Your information matters.

Information we collect

We may collect information needed to create accounts, provide the Thorlus service, communicate with users and keep the service secure. This can include:

• Account information such as name, username, email address and account credentials.
• School information such as school name, contact details, academic information and configuration.
• Information entered by authorised school users about students, staff, attendance, fees, assessments, messages and other school operations.
• Technical and security information such as IP addresses, browser information, request information and security events when needed to protect the service.
• Messages and files that users choose to submit through features that support them.
• Payment or billing information needed to manage a school's subscription or payment records. Where a third-party payment provider is used, that provider may separately process payment information under its own terms and privacy policy.

How we use information

We use information to operate, maintain and improve Thorlus. This includes providing school management features, authenticating users, processing requests, sending service communications, maintaining records, preventing abuse and investigating security incidents.

We may also use aggregated or de-identified information to understand service usage and improve the product, where that information does not identify an individual.

School data

Schools and their authorised users control the school information they enter into Thorlus. A school should only provide information it is authorised to collect and use and should give staff appropriate access based on their responsibilities.

Thorlus processes school data to provide the service and to perform actions requested by authorised users. Schools remain responsible for the accuracy of information they enter and for their own legal and organisational obligations concerning that information.

When information may be shared

Thorlus does not sell personal information. We may share or disclose information when necessary to provide the service, for example with service providers that help us operate hosting, storage, email, security or other infrastructure, subject to appropriate controls.

We may also disclose information where required by applicable law, to protect the rights or safety of users or the service, or as part of a business transfer such as a merger, acquisition or sale of assets.

Security

We use technical and organisational measures intended to protect information against unauthorised access, loss, misuse or alteration. These measures can include authentication controls, access restrictions, secure connections, logging and other security practices.

No internet service can guarantee absolute security. Users should protect their passwords, use appropriate access permissions and notify Thorlus promptly if they believe an account has been compromised.

Retention

We retain information for as long as reasonably necessary to provide the service, meet operational and legal requirements, resolve disputes, enforce agreements and maintain appropriate security records. Retention periods can differ depending on the type of information and the purpose for which it is processed.

Cookies and similar technologies

Thorlus may use cookies and similar technologies that are necessary for authentication, security, session management and website functionality. We may also use limited analytics or measurement technologies to understand how the public website is used.

Your choices and requests

Depending on the information involved and applicable requirements, users or schools may request access to, correction of or deletion of information. School-managed records should normally be handled through the school's authorised administrators because the school controls the information it enters into the service.

For privacy questions or requests, use the support contact associated with your Thorlus account or school.

Changes to this policy

We may update this Privacy Policy as the service, technology or legal requirements change. The latest version will be published on this page with its updated date. If a change is material, we may provide additional notice where appropriate.