Privacy Policy & Data Protection
Auto Timetable Generator is built specifically for academic institutions. We treat school schedules, faculty rosters, and classroom configurations with the highest standards of confidentiality, encryption, and regulatory compliance.
Zero Student PII
We never ask for or store student names, social security numbers, birth dates, or home addresses. Only cohort labels are processed.
AES-256 Encryption
All institutional records and timetable entries are encrypted in transit via TLS 1.3 and at rest with AES-256 cloud encryption.
FERPA & GDPR Rights
Full data portability, complete access on demand, and instant data deletion rights under GDPR Article 17 and FERPA.
1. Data Controller vs. Data Processor
Under global privacy frameworks including the General Data Protection Regulation (GDPR) and institutional guidelines:
- Data Controller: Auto Timetable Generator Technologies acts as Data Controller for account credentials, subscription information, and administrative account holder emails.
- Data Processor: The subscribing educational institution is the Data Controller of its own institutional schedules, courses, teachers, and classroom data. Auto Timetable Generator acts strictly as Data Processor, operating solely under the instructions of the institutional administrator.
2. Information We Collect (Data Minimization Pledge)
We practice strict data minimization. We collect only the information strictly required to authenticate administrators and execute constraint-based timetable generation:
| Category | Data Points Collected | Purpose & Lawful Basis |
|---|---|---|
| Account Information | Administrator name, institutional email address, hashed password. | Contract fulfillment (account authentication and security). |
| Faculty Records | Teacher names, work email, department, maximum weekly periods, availability preferences. | Constraint satisfaction solver inputs. |
| Curriculum & Facilities | Course titles, subject codes, weekly period counts, room names, room capacities, room tags. | Timetable matrix allocation. |
| Student Cohorts | Group labels only (e.g., "Grade 10-A", "CSE Section B"). No individual student PII. | Schedule clash prevention. |
Notice: We never collect or store student personal identification numbers, dates of birth, home addresses, guardian contacts, or biometric data.
3. Children's Privacy (COPPA & GDPR-K Compliance)
Our software is designed for use exclusively by adult school administrators, timetable committees, department chairs, and educators (18 years of age or older). We do not market to children under 16 or knowingly collect information directly from minors. In K-12 institutional deployments, all cohort scheduling is conducted through administrative accounts under school authority in accordance with FERPA and COPPA.
4. Third-Party Subprocessors & Infrastructure Audit
We maintain strict oversight of third-party service providers. All subprocessors have been vetted for SOC 2, ISO 27001, or GDPR compliance:
| Subprocessor | Role / Service Provided | Data Location | Compliance / Security |
|---|---|---|---|
| Neon Serverless (PostgreSQL) | Encrypted relational database hosting | AWS US-East Region | SOC 2 Type II, ISO 27001 |
| Amazon Web Services (AWS) | Asynchronous solver execution (Lambda) & S3 document storage | AWS US-East Region | SOC 1/2/3, ISO 27001, HIPAA eligible |
| Dodo Payments | PCI-DSS Level 1 compliant billing & checkout | Global / US | PCI-DSS Level 1 certified |
| Google Analytics | Aggregated anonymous usage metrics (Opt-in only) | United States | IP Anonymization enabled |
| Zoho Campaigns | Transactional & opt-in newsletter notifications | United States | CAN-SPAM & GDPR compliant |
5. Data Retention & The Right to Erasure
We retain institutional timetable records only as long as an organization maintains an active subscription or account. School administrators may exercise full control over their institutional records at any time:
- Data Export: Export your complete schedules, teacher rosters, and room maps to Microsoft Excel (.xlsx), CSV, and PDF at any time with zero data lock-in.
- Right to Erasure (GDPR Art. 17): Submit an automated erasure request via our Data Deletion Request Portal. Upon verified request, all organization databases, solver logs, and backup references are permanently scrubbed within 30 days.
6. Cookies & User Tracking
We use strictly necessary session cookies for security authentication and organization context. Optional analytics cookies require your explicit consent via our banner. Review our full Cookie Policy to inspect individual cookie identifiers and learn how to revoke consent at any time.
7. Privacy Officer Contact Details
For questions regarding our privacy practices, FERPA compliance documentation, or Data Processing Agreements (DPA), contact our Data Protection Officer directly:
Auto Timetable Generator Technologies
Attn: Data Protection Officer
Email: contact@autotimetablegen.com
Operating Hours: Monday – Friday, 9:00 AM – 6:00 PM UTC+5:30
Response Time: Within 24–48 hours for all verified academic data requests.