In short
- OstadTools only collects the data needed to run the teachers' tools.
- Students' data belongs to the teacher and is never sold, rented or used for advertising.
- Photos of test papers are analysed on our own server: they are not sent to any external artificial intelligence service.
- A teacher never sees another teacher's students, tests or results.
- You can access, correct, export or ask for the deletion of your data.
Data controller
- For teacher accounts (registration, subscription, messages): OstadTools, Morocco — admin@ostadtools.com.
- For students' data entered by a teacher: the teacher (or their school) decides how it is used; OstadTools processes it on their behalf, as a processor, only to provide the service.
This processing complies with Moroccan law No. 09-08 on the protection of individuals with regard to the processing of personal data.
Data processed
Teachers
- Identity and contact: name, e-mail address, phone (optional), password (stored as a hash, never readable).
- Professional profile: school, academy, directorate, subject, cycle, type of school, header logo.
- Subscription: chosen pack, dates, declared payments and uploaded transfer receipt.
- Usage: log of important actions (sign-in, saving, export) for security and support.
- Google sign-in (if you use it): name, e-mail and Google account identifier.
Students (entered by the teacher)
- First and last name, Massar code, class, position in the class.
- Answers, marks, validations, absences.
- Photos of test papers taken during grading, and printed student QR codes.
Website visitors
- Technical data needed to run the site (IP address in server logs, chosen language).
- Audience measurement, only if it is enabled and you accept it (see the cookie policy).
Purposes
- Create and manage the teacher account, approve registrations, manage subscriptions.
- Provide the tools: grade test papers, compute marks and validations, produce reports and Massar exports.
- Answer messages and provide support (e-mail, WhatsApp, platform messaging).
- Send notifications useful to the service (end of subscription, new tool); information e-mails can be turned off in the profile.
- Secure the platform and prevent abuse.
Data is never used for targeted advertising and is never sold.
Legal basis
Processing is based on providing the service requested by the teacher (account creation, Terms of Service), on consent for audience measurement and information e-mails, and on legitimate interest for security.
Recipients
- The teacher who owns the account (and the phone they paired themselves during a grading session).
- The OstadTools team (administrator, managers) for account approval, payments and support — only as far as necessary.
- Our technical providers: hosting (Hostinger International Ltd. (hostinger.com)), e-mail delivery service, Google if you use Google sign-in, audience measurement tools if you accept them.
No student data is passed on to third parties other than these technical providers, except where required by law.
Photos of test papers
Photos are stored outside the public part of the website and can only be accessed by the account owner. The analysis (detecting ticked boxes, reading the QR code) is done by a service installed on our server. Each teacher sets how long photos are kept (by default 365 days) and can delete them; saved marks are kept.
Retention
- Teacher account and students' data: as long as the account is used, then deleted after the account is closed (technical backups erased within 30 days at the latest).
- Photos of test papers: for the period chosen by the teacher.
- Payments and invoices: for the period required by accounting and tax rules.
- Technical logs: a few months at most.
Security
Encrypted connection (HTTPS), hashed passwords, strict per-account access control, protection against common attacks (CSRF, injection, rate limiting), daily backups, restricted and logged administrative access.
Your rights
Under law No. 09-08 you have the right of access, rectification, objection and deletion. You can change your information in your profile, export your results (Excel / CSV) and ask for your account to be deleted: see data deletion.
A student or their parents who wish to exercise their rights should first contact the teacher or the school; we help them answer the request.
To exercise your rights: admin@ostadtools.com. You may also contact the CNDP (Moroccan data protection authority, www.cndp.ma).
Minors
The platform is intended for teachers. Students have no account and do not access it directly.
Changes
This policy may be updated; the date of the last update is shown at the top of the page.