Privacy Policy — Arithlon Schools

1. Operator and contractual context

DEROND VENTURES SRL, registered office at 26A Valea Seacă Street, Valu lui Traian, 907300, Constanța County, Romania, Tax ID (CUI) 55505329, Trade Register J2026052043008, operates the Arithlon platform.

For customer organizations, the specific GDPR roles, processing instructions, responsibilities and any transfers are defined by the applicable agreement and data-protection agreement. This page describes the general product framework and does not replace the customer DPA.

2. Prospect, organization and billing data

• name and professional contact details of the contact person;
• organization name, locations, country/market and contractual configuration information;
• data needed for quotes, orders, invoicing and fiscal reconciliation;
• demo/pilot/enrollment status and related communications.

3. Staff data

• first name, last name and professional email;
• role, organization, locations and access scope;
• authentication data stored/protected cryptographically according to the application architecture;
• relevant security events, audit and operational actions.

4. Student data

The standard operational profile does not request the student’s email, phone number, date of birth, medical data or parent contact details. Generator payloads must not include email, phone, DOB or parent data.

• first name, last name, status and organization/location membership;
• optional external reference;
• group and pedagogical assignments;
• training configurations, answers, results, timing, assessment/Placement and derived progress;
• worksheet results and metadata required by the Generator.

5. Generator and usage data

The system may retain configuration, seed/snapshot needed for deterministic regeneration, generation/job identifiers, authorized actor, location/group/student, output counts, download/redownload, allowance usage and audit events. The usage ledger remains auditable; commercial adjustments are separate entries rather than destructive history rewrites.

6. Commercial and payment data

Arithlon does not collect or store the full card number or CVV. Child data and mathematical results are not sent to the payment processor for profiling or billing.

• orders, products, quantities, terms, currency and PriceBook;
• payment status, Stripe/provider identifiers, invoice/payment identifiers and renewal state;
• required billing details and fiscal document/identifier data;
• refund/chargeback/reconciliation and commercial audit.

7. Purposes

Data is used to provide and administer the service, identity/access and tenant isolation, training and assessment, Generator and reporting, security and abuse prevention, support, contract administration, payments, invoicing/e-Factura, audit and legal compliance. The exact legal basis depends on the contractual relationship and each party’s role and is documented in the agreement/DPA where required.

8. Providers and recipients

Data may be processed, strictly as necessary, by hosting, database, security, email and support providers. Stripe processes data required for card payments on the active channel. FGO and fiscal/RO e-Factura/ANAF systems may receive data required for invoicing and statutory reporting. Providers and mechanisms may differ by market and are controlled contractually before public activation of that market.

9. Tenant isolation and security

Access is restricted server-side by organization/tenant, location, role and pedagogical scope. Sensitive queries and downloads revalidate authorization; a resource identifier alone does not grant access. Relevant security and administrative events may be audited.

10. Retention and deletion

Operational data is retained for the period necessary to provide the service and according to the organization’s contract. On termination, export, return, anonymization or deletion follows the contract/DPA and applicable legal obligations. Commercial, fiscal and audit data may be retained for periods required by law or needed to protect legitimate rights. Backups are removed through their controlled retention cycle.

11. Rights and requests

Requests concerning access, correction, erasure, restriction, portability, objection or other applicable rights may be sent through the Arithlon Schools/contact channel. For data entered by a customer organization, the request may require coordination with that organization depending on the contractually defined roles.

12. Children, advertising and profiling

Arithlon Schools is an institutional product with no advertising; Arithlon Schools is free for the current feature set. Student data is not sold, used for commercial profiling or used for behavioral advertising. Results/assessments are used for training and reporting and do not constitute medical or psychological diagnosis.

13. Sponsored Family privacy boundary

Under the current Sponsored Family model, the organization sees only the commercial status needed for seat/code/activation/expiry and attribution. Private Family progress, results and personal profile do not become visible to the sponsoring organization by default.