Transcripta Transcripta

Legal

Privacy Policy

Draft — pending legal review. This describes how Transcripta actually works today, but it is not legal advice and has not yet been reviewed by a lawyer. Because Transcripta stores data belonging to minors, this should be checked against Jamaica's Data Protection Act (2020) — and any other jurisdiction's laws that apply to a given school — before being relied on as final. Last updated September 6, 2026.

1. Who this applies to, and who controls the data

Transcripta is a tool that schools use to manage student transcript data. In legal terms: the school is the data controller — the school decides what student information to enter and is responsible for having the right to collect and use it (e.g. under existing consent from parents/guardians for school administrative purposes). Transcripta acts as a data processor — we store and process that data on the school's behalf, under the school's instructions, and do not sell it, share it with other schools, or use it for any purpose the school hasn't directed.

If you are a parent, guardian, or student with a question about data held in Transcripta, the right first contact is your school, not Transcripta directly — the school controls that data and can act on your request.

2. What data we collect

Student data, entered by school staff:

  • Name, address, date of birth
  • Enrollment dates and prior school attended
  • Grades, GPA calculations, and CSEC/CAPE exam results
  • Extra-curricular activities, positions/offices held, and conduct/attendance/punctuality notes
  • Report card photos, if a staff member uses the photo-reading feature — see Section 4 for how these are handled

Account data, for school staff who sign in:

  • Name and email address
  • Login timestamps and basic usage activity, for security purposes

We do not knowingly collect data directly from students — all data entry is performed by school staff on the student's behalf.

3. How data is stored

Student and account data is stored using Supabase, a third-party database provider, hosted on their infrastructure. Every school's data is isolated from every other school's using database-level access rules (row-level security) — one school's staff cannot see another school's students, even though all schools share the same underlying database infrastructure.

Word document exports and photo uploads are processed in your own browser and are not stored on Transcripta's servers beyond what's needed to generate the export.

4. The AI-assisted features (report photo reading, natural-language edits)

These features are optional and only activate if a staff member adds their own Anthropic API key in Settings. When used:

  • A report card photo, or a typed instruction, is sent directly from the staff member's browser to Anthropic (the AI provider) — using their own API key, not a key belonging to Transcripta.
  • Transcripta's own servers (there are none in this data path) never see or store this content — it goes browser-to-Anthropic directly.
  • Anthropic's own privacy policy and data handling terms govern what happens to that data on their end; we encourage reviewing Anthropic's privacy policy before enabling this feature for a school that wants clarity here.

If Transcripta later offers AI features bundled into the service directly (rather than requiring a staff member's own key), this policy will be updated to reflect that Transcripta itself processes that data, and this section will change accordingly.

5. Who else sees this data

  • Supabase — our database and authentication provider (see Section 3)
  • Anthropic — only for the specific photo or instruction a staff member submits, and only when the optional AI features are in use (see Section 4)
  • Vercel — our hosting provider, which serves the application itself but does not have access to student data stored in the database
  • We do not sell student or staff data, and do not share it with any other party for advertising or marketing purposes.

6. Data retention and deletion

Student data remains stored until the school removes it or the school's account is closed. A school administrator can delete an individual student's record at any time from within the application. To request full deletion of a school's account and all associated data, contact [email protected].

7. Security measures in place

  • Every school's data is isolated from every other school's via database-level access rules, not just application logic
  • Account passwords are never stored by Transcripta directly — they are handled entirely by our authentication provider (Supabase) using industry-standard practices
  • Rate limiting is in place to reduce the risk of automated abuse

No system is perfectly secure, and we cannot guarantee absolute security of any data transmitted or stored.

8. Children's data

Transcripta stores data belonging to minors (students), entered and managed by school staff acting in their administrative capacity, not collected directly from children. Schools are responsible for ensuring they have appropriate authority (e.g. under existing parental/guardian consent for school administrative records) to enter and manage this data.

9. Your rights

Depending on your jurisdiction, you (or your school, on your behalf) may have rights to access, correct, or request deletion of personal data. For Jamaica-based schools, this includes rights under the Data Protection Act, 2020. Requests should go through your school, as the data controller; your school can then contact us at [email protected] to action any request that requires our involvement.

10. Changes to this policy

We may update this policy as Transcripta's features change — particularly if AI features move from "bring your own key" to a bundled service (see Section 4). Material changes will be communicated to school administrators.

11. Contact

Questions about this policy: [email protected]