1. Who we are
Lesson Lab is a school management system for private schools in Saudi Arabia. In this policy, "we" means the Lesson Lab team, and "the service" means this website and the Lesson Lab app.
2. Our role and the school's role
When a school uses Lesson Lab, the school decides what data about its students, parents and staff is entered and why. The school is the data controller, and Lesson Lab processes that data only on the school's instructions, under an agreement with the school.
For the details visitors send us through this website, such as a demo request, Lesson Lab is the controller.
3. What we collect
- Demo and contact forms: your name, school name, email, mobile number and your message.
- School accounts: names, usernames, email addresses, roles and the school each user belongs to.
- Records a school enters: for example classes, attendance, marks, fees and messages between teachers and parents.
- Technical data: sign-in times, IP address, browser type and error logs, used to keep the service working and secure.
4. How we use it
- To run the service for the school and its users.
- To reply to demo requests and messages.
- To send emails the service needs, such as sign-in codes and important notices.
- To protect accounts, prevent misuse and fix problems.
We do not sell personal data, and we do not use student data for advertising.
5. Children's data
Student information is entered by the school, which is responsible for getting consent from parents or guardians where required. Parents see only their own children, and teachers see only the classes they teach.
6. Who we share it with
Each school's data is kept separate, and users of one school cannot see another school's data.
We use a small number of service providers, such as hosting and email delivery, who act on our instructions and must protect the data. We share data with authorities only when Saudi law requires it.
7. How we protect it
- All traffic is encrypted with HTTPS.
- Passwords are stored as one-way hashes, never as plain text.
- School and platform administrators must use two-factor authentication.
- Repeated failed sign-ins are blocked for a time.
8. Where it is stored and for how long
We aim to keep school data in Saudi Arabia, in line with the Personal Data Protection Law (PDPL).
We keep school data while the school uses Lesson Lab. When a school leaves, it can ask for an export, and we then delete its data unless the law requires us to keep it.
9. Cookies
We use only the cookies and browser storage the service needs, for example to keep you signed in, protect forms and remember your language. We do not use advertising cookies.
10. Your rights
Under the PDPL you can ask to see, correct or delete your personal data, or ask how it is used. If your data was entered by a school, please contact the school first; we will help them answer. You can also write to us directly.
11. Changes to this policy
If we change this policy, we will update the date at the top of this page and, for important changes, tell schools in advance.
12. Contact us
Questions about privacy: info@lessonlab.me