1. Scope and responsible organization
This Policy applies to Students, Teachers, Admins, Sub Admins and visitors using Ravly. The entity acting as controller or business for each relationship is [LEGAL COMPANY NAME / CONTROLLER-PROCESSOR ROLES — CONFIRMATION REQUIRED].
An educational organization may separately control an account or course under its agreement with Ravly.
Back to top2. Information you provide
Depending on your role and enabled features, we collect:
- name, email, phone number, password credentials and verification codes;
- profile, role, invitation and account-recovery information;
- courses, descriptions, chapters, lessons, videos, PDFs, images, library files and folders;
- exam questions, choices, rubrics, assignments, answers, grades and feedback;
- support, security and administrative requests and stated reasons.
Passwords are handled through ASP.NET Identity password hashing; the application data model does not store a plaintext password.
Back to top3. Educational and activity information
Ravly records enrollments, course blocks, lesson access, viewing policies, watched-minute balances, progress, exam attempts, answers, scores, grading status and timestamps to deliver courses and enforce authorized educational rules.
Where a Teacher enables watermarking, selected account details such as a Student’s name, email or phone may be embedded or overlaid in protected PDFs or videos to identify the authorized viewer.
Back to top4. Device, security and technical information
Student security flows process platform and app version, a device-held public key and thumbprint, trusted-device state, integrity or attestation provider/result, session and token timestamps, proof/replay digests, security tier and security-event correlations. Ravly does not need the device’s private key.
When biometric login is enabled, face or fingerprint matching is performed by the operating system. Ravly receives the result and uses a registered public-key credential, not the biometric image or template.
Servers receive ordinary request information such as IP address, timestamps, routes, status and connection data. Security workflows use IP, account and installation correlations for fraud prevention and rate limiting; modeled persisted scopes are digested where specified.
Back to top5. Diagnostics and operational logs
Authenticated Student and Teacher applications may report crashes and failures involving uploads, downloads, processing, playback or document opening. Reports can contain account association, audience, operation/category, safe error type or code, HTTP status, platform, app version and timestamps.
The implemented reporter excludes ordinary validation, cancellation and offline/user outcomes and does not intentionally send free-form error messages, private object paths or signed media links. Admins may review reports for support and repair.
Back to top6. Cookies and local device storage
The web portal stores session tokens and basic account context in browser session storage and the language preference in local storage. The reviewed source contains no advertising cookies or third-party analytics tracker.
The Student app stores protected session/key material in secure storage, preferences locally, and encrypted downloaded PDFs and cache metadata. Temporary readable PDF files are deleted after viewing. Clearing app data or uninstalling does not by itself delete the server account or remove its trusted-device binding.
Back to top7. How we use information
We use information to:
- create, verify, authenticate, secure and administer accounts and trusted devices;
- provide courses, protected media, exams, grading, progress and notifications;
- enforce enrollments, viewing limits, blocks, roles and administrative scope;
- process uploads, generate protected watermarked documents and maintain private media;
- detect replay, abuse, unauthorized access and integrity problems;
- diagnose failures, provide support and maintain service reliability;
- comply with law and protect users, Ravly and third parties.
8. Legal bases
Applicable legal bases depend on the country and relationship with Ravly or an educational organization. Potential bases may include performing a contract, legitimate interests in secure education delivery, consent where requested, and legal obligations. The final mapping is [LEGAL BASES / REGIONAL ANALYSIS — LAWYER CONFIRMATION REQUIRED].
Publishing this Policy does not by itself establish GDPR, CCPA, COPPA or any other statutory compliance.
Back to top10. Service providers and integrations
Confirmed source integrations include Cloudflare R2-compatible private object storage, configured SMTP email delivery and, when enabled, Google identity and Android application-integrity verification. Database and application hosting providers also process data, but Production vendors and regions are [HOSTING / SUBPROCESSOR LIST — CONFIRMATION REQUIRED].
No payment processor, advertising network, analytics SDK or SMS delivery provider was found in the reviewed code.
Back to top11. International data transfers
Providers may process information outside your country. Production hosting locations and transfer safeguards are [HOSTING REGIONS / INTERNATIONAL TRANSFER MECHANISM — CONFIRMATION REQUIRED].
Back to top12. Data retention
We retain account, educational and content information while needed to provide and secure Ravly and for authorized educational or legal purposes. Sessions, one-time challenges, replay protections, upload sessions and rate-limit records use purpose-specific expiries.
Operational client-error events have a modeled 90-day expiry, and security events carry a retain-until time. The complete schedule for accounts, media, exams, server logs, backups and provider copies is [RETENTION / BACKUP DELETION SCHEDULE — CONFIRMATION REQUIRED].
Back to top13. Security
Controls evidenced in source include role/ownership authorization, password hashing, OTP/token digests, proof-bound Student sessions, rotating refresh tokens, replay detection, rate limits, private storage, short-lived media links, encrypted mobile PDF storage and privacy/capture responses.
No storage or transmission method is completely secure. Protect your credentials and device and report suspected compromise to [CONTACT EMAIL].
Back to top14. Your choices and rights
Depending on applicable law, you may request access, correction, deletion, restriction, objection, portability, withdrawal of consent or appeal. Limits may apply where information must be retained or other rights and security protected.
Use available account controls or contact [CONTACT EMAIL]. We may verify identity and authority. Response times, appeals and regulator details are [PRIVACY REQUEST PROCEDURE / AUTHORITY — CONFIRMATION REQUIRED].
Back to top15. Account deletion
Students can request deletion through the authenticated app. The implemented process removes the Student profile and Identity account with linked enrollments, course blocks, viewing state, exam assignments/attempts/answers and active device, session and biometric credentials.
Limited pseudonymous security records, legal records, backups or records controlled by an educational organization may remain where permitted or required. Teacher, Admin and Sub Admin deletion and content retention are [OPERATOR ACCOUNT DELETION PROCESS — CONFIRMATION REQUIRED].
Back to top16. Children’s privacy
The source does not establish a minimum age or verified parental-consent workflow. Intended use by children, schools or guardians is [CHILD USER / SCHOOL / PARENTAL CONSENT POLICY — CONFIRMATION REQUIRED]. Ravly must not be represented as COPPA compliant without separate legal and operational review.
Back to top17. Changes to this Policy
We may update this Policy for product, legal or operational changes. The page will show the effective date, and material notice or consent will be provided where required.
Back to top18. Contact us
Privacy questions and requests may be sent to [CONTACT EMAIL] or [LEGAL COMPANY NAME], [BUSINESS ADDRESS]. DPO or representative details are [DPO / REPRESENTATIVE — IF REQUIRED].
Back to top