Privacy & GDPR

Last updated: 2026-05-08

Who is responsible for your data

On the managed tier, Min Dugsi (the Danish entity operating mindugsi.dk) is the data processor on behalf of your school, which is the data controller. We process student and family data only on the school’s instructions, encoded in our Data Processing Agreement.

On the self-hosted tier, you are both controller and processor. We never see your data.

What data we hold

Students: full name, optional Arabic name, optional date of birth, gender, current class assignment, attendance, lesson scores, hifz progress.
Parents: full name, phone, optional email, relationship, link to children.
Teachers and admins: username (typically Danish phone), full name, role, tenant.
System: audit logs (admin actions, login attempts), delivery logs (WhatsApp/SMS receipts), generated tokens (hashed).

What we do not collect

No tracking pixels. No third-party advertising scripts.
No biometric data.
No marketing email to parents or teachers — only operational notifications the school explicitly triggers.

Lawful basis (Art. 6)

The school’s contractual relationship with parents is the lawful basis for processing student data. School staff role data is processed on the basis of the employment relationship. Optional contact channels (WhatsApp, SMS) are consent-based and revocable from the parent portal.

Where data is hosted

All managed-tier data is hosted inside the EU. No data leaves the EU on the managed tier.

Retention

Active tenants retain student data for the school year plus seven years (Danish bookkeeping law for finance entries; configurable per tenant in Settings → Audit retention). Soft-deleted tenants are purged 90 days after deletion.

Your rights (Art. 15-22)

Access — your school admin can export every record about a student through the Reports module. Self-hosters can run a SQL export.
Rectification — your school admin can edit any record at any time.
Erasure — request via your school. We hard-delete within 30 days unless a legal retention obligation overrides.
Portability — per-student PDF report cards and personal JSON export.
Objection — to opt out of WhatsApp/SMS notifications, parents can disable them in their portal.

Sub-processors

Supabase — EU.
Vercel — EU.
Your WhatsApp/SMS provider — configurable per tenant.

Data-protection contact

Message us on WhatsApp. We respond within 7 days. Phone-first by design — no email channel.

Need a signed DPA?

Message us on WhatsApp with your school’s legal name and authorised signatory. We countersign within 5 business days at no cost.

Who is responsible for your data

On the self-hosted tier, you are both controller and processor. We never see your data.

What data we hold

Students: full name, optional Arabic name, optional date of birth, gender, current class assignment, attendance, lesson scores, hifz progress.

Parents: full name, phone, optional email, relationship, link to children.

Teachers and admins: username (typically Danish phone), full name, role, tenant.

System: audit logs (admin actions, login attempts), delivery logs (WhatsApp/SMS receipts), generated tokens (hashed).

Your rights (Art. 15-22)

Access — your school admin can export every record about a student through the Reports module. Self-hosters can run a SQL export.

Rectification — your school admin can edit any record at any time.

Erasure — request via your school. We hard-delete within 30 days unless a legal retention obligation overrides.

Portability — per-student PDF report cards and personal JSON export.

Objection — to opt out of WhatsApp/SMS notifications, parents can disable them in their portal.