Privacy notice
Version 2026-08-01
This notice explains what we collect, why, who can see it and how to have it removed. It is written to be read, not to be survived.
Who we are
CedarNova Academy, Lebanon. For any privacy question or request, contact us through the contact page.
What we hold, and for how long
| Data | Why we hold it | Retention |
|---|---|---|
| Guardian name, email, phone | Account, booking confirmations, receipts | While the account is active, then 12 months |
| Child preferred name and age or age band | Course recommendation and class roster | While the account is active, then 12 months |
| Child interests and experience level | Matching a child to the right course | While the account is active |
| Accessibility and learning notes | Adapting teaching; restricted to assigned staff | While the account is active, deleted on request |
| Attendance and progress records | Reporting to guardians and course quality | 3 years |
| Assignment submissions | Feedback and progress evidence | 2 years, or until deletion is requested |
| Orders, payments and receipts | Fulfilling purchases; legal accounting duty | As required by Lebanese accounting law |
| Audit logs of material actions | Security, dispute resolution, safeguarding | 3 years |
| Support messages | Answering your enquiry | 18 months |
Children's data
A child's profile is created and controlled by their guardian. We ask for the minimum needed to recommend a course, schedule a class and teach it. Children have no public profile and are not discoverable. See our child safety standards.
Who can see what
- • You see everything about your own family, and published progress reports.
- • Assigned instructors see only their assigned students, and never payment amounts or other families.
- • Support staff see contact and booking status to help you reschedule; they cannot publish content or issue refunds.
- • Administrators can see operational records. Sensitive actions are logged with the actor, time and reason.
Processors we use
- • Google Firebase — authentication, database and file storage.
- • The meeting provider shown on your session — live class delivery.
- • An email delivery provider — transactional email only.
We do not sell personal data, and we do not run advertising based on your child's behaviour.
Your rights
You can ask for a copy of your data, correct it, or ask us to delete it. Deletion is available from your account settings and is a real workflow: we remove personal data and retain only the accounting and audit records we are legally required to keep. Consent for optional processing can be withdrawn at any time in your settings.
Security
Access is denied by default and granted per role. Uploaded files are stored privately and served through short-lived links. Material commercial, consent and attendance actions are recorded in an append-only audit log.