Privacy policy

What we collect depends on how you use the Service.

Account details

When a teacher or school staff member creates an account, we collect their first and last name, email address, phone number, profile photo, password and preferred language. Passwords are stored only as a one-way hash, never in plain text.

School details

The school’s name, description, logo, address, city, country and phone number, its members and their roles, and its plan and billing status.

Student and classroom data

Teachers, and students when they take part in a class, add information such as the student’s title, first and last name, student number, class, photo and an optional student password; assignments, submitted work and files; comments; scores, grades and rubric results; attendance; and points and skills. Students don’t need an email address or an account to use the Service.

Payments

Paid plans are billed through Stripe, which collects and processes card details. We receive a customer reference, the plan and the payment status, but never your full card number.

LINE chat bot

If a teacher connects a subject to our LINE chat bot, we store the LINE group identifier and process the messages sent to the bot so it can reply, for example to remind students about work that’s due or to answer a question about scores.

Support and feedback

Messages you send us by live chat, email, Facebook or phone, feedback you send from inside the app, and error reports you choose to send, which include technical details about what went wrong.

Usage and device data

Collected automatically when you use the Service: IP address, browser type and version, device type and operating system, pages visited, the time and date of visits, time spent on pages and other diagnostic data. If you turn on browser notifications, we also store your browser’s notification subscription.

You can create an account or sign in with Google. When you do, Google shares your name, email address, profile photo and Google account ID with us. We use them only to create and secure your account. Signing in with Google does not give us access to your Google Drive, Docs or Sheets.

Some features let you connect your Google account so you can use files from Google Drive, Google Docs and Google Sheets in Tatuga School: for example, attaching a Drive file to an assignment or teaching material, or opening and creating Docs and Sheets for your classes.

• Only with your permission. We connect only after you agree on Google’s consent screen, which lists exactly what access we’re asking for. We ask only for the access that the feature you’re using needs.
• What we access. Depending on the feature: the files you choose, the files the feature creates for you, and your basic profile (name and email) to show which account is connected.
• How we use it. Only to provide and improve the features you use that are visible in Tatuga School.
• What we never do. We don’t sell Google user data. We don’t use it for advertising, including retargeting or personalised ads. We don’t use it to create, train or improve general AI or machine-learning models. Our staff don’t read it unless you ask us to (for example, to help with a support request), it’s needed for security (such as investigating abuse), the law requires it, or it has been aggregated and anonymised for internal operations.
• Sharing. We transfer Google user data only to the service providers needed to run the feature, when the law requires it, or as part of a merger or acquisition with notice to you.
• Turning it off. You can remove our access at any time in your Google Account permissions at myaccount.google.com/permissions, or by contacting us. After that we can no longer reach your Google files. Copies you saved into Tatuga School, such as attachments, stay until you delete them.

Tatuga School’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• To provide the Service: run your school, classes and subjects; let students submit work and see their results; and send the notifications and LINE messages you set up.
• To manage your account and your school’s plan, including billing.
• To support you: answer your questions and fix problems you report.
• To keep the Service safe: prevent fraud, spam and abuse (our sign-up page uses Cloudflare Turnstile to block bots, for example) and protect accounts.
• To improve the Service: understand how features are used, fix bugs and build new features, including AI features (see “AI features and model training”).
• To contact you by email, phone, LINE or notifications about your account, security and changes to the Service and, unless you opt out, about news and offers from Tatuga School.
• To meet legal obligations and enforce our agreements.
• For business transfers: if we’re involved in a merger, sale or reorganisation, personal data may be transferred as part of it. We’ll tell you before your data becomes subject to a different privacy policy.

Our legal bases under the PDPA are: performing our contract with you or your school; our legitimate interests in running, securing and improving the Service, where your rights don’t override them; complying with the law; and your consent where we ask for it, such as when you connect Google Drive, Docs and Sheets.

Tatuga School includes AI features such as rubric grading assistance, answers from our LINE chat bot, help filling in teaching-material details, and career-path suggestions.

When you use an AI feature

We send the content needed for that request, such as an assignment, a rubric, a student’s submitted work or a question asked in LINE, to our AI service provider (currently Google’s Gemini API) to produce the result. Teachers should review AI suggestions before relying on them.

Training and improving our AI features

We may use de-identified data about how the Service is used, and de-identified content created in it, to train, test and improve our AI features, for example to make rubric suggestions more accurate. “De-identified” means names, email addresses, student numbers, photos and other details that identify a person have been removed, and we don’t try to re-identify anyone.

We never use the following for this purpose:

• data we receive from Google Drive, Docs, Sheets or any other Google API;
• students’ personal data, such as names, student numbers or photos.

Opting out

You can ask us to exclude your data from AI training at any time. School administrators can ask the same for their whole school. Email permlap@tatugacamp.com and we’ll stop using that data for future training. Data that has already been used to train a model can’t always be removed from that model.

• Usage statistics. We may publish aggregated, de-identified figures, such as how many schools, teachers and students use Tatuga School.
• Schools on paid plans. We may show the name, logo and city or province of schools on a paid plan on our website. A school administrator can ask us to remove their school at any time.
• Quotes and stories. We publish a person’s name, photo or words in testimonials or case studies only with their permission.
• Messages from us. We may email you about new features, tips and offers. You can ask us to stop at any time.

We don’t sell personal data, and we never use Google user data or students’ personal data for marketing or advertising.

We share personal data only as described here.

• Service providers that process it on our behalf to run parts of the Service: Google (sign-in, AI processing, and the Google Drive, Docs and Sheets connection), Stripe (payments), Cloudflare (file storage and bot protection), MongoDB Atlas (database), DigitalOcean (application servers), Netlify (website hosting), Sanity (website content), LINE (chat bot messages), Tawk.to (live chat) and our email delivery service.
• Your school. Administrators and teachers in your school can see the information they need to work together, such as members, classes and student records.
• Students and their families. Students can see their own work, scores and attendance. If a teacher shares a progress link, anyone with that link can see what it shows.
• Business transfers: as part of a merger, acquisition or sale of assets, with notice to you.
• Legal reasons: when the law or a valid request from a public authority requires it, or to protect the rights, property or safety of Tatuga School, our users or the public.
• With your consent for any other purpose.

We use a small number of cookies and similar technologies.

• Essential cookies keep you signed in and protect your account. The Service can’t work without them.
• Preference cookies remember choices such as your language.
• Third-party features. The live chat widget (Tawk.to) sets cookies to keep your conversation, and our video tour loads from YouTube only when you press play.

You can block or delete cookies in your browser settings, but parts of the Service, such as signing in, may stop working.

We keep personal data while your account or your school’s account is active, and as long as we need it for the purposes in this policy. When an account or school is deleted, we delete or de-identify its personal data within a reasonable time, unless we must keep it longer to meet legal, tax or accounting obligations, resolve disputes or enforce our agreements. Usage data is generally kept for a shorter time, unless we need it to keep the Service secure or to improve it.

Some of our service providers store or process data on servers outside Thailand. When that happens, we take the steps the PDPA requires to keep your data protected, such as working only with providers that have appropriate safeguards.

We protect data with measures such as encrypted connections (HTTPS), hashed passwords and access controls. No method of transmission or storage is completely secure, so we can’t guarantee absolute security. If a breach affects your personal data, we’ll notify you and the authorities as the law requires.

Under the PDPA you have the right to:

• know how your personal data is used;
• access your personal data and get a copy of it;
• receive your data in a commonly used electronic format, or have it sent to another service;
• correct data that is inaccurate or incomplete;
• ask us to delete or de-identify your data;
• ask us to restrict how we use your data;
• object to how we use your data, including for marketing and AI training;
• withdraw consent you’ve given, such as for the Google connection, without affecting what was done before;
• complain to the Office of the Personal Data Protection Committee (PDPC).

You can change most account details yourself in the app. For anything else, email permlap@tatugacamp.com. We may need to confirm your identity, and we’ll reply within 30 days. For student data, we may involve the student’s school, which manages that data.

Schools use Tatuga School to teach students, many of whom are under 20 and therefore minors under Thai law. Student information is added and managed by the school and its teachers, and we process it on the school’s behalf to provide the Service. Schools are responsible for telling students and their parents or guardians how student data is used, and for getting consent where the law requires it.

We never sell student data, never use it for advertising, and never use students’ personal data to train AI models. Parents or guardians with questions, or who want a student’s data corrected or deleted, can contact the student’s school or email us.

The Service may link to websites we don’t run. If you follow a third-party link, you’ll go to that site, and we encourage you to read its privacy policy. We have no control over, and take no responsibility for, the content, privacy policies or practices of third-party sites or services.

We may update this policy as the Service changes. We’ll post the new version on this page and update the date at the top. If a change is significant, we’ll also tell you by email or with a notice in the Service before it takes effect.

Questions about this policy or your data? Email permlap@tatugacamp.com, or write to Tatuga Camp Limited Partnership, 879 Moo 3, Pho Klang Subdistrict, Mueang Nakhon Ratchasima District, Nakhon Ratchasima, Thailand.