In short
BookVu collects only what it needs to run your classes and keep accounts safe. We do not sell personal data and we do not show ads. Class data belongs to the teacher or organization that runs the class. You can ask for a copy of your data, correct it or delete your account at any time.
Who we are
BookVu (bookvu.com) is an online platform for private teachers, tutoring centers and schools in Egypt and the MENA region. It is run from Cairo, Egypt. You can reach us at contact@bookvu.com for anything in this policy.
The two roles BookVu plays
- Your own account. For the details you give us to create and use your account, BookVu decides how they are used.
- Class data. For the data inside a class — students' records, work, grades, attendance, reports and the guardians' details — the teacher or organization that runs the class decides what is collected and why. BookVu stores and processes that data on their behalf and on their instructions. If you are a student or a guardian and want something in a class changed or removed, ask the teacher first. You can also write to us and we will pass your request on.
What we collect and why
| Who | What | Why |
|---|---|---|
| Everyone with an account | Name, email, phone number, gender, role, password (stored only as a one-way hash, never readable), language and theme choices, notification choices, and anything you choose to add to your profile (photo, bio, city, country, date of birth, address, school or university) | To create and run your account, show your name to the people in your classes, and contact you about your account |
| Teachers | Years of experience, how you heard about us, and what you create: courses, organizations, classes, materials, assignments, grades, attendance, announcements, messages and report settings | To run your classes |
| Assistants | The classes you are added to and what you do in them (grades entered, attendance taken, files uploaded) | To run the classes you help with |
| Students | Education level, school, student ID number (if you give one), your guardians' details, the classes you join, the work and files you hand in, your grades and attendance (including QR check-ins), comments, messages and the reports made about you | To take part in your classes and keep your guardians informed |
| Guardians (no account) | Name, relationship to the student, phone, email, whether and how you confirmed the connection, and the reports sent to you | To send you the student's reports by WhatsApp and email |
| Visitors | What you type into the contact form (name, email, optional phone, message), and your email if you join the newsletter | To answer you and send the newsletter you asked for |
| Automatically | IP address, browser and device type, sign-in times and failed sign-in attempts, the devices you signed in from, error reports, and requests that were blocked or limited | To keep accounts safe (new-device emails, lockouts after failed attempts), fix errors and stop abuse |
| If you allow notifications | The push address your browser gives us | To send you notifications |
- Profile photo: we do not use your Google photo. Your account starts with a default picture, and you can upload your own. Your profile photo is visible only to you and to people in your classes.
- BookVu news by email: only if you tick the box for it when you create an account, or join the newsletter on our site. We keep the date, IP address and browser of that choice as the record of your consent. You can stop at any time in Settings → Notifications → Product Updates & Newsletter.
- Camera: used only on your device to scan attendance QR codes. No image is sent to us.
- We do not collect your location or your contacts, and we do not use your microphone.
- We do not sell personal data and we do not show ads.
Signing in with Google
If you choose "Continue with Google", Google sends us your name, email address and Google account ID (the openid, email and profile permissions). We use them only to create your account, sign you in, and link Google to an existing BookVu account with the same email. We do not receive your Google password, and we have no access to your Gmail, Drive, contacts or any other Google data. We do not store your Google profile photo. You can remove BookVu's access at any time at myaccount.google.com/permissions.
BookVu's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
Who can see your data inside BookVu
- The teacher sees everything in their classes: students' and guardians' contact details, work, grades, attendance and reports, and what each student opened, watched and downloaded.
- Assistants see the same for the classes they are added to. What they can change depends on the permissions the teacher gives them.
- Students see their own records, their classes' materials and announcements, and the names and photos of people in their classes where a page shows them (for example in comments and messages).
- Guardians see only the reports sent to them.
- BookVu looks at data only when needed to run, support or secure the service, or when the law requires it.
Outside services we use
| Service | What for | What it receives | Where |
|---|---|---|---|
| Supabase | Database | All account and class data | Germany (EU) |
| Render | Runs our servers | All data passing through the app; short-lived server logs | Germany (EU) |
| Cloudflare | Network security and speed; bot checks on our forms (Turnstile); file storage (R2); forwarding email sent to contact@bookvu.com; visit statistics, only if you accept them | All traffic, including IP addresses; uploaded files; emails you send us | Global network; files stored in Western Europe |
| Resend | Sending email | Recipient name and address, the email's content and attachments (for example a report PDF) | Ireland (EU) |
| WhatsApp (Meta) | Messages to guardians | Guardian's phone number and name, the student's name, the report | Meta's global servers |
| Sign-in with Google; the fonts our pages use; our team inbox (Gmail) that contact@bookvu.com forwards to | Sign-in: as in "Signing in with Google". Fonts: your IP address when a page loads. Inbox: emails you send us | Global | |
| Google Gemini | Writing the short summary in a student report, when AI summaries are on | The student's name and the grade and attendance figures in that report | Global |
| Web push services (Google, Apple or Mozilla, depending on your browser) | Delivering notifications | The push address and the notification, encrypted so the service cannot read it | Global |
| VirusTotal (Google) | Checking uploaded files for malware | Only the file's fingerprint (a SHA-256 hash), never the file | Global |
| Have I Been Pwned | Refusing passwords known from data leaks | The first 5 characters of a hash of the password, never the password | Global |
We choose services that protect data and use them only for the purposes above.
Data stored outside Egypt
Our database and servers are in Germany, in the European Union, whose data protection rules are among the strictest in the world, and some services in the table run on global networks. So your data is stored and processed outside Egypt. We transfer it only as Egyptian law allows. When you sign up you agree to this transfer.
Children and guardians
Students on BookVu range from Year 1 to Year 12 and university.
- The teacher or organization that adds students is responsible for having the approval of each student's parent or guardian before the student uses BookVu.
- On top of that, when a student adds a guardian, we send the guardian a link. By confirming, the guardian agrees to the student using BookVu and to receiving the student's reports. A guardian who does not confirm receives no reports.
- A parent who believes their child is on BookVu without their approval can write to contact@bookvu.com. We will work with the teacher to remove the child's data.
How long we keep data
| Data | Kept |
|---|---|
| Your account and class data | While your account is open |
| A deactivated account | 40 days, then deleted for good (we email you 7 days and 1 day before). Signing in again within the 40 days reopens it |
| Deleting your account now (in Settings, with a code sent to your email) | Deleted at once |
| Sign-in attempts | 30 days |
| Sessions | Until they expire or you sign out (at most 30 days) |
| Devices you signed in from | 1 year after last seen |
| Security and error logs | 30 days |
| Account activity log | 90 days |
| Read notifications | 60 days (unread ones stay until you read or delete them) |
| Email and WhatsApp sending records | 30 to 90 days |
| Contact form messages | 180 days after we reply, otherwise 1 year |
| Newsletter address | Until you unsubscribe |
| Backups | Rolled over within 30 days |
What deleting an account removes:
- A teacher's account takes everything they own with it: their courses, classes, materials, assignments, grades, attendance and reports, including the students' records in those classes. Export what you need first.
- A student's account takes their work, grades, attendance, guardians and reports in every class with it.
- Messages you sent stay in the conversation, without your name.
- Your files are removed from storage right after your account.
Your rights
Under Egypt's Personal Data Protection Law (No. 151 of 2020) you can ask to know what data we hold about you, get a copy of it, correct it, delete it, withdraw a consent you gave, and object to how it is used. You will also be told if a breach affects your data.
- Most of this you can do yourself: edit your profile, change notification choices, unsubscribe from the newsletter, or delete your account in Settings.
- For a copy of your data, or anything else, email contact@bookvu.com from the email address on your account. We may ask you to confirm it is you. For class data, we involve the teacher who runs the class.
- We answer within the time Egyptian law sets.
- You can also complain to Egypt's Personal Data Protection Center.
How we protect data
- Every connection to BookVu is encrypted (HTTPS), and so is the connection between our servers and the database.
- Passwords are stored only as one-way hashes, and passwords known from data leaks are refused.
- Two-step sign-in is available, and its secrets are stored encrypted.
- Private files are kept in private storage and opened through links that expire within minutes.
- Uploaded files are checked for known malware.
- Repeated failed sign-ins lock the account for a while, requests are rate-limited, and you get an email when a new device signs in.
- Who can see or change what is checked on our servers for every request, by role and class.
No system is perfectly secure. If you find a security problem, please tell us at contact@bookvu.com (bookvu.com/.well-known/security.txt). If a breach affects your data, we will tell you and the authorities as the law requires.
Changes to this policy
When we change this policy we publish the new version here with a new date. If a change matters to how your data is used, we tell you before it takes effect: teachers by email, and everyone in the app.