Privacy Policy
Last updated: 9 July 2026
Rang360 is a planning tool for Irish primary school teachers. This policy explains what personal data we collect, why, where it is stored, and the rights you have over it. We've tried to write it in plain English.
The one-line version: Rang360 collects teacher and account data only. We never collect or store any pupil/student data. Your data is stored in the EU (Ireland), protected by row-level security, and we never sell it.
1. Who we are
Rang360 is operated by Rang360 Ltd (the "data controller"), a private company limited by shares registered in Ireland. Rang360 is independent of the NCCA, the Department of Education, and the INTO.
- Company registration number (CRO): 820397.
- Registered address: Venture Hub, 136 Capel Street, Dublin 1, D01 T2C9, Ireland.
- Data protection contact: hello@rang360.ie
For any privacy question or to exercise your rights, email hello@rang360.ie.
2. Data we collect
We only collect data from the teacher using Rang360 - there is no pupil-facing part of the service. The data we hold is:
| Data | Why we hold it | Where it's stored |
|---|---|---|
| Email address | Account identity, login, and essential service emails | Supabase Auth |
| Password | Authentication - stored only as a salted hash, never in plain text | Supabase Auth |
| Your name | Personalisation; printed on your own worksheets and Cuntas | Database |
| School name & roll number (optional) | Personalisation; chosen from a public directory of Irish primary schools | Database |
| Class level(s), subjects, months, term-start date | To build your timetable and scheme of work | Database |
| Lesson records, notes, reflections, curriculum tick-offs | The core planning and tracking features | Database |
| Attachments you upload (files/links) | Your own resources, attached to your lessons | Supabase Storage |
| Generated worksheet content | Cached so the same worksheet isn't regenerated | Database |
| Trial / subscription state & daily worksheet count | To manage your free trial and fair-use limits | Database |
| A one-way salted hash of your email | Trial-abuse prevention only - see section 8 | Database |
| Account created & last sign-in time | Account security | Supabase Auth |
3. Data we never collect
Rang360 is a tool for adult teachers. It has no field for pupil data and we instruct teachers never to enter it.
- No pupil or student personal data of any kind - no names, results, or any child's data. Teachers track curriculum coverage, not individual children.
- No special-category data, biometric data, or location tracking.
- No advertising or marketing trackers, and no ad-network cookies.
- We never sell your personal data to anyone.
4. Why we use your data & our lawful basis
- To provide the service (your account, planning, tracking and Cuntas features) - performance of our contract with you.
- To send essential account emails (sign-up confirmation, password reset, email-change confirmation) - performance of our contract.
- To keep the service secure and prevent abuse (including trial-abuse prevention) - our legitimate interests (Art. 6(1)(f) GDPR).
We do not use your data for advertising or profiling, and we do not make automated decisions that have legal effects on you.
5. AI worksheet generation
When you generate a worksheet, Rang360 sends a prompt to Anthropic's Claude API through a secure server-side proxy (the API key is never exposed to your browser). The prompt contains only generic curriculum content - the topic/theme, differentiation level and worksheet type.
No pupil data and no teacher personal data is sent to the AI. Your name is only added to the printed worksheet on your own device as a cosmetic footer - it is never part of the AI prompt. Anthropic does not use API data to train its models by default.
We plan to move to pre-generated, pre-reviewed worksheets served from our own database. Once that change ships, no per-use data will be sent to Anthropic at all.
6. Who we share data with
We use a small number of trusted service providers ("sub-processors") to run Rang360. Each handles only the data needed for its function, under a data-processing agreement.
| Provider | Function | Data involved |
|---|---|---|
| Supabase | Database, authentication, file storage | All account and teaching data, email, hashed password |
| Vercel | App and API hosting | Request data, IP address, auth token in transit |
| Anthropic | AI worksheet generation | Worksheet prompt only - no pupil data, no teacher PII |
| Resend | Essential account emails | Recipient email address and email content |
| Stripe (once paid plans launch) | Payment processing | Name, email, payment details - handled entirely by Stripe; card data never reaches our servers |
| Google (if you choose Google sign-in, once enabled) | Optional sign-in | Email, name, profile photo, Google account id |
We'll keep this list current and update it before adding any new sub-processor.
7. Where your data is stored & international transfers
Your data at rest - your account, all your teaching data and uploaded files - is stored in the EU (Amazon Web Services, Dublin, Ireland) via Supabase.
Some functions are handled by US-based providers (Anthropic for AI generation, Resend for email, certain Vercel serverless functions, and - once enabled - Stripe and Google). Where data is transferred outside the EEA for those specific functions, the transfer relies on Standard Contractual Clauses and/or the provider's own approved transfer mechanism.
8. Trial-abuse prevention
To stop people repeatedly deleting and re-creating accounts to get endless free trials, we keep a server-only record of which emails have already used a trial.
This record stores only a salted, one-way hash of your normalised email address - never the email itself. It cannot be read back into your contact details; it is only used as a yes/no membership check.
Because its whole purpose is to survive account deletion, this hash is deliberately retained after you delete your account. It is the one piece of data not erased on deletion. The lawful basis is our legitimate interest in preventing fraud and abuse (Art. 6(1)(f) GDPR), relying on the erasure exemption in Art. 17(3).
9. Data retention & deletion
- While your account is active, we keep your data to provide the service.
- You can delete everything yourself. Settings → Delete account removes your login, profile and all teaching data - schemes, lessons, records, attachments, lesson plans, Cuntas reports, worksheet cache and uploaded files.
- There is also a "Start fresh" option that wipes your teaching data but keeps your account.
- Exception: the salted email hash described in section 8 is retained for abuse prevention.
- Residual copies may persist in encrypted backups for up to 7 days before rotation.
10. Your rights
Under the GDPR and the Irish Data Protection Act 2018 you have the right to:
- Access & portability - much of your data is viewable and exportable in-app (Cuntas and worksheet PDFs). For a full copy, email hello@rang360.ie and we'll arrange it. (We don't yet have one-click full export, so this is handled by request.)
- Rectification - your name and email are editable in Settings.
- Erasure - self-service "Delete account" (subject to the section 8 carve-out).
- Restriction & objection - email hello@rang360.ie.
- Complaint - you can complain to Ireland's supervisory authority, the Data Protection Commission.
11. How we protect your data
- Encryption in transit (HTTPS/TLS) and at rest.
- Row-level security on every database table - each teacher can access only their own data.
- Passwords stored only as salted hashes; minimum length enforced and email confirmation required.
- Secrets (API keys) live server-side only and are never exposed to the browser.
- Security headers and an authenticated, rate-limited AI proxy.
12. Children's data
Because Rang360 is used by adult teachers and collects no pupil data, child-specific data rules (such as GDPR Article 8 and the digital age of consent) do not apply to content entered in the app. Schools and parents can be assured no child's data passes through Rang360.
13. Cookies
Rang360 uses only strictly-necessary and functional storage, and no tracking or advertising cookies. See our Cookie Policy for the detail.
14. Changes to this policy & contact
If we make material changes we'll update this page and the "last updated" date, and we may notify you by email. For any question about this policy or your data, contact hello@rang360.ie.