Privacy Policy

1. Who We Are

Scholly is a mobile application and associated web service operated by:

Quantumloop Limited
Company Registration Number: 780236
Registered in the Republic of Ireland
Registered Office: Dublin, Ireland
Email: support@schollyapp.com
Website: https://www.schollyapp.com

Quantumloop Limited is the data controller for personal data processed through the Scholly application and website. As a data controller, we determine why and how your personal data is processed.

For all data protection queries, requests to exercise your rights, or concerns, please contact us at support@schollyapp.com.

2. Data We Collect

We collect only the data necessary to provide and improve the Scholly service. We do not sell your personal data to third parties.

2.1 Account Data

• Name (first and last name) — provided at registration
• Email address — used for account authentication, service communications, and password reset
• Password — stored as a cryptographic hash (bcrypt); we never store your password in plain text

2.2 Children's Profile Data

• Child nickname — a name or nickname you assign (e.g. "Tom", "DB"); this need not be the child's real name
• Colour tag — a display preference (blue, pink, green, or purple)
• School association — the name of the school linked to each child profile

We do not collect children's dates of birth, photographs, medical information, or any other sensitive information about minors.

2.3 Subscription & Payment Data

• Subscription status — whether your account is on a free beta or paid plan
• Purchase receipts — transaction identifiers provided by Apple App Store or Google Play (we do not collect or store card numbers, bank details, or billing addresses)

All payment processing is handled entirely by Apple, Google, and RevenueCat. Scholly never has access to your full payment card details.

2.4 Device & Technical Data

• Push notification token — a device identifier required to send you holiday reminders (only collected if you grant notification permission)
• Device type and operating system — used for compatibility and support purposes
• IP address and request logs — recorded by our hosting infrastructure for security and abuse prevention; retained for a maximum of 90 days

2.5 Usage Data

• Calendar interactions (months viewed, days tapped)
• Features used within the app
• Error and crash reports

We use this data solely to improve the service. We do not build advertising profiles from usage data.

2.6 Communications

• Messages you send to us via support@schollyapp.com
• Any feedback or support requests you submit

3. How We Use Your Data

• Providing the service — authenticating your account, loading and displaying your children's school calendars, showing holiday events
• Push notifications — sending holiday reminders to your device, if you have granted permission
• Subscription management — verifying and managing your paid or beta subscription via RevenueCat
• School calendar extraction — using Google Gemini AI to extract and interpret school holiday dates from publicly available school websites
• Transactional emails — password resets, account confirmations, and important service notices sent via Gmail/Google SMTP
• Security and fraud prevention — detecting and responding to suspicious activity or unauthorised access
• Legal compliance — meeting our obligations under Irish and EU law
• Service improvement — analysing aggregate usage patterns to improve features and reliability

We do not use your personal data for advertising, behavioural profiling, or sale to third parties.

4. Lawful Basis for Processing

Under Article 6 of the GDPR, we rely on the following lawful bases:

• Contract (Article 6(1)(b)) — processing your account data, children's profiles, and school associations is necessary to perform the service you have signed up for.
• Legitimate Interests (Article 6(1)(f)) — processing device logs, IP addresses, and usage data to maintain security, prevent abuse, and improve the service. Our legitimate interests do not override your rights.
• Consent (Article 6(1)(a)) — sending push notifications. You may withdraw consent at any time through your device notification settings or by contacting us.
• Legal Obligation (Article 6(1)(c)) — retaining financial transaction records as required under Irish tax and company law.

5. Third-Party Services & Processors

We use a limited number of carefully selected third-party services to operate Scholly. Each acts as a data processor on our behalf and is bound by contractual data protection obligations.

SCCs = Standard Contractual Clauses approved by the European Commission, providing appropriate safeguards for transfers outside the EEA.

6. International Data Transfers

Several of our third-party processors are based in the United States, which is outside the European Economic Area (EEA). Where data is transferred outside the EEA, we ensure appropriate safeguards are in place in accordance with Chapter V of the GDPR. These safeguards include:

• Standard Contractual Clauses (SCCs) — the European Commission-approved contractual mechanisms requiring processors to protect your data to EEA standards
• Adequacy decisions — where applicable, transfers to countries recognised by the European Commission as providing an adequate level of protection

You may request a copy of the relevant safeguards by contacting us at support@schollyapp.com.

7. Data Retention

• Active accounts — personal data is retained for as long as your account remains active and the service is in operation.
• Account deletion requests — upon receiving a valid deletion request, we will erase your personal data within 30 days, except where retention is required by law (e.g. financial records).
• Financial records — transaction records relating to paid subscriptions are retained for 7 years as required under the Irish Companies Act 2014 and tax legislation.
• Server logs — IP address and access logs are retained for a maximum of 90 days for security purposes, then automatically deleted.
• Support communications — emails sent to support@schollyapp.com are retained for 2 years to assist with ongoing support queries, then deleted.

To request deletion of your account and personal data, please email support@schollyapp.com with the subject line "Data Deletion Request". We will acknowledge your request within 5 business days and complete the erasure within 30 days.

8. Your Rights Under GDPR

As a data subject under the GDPR and the Irish Data Protection Acts, you have the following rights. To exercise any of these rights, contact us at support@schollyapp.com. We will respond within one calendar month.

9. Children's Privacy

Scholly is intended for use by adults aged 18 and over. We do not knowingly collect personal data directly from children under 18.

The app allows adult users to create child profile entries (nickname and school) for the purpose of tracking school holidays. This data is provided by the adult account holder, not by the child. We collect only the minimum data necessary (nickname and school name) and do not collect any sensitive information about minors such as photographs, dates of birth, or health information.

If you believe a child under 18 has created an account directly, please contact us immediately at support@schollyapp.com and we will promptly delete the account.

10. Cookies & Local Storage

Mobile app: The Scholly app does not use browser cookies. It uses your device's secure local storage (AsyncStorage) solely to store your authentication session token and app preferences locally on your device. This data does not leave your device except as part of authenticated API requests to our servers.

Website (schollyapp.com): Our website is a static marketing page and does not use tracking cookies, advertising cookies, or analytics cookies. We do not use Google Analytics or any third-party tracking scripts on the website. The only external resources loaded are fonts from Google Fonts (fonts.googleapis.com), which may set performance-related cookies subject to Google's own privacy policy.

11. Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures, including:

• Encryption in transit — all data transmitted between your device and our servers is encrypted using TLS 1.2 or higher (HTTPS)
• Encryption at rest — your data is stored in an encrypted PostgreSQL database on Railway's infrastructure
• Password hashing — passwords are hashed using bcrypt and are never stored or transmitted in plain text
• JWT authentication — session tokens are signed using HS512, short-lived, and validated on every request
• Rate limiting — login and registration endpoints are rate-limited to prevent brute-force attacks
• Principle of least privilege — internal systems access only the data they need to function
• Security headers — our web server applies HTTP security headers including HSTS, Content Security Policy, and X-XSS-Protection

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours of becoming aware of the breach, and will notify affected users without undue delay, as required under Article 33–34 of the GDPR.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Notify you by email (to the address associated with your account) at least 14 days before the changes take effect
• Display an in-app notice for significant changes

Your continued use of Scholly after the effective date of any changes constitutes your acceptance of the updated policy. If you do not agree to the changes, you may delete your account by contacting support@schollyapp.com.

13. Contact & Complaints

For any questions, concerns, or requests relating to your personal data or this Privacy Policy, please contact us:

Quantumloop Limited (trading as Scholly)
Email: support@schollyapp.com
Website: https://www.schollyapp.com

We will acknowledge your query within 5 business days and resolve it within one calendar month. If we need additional time (up to 2 further months for complex requests), we will inform you of the reason for the delay.

If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Commission (DPC), the Irish supervisory authority under the GDPR:

Data Protection Commission
21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
www.dataprotection.ie
info@dataprotection.ie
Tel: +353 57 868 4800