Privacy and Personal Data Protection Policy

Last updated: June 9, 2026 · Effective June 9, 2026

SOLUCIONES INTEGRALES DE SOFTWARE SOLINTSOFT TECHNOLOGIES S.A.S. (“Solintsoft”, “we” or “the Company”) operates colegy, an education platform for K-12 schools in Ecuador, available as a website, a web application and a mobile application. This Policy describes how we process personal data when providing the service, in compliance with Ecuador's Organic Law on the Protection of Personal Data (LOPDP), its Regulation and other applicable rules.

1. Data controller and processor

colegy is a service that schools contract to manage academics, communicate with families and run live classes. In this context:

• The school that contracts colegy is the data controller for the personal data of its community (students, parents/guardians and staff), as it determines the purposes and means of processing.
• Solintsoft acts as a data processor, processing that data on behalf of and following the instructions of the school, under contractual confidentiality and security obligations.

Company details:

• Legal name: SOLUCIONES INTEGRALES DE SOFTWARE SOLINTSOFT TECHNOLOGIES S.A.S.
• Tax ID (RUC): 0993407398001
• Email: contact@solintsoft.com
• Phone: +593 98 525 9950

To exercise rights over student or family data, we recommend contacting the relevant school first, as the data controller. You may also write to contact@solintsoft.com and we will forward or handle the request within the timeframes set by the LOPDP.

2. Scope

This Policy applies to personal data processed through the website (colegy.co), the web application (app.colegy.co and each school's subdomain) and the colegy mobile app, as well as support communications. It does not apply to third-party sites or services linked from the platform, which are governed by their own policies.

3. Personal data we process

• Identification and contact: first and last names, user identifier, email and, where applicable, phone, of teaching and administrative staff, parents/guardians and students.
• Credentials and account: sign-in identifiers managed through our identity provider, role within the school and activity logs needed to provide the service.
• Academic data: school, course, subjects, terms, grades, attendance, schedules and the associated history.
• Communications: chat messages between teachers and families, reactions and the attachments users choose to share.
• Live-class audio and video: during video calls, the image and sound that the user enables through their device's camera and microphone are transmitted.
• Resources and files: documents, images or other materials users upload to the platform.
• Technical and device data: IP address, device identifier and type, and the push notification token, related to the security and operation of the service.

4. Purposes of processing

• Provide, maintain and operate the education platform for the school.
• Manage academics: enrollment, courses, grades, attendance and schedules.
• Enable communication between the school, staff and families.
• Offer live classes via video call.
• Provide the AI assistant to query academic information in natural language.
• Send operational notifications related to academic activity.
• Ensure platform security and prevent misuse.
• Comply with legal obligations and requests from competent authorities.

5. Legal basis

Processing is based, as applicable, on the grounds set out in the LOPDP:

• Performance of the contract between Solintsoft and the school, and the school's relationship with its community.
• Consent of the data subject or, for minors, of their legal guardian, obtained by the school where applicable.
• Compliance with legal obligations applicable to the school and the Company.
• Legitimate interest, in particular for information security and the prevention of misuse.

6. Minors

colegy is aimed at K-12 schools, so it necessarily processes data of children and adolescents. This data is processed under the authority and instructions of the school and, where applicable, with the consent of legal guardians obtained by the school.

• We apply data minimization: we only process data needed for the educational purpose.
• We do not use minors' data for advertising nor share it for third-party advertising, and the platform shows no ads.
• Access to a student's data is limited to the school, authorized staff and their guardians, according to role.

7. Processors and third parties

To provide the service we rely on providers acting as processors or sub-processors on behalf of Solintsoft, under contractual confidentiality and security obligations:

• Cloud infrastructure provider (Amazon Web Services): secure hosting and storage of the platform, databases and files.
• Live-class provider (LiveKit): audio and video transmission during video calls.
• AI assistant provider (Anthropic — Claude): processes the assistant's natural-language queries to generate answers. Only the information needed to answer the query is sent, and the content is not used to train models.
• Push notification provider (Expo): delivery of notifications to the mobile app.

We do not sell or transfer personal data to third parties for commercial purposes unrelated to those described here.

8. International transfers

Some of our providers process data on servers located outside Ecuador (for example, in the United States). In such cases we adopt the safeguards required by the LOPDP so that the transfer maintains an adequate level of protection.

9. Data retention

We retain personal data for as long as the relationship with the school lasts and for the periods needed to meet legal and contractual responsibilities. When that relationship ends, data is deleted or anonymized, except where we must retain it by law. The school, as controller, may request the return or deletion of the data as agreed.

10. Your rights

As a data subject — or their legal guardian, in the case of minors — you have the right to:

• Access your personal data and information about its processing.
• Rectification and update of inaccurate or outdated data.
• Erasure or deletion, where applicable.
• Objection to processing in the cases provided by law.
• Portability of your data in a structured format.
• Not to be subject to decisions based solely on automated processing that produce legal effects.

Since the school is the data controller, requests about academic or student data are usually channeled through it. You may also write to contact@solintsoft.com proving your identity; we will handle your request within the timeframe set by the LOPDP.

11. Complaints to the supervisory authority

If you believe the processing of your data does not comply with the law, you may file a complaint with Ecuador's Superintendency for the Protection of Personal Data, without prejudice to any other remedies available to you.

12. Information security

We apply reasonable technical and organizational measures to protect personal data against unauthorized access, loss or alteration, including encryption of communications (TLS), role-based access control and authentication through an identity provider.

13. Mobile app permissions

The colegy mobile app requests the following device permissions, always for a specific purpose and with the operating system's prior consent:

• Camera: join live classes with video and attach photos or documents.
• Microphone: join live classes with audio and send voice notes, where available.
• Storage / files: select and attach documents and images.
• Bluetooth: allow the use of headphones or audio devices during live classes.
• Notifications: receive academic alerts and messages.

You can revoke these permissions at any time in your device settings; some features may stop working.

14. Changes to this Policy

We may update this Policy to reflect legal or operational changes. The current version will always be the one published on this page, with its update date.