one country, and why this one. MySchool.Life is built so that a family with children at more than one school, and staff who work across schools, use a single account. That needs one shared database rather than a copy per region — so we put it in the country with the strictest rules we operate under. Canada sets the highest bar of the three, and meeting it means schools in the other two are covered as well.

If your school is not in Canada. For a school in the United States, storage in Canada is permitted: FERPA and COPPA set conditions on how a vendor may handle education records — purpose limits, direct control, no re-disclosure, deletion or return — not on which country holds them. For a school in Australia, holding data in Canada is a cross-border disclosure under Australian Privacy Principle 8; we take the reasonable steps APP 8 requires, remain accountable for it under s. 16C, and name Canada as the destination here and in the collection notice we supply for enrolment packs. In both cases we say so before you sign, not after. Safeguards are the same everywhere — encryption in transit, role-based access, audit logging and contractual limits on every provider.

Where we work from. Storing your data in Canada is not the same as never reaching it from anywhere else, and we would rather you heard that from us than found it in a security review. InterconX Limited is registered in Hong Kong, and a small number of named support staff administer production systems from outside Canada. That access is limited to named people, role-based, logged, used only to operate and support the service, and bound by our agreement with your school — but it is a disclosure outside Canada, and your assessment should treat it as one. If your board requires that personal information be neither stored nor accessed outside Canada, tell us before deployment and we will give you a straight answer on whether we can meet it.

Schools subject to provincial rules on storing or accessing personal information outside Canada or outside Quebec — including the privacy impact assessments those rules require — should contact us before deployment. We provide a vendor privacy assessment describing data flows, locations and safeguards to support your assessment, and we contract accordingly.

Section 8Retention and deletion

• Account information is kept while the account is active and the school's subscription continues.
• School records — bookings, attendance, exam results, messages — are kept for as long as the school's subscription requires and according to the school's own retention rules. Schools decide what is kept and for how long; some records must be retained by law.
• Audit logs that record who accessed or changed information are kept for 7 years, then removed.
• Technical logs (errors, security events) are kept for a limited operational period and then deleted.
• When a subscription ends, we return the school's data on request and delete it, then confirm the deletion in writing.
• Individual deletion requests are completed within 30 days of verification (see section 9). Any copies held in backups are deleted when those backups expire.

Section 9Your rights and how to use them

Depending on where you live, you have the right to access the personal information held about you, to have it corrected, to receive a copy, to withdraw consent, to ask for deletion, and to complain. We respond to access requests within 30 days.

If you are not satisfied with our response you may complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner — Alberta, British Columbia, Ontario, Quebec — or the equivalent authority where you live.

Section 10Children and students

• Student accounts are created and managed by the school. We do not knowingly collect personal information directly from a child under 13 without the school's authorisation or a parent's consent.
• Students see only their own information; parents see only the children linked to them by the school; teachers see the classes and events they are assigned to.
• We show no advertising to anyone and build no profiles of students for any purpose other than the school's own use of the service.
• Parents and guardians can ask the school, or us, for access to or deletion of a child's information as described in section 9.

Section 11Security

• All traffic between your device and MySchool.Life is encrypted with TLS.
• Passwords are stored only as salted hashes; multi-factor authentication is available for accounts.
• Role-based access controls and per-school isolation limit every user to the information their role allows.
• Every access to and change of records is written to an audit log and kept for 7 years.
• QR tickets and check-in codes are signed and time-limited to prevent copying.
• Staff access to production systems is limited to named people and logged.

If something goes wrong. We notify affected schools without undue delay — and no later than 72 hours after we confirm an incident involving their information — with what happened, what information was involved and what we are doing about it, so that the school can meet its own notification duties. We report breaches that create a real risk of significant harm to the Privacy Commissioner of Canada and keep records of every incident. Report a security concern to [email protected].

Section 12Cookies and analytics

• Signed-in session: the app uses a session token to keep you signed in. That is the only strictly necessary storage.
• Preferences: this website remembers your light/dark theme choice in your browser's local storage. Nothing is sent to us.
• Analytics: we use Matomo, hosted on our own servers, configured without cookies, with IP addresses truncated and with your browser's Do-Not-Track setting respected. No analytics data is shared with any third party and no advertising network is involved.

Section 13Changes to this policy

Each version of this policy is dated. We tell school administrators at least 30 days before a material change takes effect and keep earlier versions available on request. Continued use of the service after a change takes effect indicates acceptance of the updated policy; schools may end their subscription if they disagree.

Section 14Contact

Privacy Officer, InterconX Limited
Email: [email protected]
Security: [email protected]
Website: myschool.life

Nous répondons aussi en français.

Section 15Regional addenda