Política de privacidad

samipe is a school-operations platform built and run by Nali Consultants LLP. This policy explains what personal information we handle, why, and the choices you have. The key points:

• Schools own their data. When a school uses samipe, the school decides what goes in, who can see it and when it is deleted. We process it only on the school’s instructions.
• We never sell personal information, never use it for advertising, and never build profiles of students.
• Our AI assistant, Sam, runs on a model we host ourselves. Your school’s data is not sent to any third-party AI provider.
• Your data stays in the region your school chooses: the EU, the US or APAC.
• Parents and students only have accounts if the school subscribes to CHIRP. Otherwise samipe is used by school staff only.
• Questions? Contact our Data Protection Officer at dpo@getnali.com.

samipe is provided by Nali Consultants LLP (“Nali”, “we”, “us”). This policy covers our website at samipe.com, the samipe applications (web, desktop and mobile), our AI assistant Sam, and our sales, onboarding and support activities.

If you are a member of staff, a parent or a student at a school that uses samipe, your school’s own privacy notice also applies, and your school is the first place to go with questions about your records.

Data protection law distinguishes between the organisation that decides why and how personal data is used (the controller) and the organisation that handles it on the controller’s behalf (the processor, or “data intermediary” under Singapore’s PDPA). Our role depends on the data:

Most of this policy describes how we handle data as a controller. For School Data, section 7 explains what we do on the school’s behalf.

When you visit our website

• Technical data: IP address, browser and device type, pages viewed, referring page and approximate location derived from your IP address.
• Cookie choices: the consent preferences you set in our cookie banner.
• Analytics data: only if you allow analytics cookies (see section 16).

When you contact us or book a demo

• Your name, work email address, school or organisation, school size, the modules you are interested in, your message and your contact preferences.
• Spam-protection signals from Google reCAPTCHA, which checks that the form is being submitted by a person (see section 16).

When your school uses samipe

• Account data for staff users: name, work email, role, department, permissions, login and authentication records.
• School Data: whatever the school chooses to load into the modules it subscribes to. Depending on the modules, this can include timetables, leave and relief-cover records, duty rosters, room and resource bookings, asset and library loans, CCA participation and awards, attendance, behaviour and merit records, trip and event details, messages to families, and health-office records.
• Parent and student data (CHIRP only): if a school subscribes to CHIRP, parents and students may be given accounts. We then process their name, contact details, the students they are linked to, and the messages, forms and acknowledgements exchanged with the school. If a school does not use CHIRP, only school staff have accounts. Student information is then entered and managed by staff.
• AI assistant data: the prompts users give Sam, the responses it produces and the actions taken through it (see section 6).
• Usage and diagnostic data: feature usage, error logs, performance metrics and audit logs of who did what, and when.

Sensitive information

Some modules can hold sensitive information. MEDIC, for example, can hold health information such as allergies, medication and health-office visits, and MERIT can hold behaviour records. The school decides whether to record this information and remains responsible for having a lawful basis to do so. We protect it as described in sections 9 and 13.

Information from others

Most personal data in samipe is entered by your school, or imported by us during onboarding on the school’s instructions. We may also receive business contact details from event organisers, partners or referrals, and payment confirmations from banks.

Where the EU GDPR applies, we must have a legal basis for each use of personal data. Where Singapore’s PDPA applies, we collect, use and disclose personal data with consent, or where the PDPA otherwise permits (for example, for business improvement or legitimate interests), and only for purposes a reasonable person would consider appropriate.

What we never do: we do not sell personal information, we do not use it for targeted or behavioural advertising, and we do not build profiles of students or use School Data for any purpose other than providing the service to that school.

Sam is an optional add-on that helps users find information and take actions across the samipe modules their school uses, for example drafting a relief-cover plan or summarising a CCA record.

• Self-hosted model. Sam runs on an AI model that we host and operate ourselves. Prompts, responses and School Data are not sent to any third-party AI provider or frontier AI lab.
• Same permissions as the user. Sam can only see and act on data the signed-in user is already allowed to access.
• No training on your data. We do not use School Data, prompts or responses to train or improve AI models for anyone else.
• Stored with your school’s data. Conversation history and actions taken through Sam are stored and deleted like other School Data. They are kept in your school’s hosting region.
• Human review. Sam’s output is generated automatically and can be wrong. We do not use Sam to make decisions that have legal or similarly significant effects on individuals. Staff should check Sam’s output before relying on it, especially for students.

When we process School Data, we act only on the documented instructions of the school, which are set out in its agreement with us and in a Data Processing Agreement (DPA) available on request. In particular, we:

• use School Data only to provide, secure and support the service for that school;
• make sure our staff and sub-processors are bound by confidentiality;
• help the school respond to requests from individuals and regulators;
• tell the school without undue delay if we become aware of a personal data breach affecting its data;
• return or delete School Data when the school’s subscription ends (see section 12).

Each school is responsible for giving its staff, students and families appropriate privacy notices, and for having a lawful basis (including any required consents) for the data it puts into samipe.

samipe is bought, configured and administered by schools. We never deal directly with students to collect their data, except where a school has given students accounts through CHIRP.

Our commitments on student data

• We process student data only to provide the service to the school, and never for advertising, marketing or profiling.
• We never sell student data, and we never disclose it except as the school directs, or as the law requires.
• We do not knowingly collect personal information directly from children, except through CHIRP accounts that the school has set up.

United States: FERPA and COPPA

For US schools, we act as a “school official” with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA). We work under the school’s direct control over how education records are used and maintained. We use them only for the purposes the school authorises and do not re-disclose them except as FERPA permits.

Where the Children’s Online Privacy Protection Act (COPPA) applies to students under 13, we rely on the school to consent on behalf of parents. We use the information collected solely for the school’s educational purposes and for no other commercial purpose. Parents may ask the school to review or delete their child’s information, or to stop further collection, and we will support the school in responding.

EU and Singapore

Schools in the EU remain controllers under the GDPR and decide the lawful basis for processing student data, including any parental consent needed for children. Schools in Singapore are responsible for obtaining consent under the PDPA where required. In both cases we process the data only on the school’s instructions.

Schools using MEDIC (the health-office module) may record health information about students or staff. We treat this as the most sensitive category of data we handle. Access is restricted to roles the school authorises. All access is logged, and it is protected by the controls described in section 13.

• EU: health data is “special category” data under the GDPR. The school must identify an appropriate condition for processing it, and we process it only on the school’s instructions.
• United States: health records kept by schools are usually education records governed by FERPA rather than HIPAA. Where a school or its health provider is subject to HIPAA and uses samipe to hold protected health information, we will sign a Business Associate Agreement and apply the safeguards HIPAA requires.
• Singapore: we apply enhanced protection to health information in line with the PDPC’s guidance on sensitive personal data.

We share personal information only when it is necessary, and only with:

• Sub-processors that help us run samipe and our website. These are cloud hosting and database providers, email delivery providers, messaging providers that deliver the SMS and WhatsApp notifications a school chooses to send, spam protection for our forms, and (only with your consent) website analytics. Each is bound by a written contract that includes confidentiality and data-protection terms. We share only the data each needs to perform its service. Customers can ask us for the current list of sub-processors, and we will notify customers before adding or replacing a sub-processor that processes School Data.
• Your school: if you are a user at a school, administrators at that school can see account and activity information according to the roles they have set.
• Professional advisers such as lawyers, auditors and insurers, under a duty of confidentiality.
• Authorities, where the law requires it. Where the law allows, we will tell the affected school first and disclose only the minimum necessary.
• A successor business if Nali’s business is reorganised, merged or sold. Any successor must honour this policy, and schools will be told in advance.

We do not share personal information with advertisers or data brokers.

Each school chooses where its School Data is hosted: the EU, the US or APAC. School Data, including backups and Sam’s conversation history, is stored in that region. We do not move it to another region without the school’s agreement.

Some processing may still involve access from another country, for example when our support engineers help a school at the school’s request, or for website and enquiry data. Where personal data is transferred out of the EU or Singapore, we protect it:

• From the EU/EEA: we rely on an adequacy decision where one exists, or on the European Commission’s Standard Contractual Clauses, together with any additional safeguards needed.
• From Singapore: we make sure the recipient is bound by legally enforceable obligations giving a standard of protection comparable to the PDPA, as the PDPA’s Transfer Limitation Obligation requires.
• In all cases: access is limited to what the task requires, logged, and protected by the controls in section 13.

We keep personal information only for as long as we need it for the purposes in this policy, or as the law requires.

We use technical and organisational measures appropriate to the sensitivity of school data, including:

• encryption in transit (TLS) and at rest;
• each school’s data kept logically separate from every other school’s;
• role-based, least-privilege access, both for school users and for our own staff;
• audit logging of access to and changes to School Data;
• automated backups, with restores tested regularly;
• confidentiality undertakings and data-protection training for our staff.

No system is perfectly secure, but we work continually to protect yours. For more detail, see our Security & compliance page.

If we become aware of a personal data breach affecting School Data, we will notify the affected school without undue delay. We will give it the information it needs to meet its own obligations, such as notifying a supervisory authority within 72 hours under the GDPR, or within 3 calendar days under the PDPA. Where we are the controller, we will notify regulators and affected individuals ourselves when the law requires.

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate or incomplete data;
• delete your data;
• restrict or object to certain processing, including processing based on legitimate interests and direct marketing;
• data portability: receive your data in a commonly used format or have it sent to another organisation;
• withdraw consent at any time, where we rely on consent. This does not affect processing already carried out.

EU residents have these rights under the GDPR. Singapore residents have rights under the PDPA to access and correct their personal data and to withdraw consent. US residents of states with consumer privacy laws may have similar rights to know, correct and delete, and we will not treat you differently for exercising them. We do not sell or “share” personal information for cross-context behavioural advertising.

How to exercise your rights

If your request is about School Data (for example, you are a teacher, parent or student at a school that uses samipe), please contact your school, because the school controls that data. If you contact us, we will pass your request to the school and help it respond.

For everything else, email dpo@getnali.com. We may need to verify your identity before acting. We respond within one month under the GDPR and within 30 days under the PDPA. If a request is complex, we will tell you if we need longer.

Our website uses a small number of cookies. When you first visit, a banner lets you choose which optional categories to allow. Nothing optional runs until you agree.

Our contact form uses Google reCAPTCHA to protect against spam. reCAPTCHA collects hardware and software information and sends it to Google for analysis. Its use is subject to Google’s Privacy Policy and Terms of Service.

You can change your choices at any time by using the Cookie settings link in the website footer, or by clearing cookies in your browser. The samipe application itself uses only the cookies it needs to keep you signed in and secure.

We send occasional product news and event invitations to business contacts at schools. Where the law requires consent, we ask for it first. Every marketing email includes an unsubscribe link, or you can email dpo@getnali.com. Service messages that you need in order to use samipe, such as security notices or invoices, are not marketing and will still be sent.

If you have a concern about how we handle personal data, please contact our Data Protection Officer first so we can try to resolve it. You also have the right to complain to a regulator:

• EU: the data protection supervisory authority in the country where you live or work, or where the issue occurred.
• Singapore: the Personal Data Protection Commission (PDPC).
• United States: the Attorney General or privacy regulator of your state. For student records, the US Department of Education’s Student Privacy Policy Office.

Nali is established in Singapore and does not have an office in the European Union. We have not yet appointed a representative in the EU under Article 27 of the GDPR. We will publish their details here once appointed. Until then, individuals and supervisory authorities in the EU can contact our Data Protection Officer directly at dpo@getnali.com about any aspect of our processing.

We may update this policy from time to time, for example when we add features or when the law changes. We will update the “Last updated” date at the top of the page. If a change is material, we will notify customers’ administrators by email or in the product before it takes effect. Previous versions are available on request.

For privacy questions, requests or complaints, contact our Data Protection Officer:

For anything else, email hello@samipe.com or use our contact form.