Privacy Policy
Last updated: 12 August 2026
Rang360 is a planning tool for Irish primary school teachers. This policy explains what personal data we collect, why, where it is stored, and the rights you have over it. We've tried to write it in plain English.
The one-line version: Rang360 collects teacher and account data only. We never collect or store any pupil/student data. Your data is stored in the EU (Ireland), protected by row-level security, and we never sell it.
1. Who we are
Rang360 is operated by Rang360 Ltd (the "data controller"), a private company limited by shares registered in Ireland. Rang360 is independent of the NCCA, the Department of Education, and the INTO.
- Company registration number (CRO): 820397.
- Registered address: Venture Hub, 136 Capel Street, Dublin 1, D01 T2C9, Ireland.
- Data protection contact: hello@rang360.ie
For any privacy question or to exercise your rights, email hello@rang360.ie.
2. Data we collect
We only collect data from the teacher using Rang360 - there is no pupil-facing part of the service. The data we hold is:
| Data | Why we hold it | Where it's stored |
|---|---|---|
| Email address | Account identity, login, and essential service emails | Supabase Auth |
| Password | Authentication - stored only as a salted hash, never in plain text | Supabase Auth |
| Your name | Personalisation; printed on your own worksheets and Cuntas Míosúil | Database |
| School name & roll number (optional) | Personalisation; chosen from a public directory of Irish primary schools | Database |
| Class level(s), subjects, months, term-start date | To build your timetable and scheme of work | Database |
| Lesson records, notes, reflections, curriculum tick-offs | The core planning and tracking features | Database |
| Attachments you upload (files/links) | Your own resources, attached to your lessons | Supabase Storage |
| Trial / subscription state & daily worksheet count | To manage your free trial and fair-use limits | Database |
| A one-way salted hash of your email | Trial-abuse prevention only - see section 8 | Database |
| Account created & last sign-in time | Account security | Supabase Auth |
3. Data we never collect
Rang360 is a tool for adult teachers. It has no field for pupil data and we instruct teachers never to enter it.
- No pupil or student personal data of any kind - no names, results, or any child's data. Teachers track curriculum coverage, not individual children.
- No special-category data, biometric data, or location tracking.
- No advertising or marketing trackers, and no ad-network cookies.
- We never sell your personal data to anyone.
4. Why we use your data & our lawful basis
- To provide the service (your account, planning, tracking and Cuntas Míosúil features) - performance of our contract with you.
- To send essential account emails (sign-up confirmation, password reset, email-change confirmation) - performance of our contract.
- To keep the service secure and prevent abuse (including trial-abuse prevention) - our legitimate interests (Art. 6(1)(f) GDPR).
- To moderate uploaded files. Files you upload are stored privately and are accessible only to you in normal use. A small number of authorised Rang360 staff may access uploaded files for safety and moderation purposes - our legitimate interest in keeping the platform safe and lawful (Art. 6(1)(f) GDPR). Files are not used for any other purpose.
We do not use your data for advertising or profiling, and we do not make automated decisions that have legal effects on you.
5. Worksheets
Worksheets in Rang360 come from a pre-generated, teacher-reviewed library served from our own database. Every worksheet is created and reviewed before it ever reaches the app, at support, core and extended levels - nothing is generated while you use the service.
No data is sent to any AI provider when you use a worksheet. The only personalisation is cosmetic: your name is added to the worksheet template when it is displayed - it is never sent anywhere for this purpose.
Earlier versions of Rang360 generated worksheets on demand using Anthropic's Claude API. That has been fully retired: worksheets are now served entirely from our own library and no per-use data is sent to Anthropic at all.
6. Product analytics
We use PostHog (hosted in the EU) on the app and on this website to understand how Rang360 is used so we can improve it - for example, which features teachers use and where errors occur. The setup is deliberately privacy-minimal:
- Pseudonymous. In the app, analytics events are linked to a random account identifier, never to your name or email. On this website there is no account, so events are effectively anonymous page and click counts.
- No content. Events record feature usage as codes and counts. The content of your lessons, notes, files and searches is never sent.
- No recording, no cookies. We do not record your screen, and we use no analytics cookies or advertising identifiers - a small amount of analytics state is kept in your browser's local storage.
- Your choice. You can turn analytics off at any time in Settings → Preferences in the app.
Crashes and errors are reported with technical context (browser and app version) under the same no-content rules. Our lawful basis is our legitimate interest in improving the service (Art. 6(1)(f) GDPR).
7. Who we share data with
We use a small number of trusted service providers ("sub-processors") to run Rang360. Each handles only the data needed for its function, under a data-processing agreement.
| Provider | Function | Data involved |
|---|---|---|
| Supabase | Database, authentication, file storage | All account and teaching data, email, hashed password |
| Vercel | App and API hosting | Request data, IP address, auth token in transit |
| Resend | Account emails (confirmation, password reset, replies to your feedback) and a small number of getting-started and reminder emails, each with a one-click unsubscribe. You can also switch these off in Settings, then Preferences. | Recipient email address and email content |
| PostHog | Product analytics (EU hosting) | Pseudonymous usage and error events tied to a random account id - no names, no emails, no lesson content |
| Stripe (once paid plans launch) | Payment processing | Name, email, payment details - handled entirely by Stripe; card data never reaches our servers |
| Google (if you choose Google sign-in, once enabled) | Optional sign-in | Email, name, profile photo, Google account id |
We'll keep this list current and update it before adding any new sub-processor.
8. Where your data is stored & international transfers
Your data at rest - your account, all your teaching data and uploaded files - is stored in the EU (Amazon Web Services, Dublin, Ireland) via Supabase.
Some functions are handled by US-based providers (Resend for email, certain Vercel serverless functions, and - once enabled - Stripe and Google). Where data is transferred outside the EEA for those specific functions, the transfer relies on Standard Contractual Clauses and/or the provider's own approved transfer mechanism.
9. Trial-abuse prevention
To stop people repeatedly deleting and re-creating accounts to get endless free trials, we keep a server-only record of which emails have already used a trial.
This record stores only a salted, one-way hash of your normalised email address - never the email itself. It cannot be read back into your contact details; it is only used as a yes/no membership check.
Because its whole purpose is to survive account deletion, this hash is deliberately retained after you delete your account. It is the one piece of data not erased on deletion. The lawful basis is our legitimate interest in preventing fraud and abuse (Art. 6(1)(f) GDPR), relying on the erasure exemption in Art. 17(3).
10. Data retention & deletion
- While your account is active, we keep your data to provide the service.
- You can delete everything yourself. Settings → Delete account removes your login, profile and all teaching data - schemes, lessons, records, attachments, lesson plans, Cuntas Míosúil reports, saved worksheets and uploaded files.
- There is also a "Start fresh" option that wipes your teaching data but keeps your account.
- Exception: the salted email hash described in section 8 is retained for abuse prevention.
- Residual copies may persist in encrypted backups for up to 7 days before rotation.
11. Your rights
Under the GDPR and the Irish Data Protection Act 2018 you have the right to:
- Access & portability - much of your data is viewable and exportable in-app (Cuntas Míosúil and worksheet PDFs). For a full copy, email hello@rang360.ie and we'll arrange it. (We don't yet have one-click full export, so this is handled by request.)
- Rectification - your name and email are editable in Settings.
- Erasure - self-service "Delete account" (subject to the section 8 carve-out).
- Restriction & objection - email hello@rang360.ie.
- Complaint - you can complain to Ireland's supervisory authority, the Data Protection Commission.
12. How we protect your data
- Encryption in transit (HTTPS/TLS) and at rest.
- Row-level security on every database table - each teacher can access only their own data.
- Passwords stored only as salted hashes; minimum length enforced and email confirmation required.
- Secrets (API keys) live server-side only and are never exposed to the browser.
- Security headers and an authenticated, rate-limited AI proxy.
13. Children's data
Because Rang360 is used by adult teachers and collects no pupil data, child-specific data rules (such as GDPR Article 8 and the digital age of consent) do not apply to content entered in the app. Schools and parents can be assured no child's data passes through Rang360.
14. Cookies
Rang360 uses no tracking or advertising cookies. Beyond strictly-necessary and functional storage, our cookieless analytics keeps a small amount of state in your browser's local storage (see Product analytics, section 6). See our Cookie Policy for the detail.
15. Changes to this policy & contact
If we make material changes we'll update this page and the "last updated" date, and we may notify you by email. For any question about this policy or your data, contact hello@rang360.ie.