Privacy Policy

Scope of this policy

This Privacy Policy explains how MQurious ("we", "us") collects, uses, shares and protects personal information when you visit our website, use the MQurious School Platform or Student Platform, attend a demo, or otherwise interact with us.

It applies to mqurious.com and to the services we operate on behalf of schools. It does not apply to third-party websites or services that we link to but do not control.

The two roles we play

MQurious acts in two different capacities, and it matters for your rights. When you contact us as a visitor or a prospective customer, we are the controller of the information you give us. When a school uses the platform, the school is generally the controller of the student and family records it enters, and we act as the school's processor — we handle that data on the school's instructions and for the school's purposes.

Requests about student or family records should normally go to the relevant school first, because the school holds the record and can usually satisfy the request immediately.

Information you give us

• Contact details such as name, work email address, phone number, school name and role, submitted through our contact or demo forms.
• Messages, feedback and support correspondence you send to us.
• Account and profile information, where you are an administrator or teacher with your own login.
• Records you ask us to import on your behalf, such as student rosters or historical attendance data.

Information about students

A school management platform necessarily processes information about students and their families. Depending on how your school configures the platform, this may include:

• Identity details such as name, date of birth, enrolment number, photograph and grade or class.
• Academic records including attendance, assignments submitted, grades, examination results and teacher comments.
• Contact details provided by parents or guardians, including email address, phone number and home address.
• Timetable, health or special-needs information, and fee or billing records, but only to the extent your school chooses to record them.

Information collected automatically

• IP address, device and browser type, operating system, and screen dimensions.
• Pages visited, referring page, and approximate location derived from your IP address.
• Session identifiers and authentication tokens required to keep you signed in and to protect the platform against misuse.
• Cookie preferences. See Section 10 for details on cookies and similar technologies.

Information from other sources

• Information provided by your school when it sets up and administers your account.
• Updates from your organisation's identity provider, if your school uses single sign-on.
• Publicly available business information about organisations we contact in the course of sales activity.

To operate the platform

• Authenticating users and maintaining accounts, sessions and permissions.
• Delivering the functionality you use — attendance, homework, grading, timetables, reports and messaging.
• Storing, backing up and restoring data so the service is reliable and recoverable.
• Preventing fraud, abuse and unauthorised access, and enforcing our terms.

To communicate with you

• Responding to enquiries and demo requests.
• Sending service messages such as maintenance notices, security alerts and password resets.
• Sending product announcements and educational content, where you have asked to receive them. Every marketing email includes an unsubscribe link.

To improve our services

• Understanding which features are used, and how the platform is used, so we can prioritise improvements.
• Diagnosing errors, measuring performance and monitoring availability.
• Running internal analytics and quality assurance.

To meet legal obligations

We process personal information when necessary to comply with applicable law, valid legal process and our legitimate business interests, such as keeping financial records and defending our legal rights.

Profiling and automated decisions

We do not use student data for advertising, and we do not make decisions producing legal or similarly significant effects about students using automated means. Career-pathway suggestions shown in the Student Platform are advisory, are produced with general assessment logic rather than individual profiling, and are intended to be reviewed by a human.

Student data

MQurious is designed for use by schools, and much of the information in the platform concerns children. We process that information solely on the instructions of the school, which is in practice the party that decides what is recorded and who may see it. Our customer agreements require schools to configure roles and permissions appropriately, and we provide the tools to do so.

United States requirements

Where a school uses the platform, the school is responsible for meeting the requirements of the Family Educational Rights and Privacy Act (FERPA) and any equivalent state law. We support the school's obligations through role-based access controls, audit logs, configurable retention, and export or deletion on request.

If the platform is used in a context governed by the Children's Online Privacy Protection Act (COPPA), the school — not MQurious — is the operator of a child-directed service. We do not knowingly collect personal information directly from a child under 13 through our own website; accounts are created and managed by the school or guardian.

Our commitments regarding minors

• We never sell, rent or trade personal information about students or families.
• We do not use student data for behavioural advertising or cross-contextual advertising.
• We do not share student data with third parties except as necessary to provide the service, as directed by the school, or as required by law.
• We apply the same technical and organisational safeguards to student data as to all other customer data.

Service providers

We share information with vetted third-party suppliers who host our infrastructure, deliver email and messaging, process payments, and provide analytics and support tooling. They act as processors on our instructions, are bound by contract to protect the information, and may not use it for their own purposes.

At the school's direction

Information entered into the platform is visible to the school's authorised staff, and is shared with students, parents and others only as your school configures. If you believe you should have access to information about you held in the platform, contact the relevant school.

Legal and safety disclosures

We may disclose information where we reasonably believe it is required by law, valid legal process such as a court order or regulatory demand, or necessary to protect our rights, our users or the public. We will notify the affected customer unless legally prohibited from doing so.

Corporate transactions

If we merge with, acquire or sell all or part of our business, information may be transferred as part of that transaction. We will continue to honour this policy, and where the change materially affects your rights we will give notice before it takes effect.

No sale of personal information

We do not sell personal information as that term is defined under the California Consumer Privacy Act, and we do not share personal information for cross-contextual behavioural advertising. Where we disclose our practices in a way that constitutes “selling” or “sharing”, we honour the resulting rights, including the right to opt out.

Customer data

Information belonging to a school is retained for as long as the school has an active account, and for a configurable period after termination so that data can be exported. Our default post-termination retention is 90 days, after which customer data is deleted from production systems and removed from backups as those backups rotate.

Marketing and sales enquiries

Information submitted through our contact or demo forms is retained for as long as needed to manage the relationship, and for a reasonable period afterwards to maintain a record of enquiries. You can ask us to delete it at any time.

Technical logs

Security and application logs are retained for a limited period — typically up to 12 months — to investigate incidents and maintain the security of the service.

Legal obligations

Some records must be kept longer where tax, employment, regulatory or other law requires it. Where this applies, we keep the information for the required period and isolate it from ordinary processing.

Technical measures

• Encryption in transit using TLS, and encryption at rest for stored customer data and backups.
• Role-based access control, so each user sees only the data their role permits.
• Multi-factor authentication for privileged and administrative access.
• Centralised logging and monitoring of access to customer data.
• Regular vulnerability scanning, dependency patching and independent penetration testing.
• Documented incident response and breach notification procedures.

Organisational measures

• Confidentiality obligations for all personnel who can access customer data.
• Background screening for staff in trusted or privileged roles.
• Security awareness training and annual refreshers.
• Vendor risk assessment before a supplier is permitted to process customer data.

Limitations

No system is perfectly secure. Customers are responsible for configuring permissions sensibly, protecting account credentials, and promptly revoking access for staff and students who leave.

Breach notification

Where a breach affects personal data we will notify the affected customer without undue delay, and provide the detail needed to meet their own notification obligations. Where the law requires us to notify individuals or regulators directly, we will do so.

Rights we honour

Depending on where you live, you may have the right to:

• Request access to the personal information we hold about you, and a copy of it.
• Ask us to correct information that is inaccurate or incomplete.
• Ask us to delete information we no longer have a lawful reason to keep.
• Receive certain information in a portable, machine-readable format.
• Object to, or ask us to restrict, certain processing.
• Withdraw consent where processing relies on it, without affecting processing already carried out.
• Opt out of sale or sharing of your personal information.
• Complain to your data protection authority.

How to exercise them

Send us an email at privacy@mqurious.com, or write to us at the address in Section 13. Describe what you want and, if you are acting for a student, state which school the student attends. We will verify your identity before acting — we cannot disclose a student's information to anyone other than the student, their guardian, or the school holding the record. We aim to respond within 30 days.

Appeals and complaints

If you are unhappy with how we have handled a request or with our processing generally, tell us first so we can put it right. You also retain the right to lodge a complaint with your supervisory authority at any time.

Where data is processed

MQurious is based in the United States. If a school's data is processed outside its own country — for example by an infrastructure or support provider in another jurisdiction — we rely on an appropriate transfer mechanism, such as Standard Contractual Clauses, together with a transfer risk assessment and supplementary measures where needed.

What we use

• Strictly necessary cookies, required to sign you in, maintain sessions and remember security settings. The service cannot function without them.
• Preference cookies, such as remembering choices that affect how the site behaves.
• Analytics cookies, which help us understand how the site is used so we can improve it.

Your choices

You can block or delete non-essential cookies through your browser settings, and most browsers offer a per-site control. Blocking strictly necessary cookies will prevent sign-in.

Links to other sites

Our website may contain links to third-party sites. Once you follow a link we no longer control the destination, and that site's own privacy policy applies.

Embedded content

Where we embed content from another provider — for example a video or a map — that provider may collect information about your visit independently of us. Consider using privacy or tracking settings in your browser.

Updates

We may update this policy to reflect changes in our practices, our services or the law. When we make a material change we will post the revised policy here and update the effective date at the top of the page, and we will provide additional notice where the change affects customers or students.

Previous versions

We retain previous versions of this policy so you can see how it has changed over time.

Questions and requests

If you have a question about this policy, or wish to exercise a right described in Section 8, contact us:

• Email: privacy@mqurious.com
• Post: MQurious — Privacy Team, 2825 Pacific Dr., Suite C, Norcross, GA 30071, United States