Privacy Policy

Spoteca ("Spoteca", "we", "us", or "our") is a management platform for schools and academies that teach through lessons and classes — music, dance, arts, languages, tutoring, sports and more. It is operated by Hawa Music SAL, registered in Lebanon, with offices at Mkales Roundabout, Sin el Fil, Lebanon.

This Privacy Policy explains what personal data we collect when you use spoteca.com, why we collect it, who else handles it, how long we keep it, and your rights. By creating a Spoteca account or using the platform, you agree to this policy.

Age requirement: Staff accounts (owner, administrator and teacher roles) may only be created by people aged 18 or older. Students and guardians get accounts from their school. Schools are solely responsible for obtaining appropriate parental or guardian consent before entering personal data about minor students.

• School operators — the person or organisation who registers a school on Spoteca (the "subscriber").
• Staff — owners, administrators and teachers with accounts at a school.
• Students and guardians — people whose records a school keeps on Spoteca, whether or not they have signed in.
• Visitors — anyone browsing our public website or booking a support call.

2.1 When a school signs up

• School name, address, country, phone number, timezone and email address.
• The owner's name, username, email and password. Passwords are stored only as a one-way bcrypt hash — we cannot read them.

2.2 What a school records about its people

A school decides what to enter. Depending on how it uses Spoteca, that can include:

• Students: name, username, email, phone and WhatsApp availability, address, date of birth, gender, nationality, city, school or occupation, grade, photo, level, subjects and plans, start date, emergency contact name and phone, medical notes and allergies, how they heard about the school, tags, internal notes and any custom fields the school defines.
• Guardians: name, relationship to the student, phone, email and address.
• Teachers: name, username, email, phone, address, photo, subjects, biography, CV, weekly availability, and pay arrangements (per-lesson rates or salary).
• Learning records: attendance, lesson notes and their attachments, assessments, skills, repertoire, practice logs, reports, ratings students give their teachers, and private notes staff keep about a student.
• Money: the school's invoices to students, payments, instalments, refunds and discounts, its payments to teachers, and its expenses.

Spoteca handles this data on the school's behalf — see section 9.

2.3 What the platform records as it is used

• Schedules, lessons, group classes, reschedules and cancellations.
• Messages and announcements sent between users inside Spoteca, and in-app notifications.
• Your language and timezone preferences.
• Sign-ins by staff (owners, administrators and teachers): the date, time, IP address and browser, kept for security. Student and guardian sign-ins are not recorded.
• An audit log of significant actions — who did what, and when — for accountability.
• Emails we send: the recipient, subject, type of email and whether it was delivered to the mail server. The content of the email is not stored.
• Push notification addresses for devices where you allowed notifications.
• Questions asked to Ask AI, the in-app help assistant, together with its answers, your role and your school.
• Support call bookings: your name, email, timezone, the time you chose and what you wrote you would like to cover.

2.4 Our records about your school's account

Your plan and billing status, monthly enrolment counts, the invoices we issue you and payments received, and — if you add one — a card for your subscription. A card is handled entirely by our payment gateway; we keep only a reference token and never the card number.

• To run the service for your school: schedules, lessons, attendance, billing and communication.
• To send service emails: account and password emails, invoices and receipts, reminders, and notices about your account. These cannot be switched off while you have an account.
• To help you get started: a small number of onboarding emails to schools that have not finished setting up, including an offer of a free one-hour setup call. Reply to any of them and we will stop.
• To send push notifications such as lesson reminders, on devices where you enabled them. Turn them off at any time in your browser or device settings.
• To bill your school for Spoteca, based on the enrolments and class places that had a lesson each month. See section 9.
• To support your school. Our staff see which schools are active and how far each has got with setup, so we can offer help. When you ask for support, authorised staff may view your school as an administrator would — see our Terms, section 7. Every such session is logged.
• To answer help questions through Ask AI, and to review its answers so we can correct wrong ones.
• To keep the platform secure and to investigate faults and misuse.
• To comply with the law where Lebanese law or a lawful authority requires it.

We do not sell your data, and we do not use it for advertising.

We use the following providers, and share only what each needs to do its job:

We do not share your data with advertisers, data brokers, or any other third party not listed above, except where the law requires it.

About Ask AI: its answers are written automatically and can be wrong. Treat them as guidance, not as a statement of how your account is set up; when in doubt, contact us.

• Your data is stored in the United States — our database is hosted by SiteGround in Virginia — and processed there by the providers listed in section 4.
• All connections to Spoteca use encrypted HTTPS.
• Passwords are stored only as bcrypt hashes and are never stored or sent in plain text.
• Sign-in sessions are encrypted and kept in secure, HttpOnly cookies.
• Each school's data is separated from every other school's, and access to production data is limited to authorised Spoteca staff.
• Password-reset and email-confirmation links are single-use and expire; we do not keep copies of them.

No system is completely secure. We take reasonable measures to protect your data but cannot guarantee absolute security. If we become aware of a breach affecting your data, we will tell you without undue delay.

• While your account is open, we keep your school's data, including sign-in records, the email log and Ask AI questions.
• When an account is deleted, it is held for 30 days so it can be restored if the deletion was a mistake, then permanently erased.
• Unused free accounts (from 2 October 2026): if a school on the free plan has not signed in or used Spoteca for 90 days, we may close it. We will email the owner at least 14 days beforehand, and signing in during that time keeps the account. A closed account is then deleted as above.
• Suspended or unpaid accounts are kept while suspended. If an account stays suspended for 90 days, we may delete it after notice.
• Our billing records— the invoices we issue schools, payments received, and the monthly record of what each invoice was for — may be kept for up to 7 years where accounting law requires it. When a school is deleted, the breakdown naming its students is deleted with it; what we keep is the school's name, the month, the number of places billed and the amount. See section 9.

• Access: ask for a copy of the personal data we hold about you.
• Correction: correct inaccurate data. You can change your own name, email, phone, address and photo at any time under My account.
• Deletion: ask for your personal data to be deleted. Deleting a school deletes its whole workspace.
• Portability: a school owner can export the school's data at any time, as Excel, from the Super Admin panel.
• Objection: object to certain uses of your data, including onboarding emails.

If you are a student, guardian or teacher, your school controls your records. Please contact your school first; we will help them respond.

To exercise any of these rights, email support@spoteca.com. We will respond within 30 days.

Many schools on Spoteca teach children, so students under 18 often have records — and sometimes accounts — at their school. That data is entered and controlled by the school, which must have the consent of a parent or guardian. We use it only to provide the service to that school. We do not run analytics or advertising on any page students or guardians use.

When a school enters personal data about its teachers, students or guardians, the school is the data controller for that data and Spoteca acts as its data processor. We process it only to provide the service, on the school's instructions.

Schools are responsible for:

• having a lawful basis for collecting and processing their people's data;
• telling students, teachers and guardians that their data is managed on Spoteca;
• obtaining parental or guardian consent before entering data about minors;
• handling sensitive information — such as medical notes — with care, and only when needed;
• complying with the data-protection laws of their own country.

One exception — our own billing.To charge your school for Spoteca, we record each month the enrolments and class places that had a lesson, including the student's name, the subject or class, and how many lessons it had. For that record we act as controller rather than as your processor, because it is the evidence behind an invoice we issue to you and we are required to keep it.

You can see it in full on your own Billing page, which is why we keep it: so you can check exactly what you are paying for. It is never shown to another school, and it never appears on any document that leaves Spoteca — the invoice we send you carries the number of places and the amount, never a student's name. If your school is deleted, this breakdown is deleted with it and only the figures remain (section 6).

• Sign-in cookies keep you signed in and protect forms against forgery. They are strictly necessary.
• A language cookie remembers the language you chose, for up to a year.
• Browser storage remembers small interface choices, such as whether the menu is collapsed. It never leaves your device.
• Google Analytics cookies are set on our public website only, and only after you choose "Accept" in the banner. They are never used inside school portals. Your choice is remembered in your browser; clear your browser storage to be asked again.

We do not use advertising cookies, Meta Pixel or any other tracking pixel.

Spoteca is operated from Lebanon and used by schools in many countries. By using it, you understand that your data is stored and processed in the United States (see section 5). Where the law of your country gives you additional rights, we will honour them.

We may update this policy. For changes that reduce your rights or change how we use your data, we will email school owners at least 14 days before the change takes effect. Corrections and additions that do not reduce your rights take effect when published. The date at the top of this page always shows the latest version.

For questions about this policy or your data: