Privacy policy for Ivrigo
Which personal data Ivrigo processes, why, where it is stored and which rights you have.
Updated
01About Ivrigo
Ivrigo is a school platform for weekly plans, attendance, assessment and contact between school and home. Ivrigo is provided by Kalirox AS, org. no. 836 971 752, Tårnveien 14, 3047 Drammen, Norway.
02Who is responsible
The school that uses Ivrigo is the controller of the personal data about its pupils, guardians and staff. Kalirox AS processes that data on the school's behalf, under a data processing agreement and only on the school's instructions. Each school publishes its own privacy notice under "Privacy" on the school's Ivrigo address.
Kalirox AS is the controller of the data we process for ourselves: running and securing the platform, enquiries to us, and visits to ivrigo.no. We do this on the basis of our legitimate interest in a secure, working service, or to answer you.
03Which data we process
- Account data: name, e-mail address, role and school.
- The school day: timetables, attendance and absence (including the reason), assessments and feedback, assignments and submissions, and messages between school and home.
- Photos and documents the school shares. Photos of pupils only with consent.
- ID cards: portrait and date of birth, stored encrypted.
- Staff birthdays: day and month only, and only when the staff member shares them.
- Technical data: IP address and time in security logs, and data about the signed-in device.
We never use personal data for advertising and never sell it.
04Google user data
Ivrigo uses Google services only when the school has turned them on:
- Sign in with Google: Ivrigo receives the e-mail address and name of your Google account and whether the e-mail address is verified. The e-mail address is used only to find the account your school created for you. Ivrigo never creates accounts from a Google sign-in and never receives your Google password.
- Google Drive for assignments (optional, for teachers and administrators): with a separate consent, Ivrigo can reach only the files you pick yourself and the files Ivrigo creates for you. It uses them to make a copy of an assignment template for each pupil, share the copy with the pupil's school account, and keep the submitted work in Ivrigo. Ivrigo keeps only what the connection needs, and keeps it protected.
- You can disconnect Google Drive in Ivrigo at any time, and you can also remove the access in your Google account (myaccount.google.com/permissions). Documents in your Google Drive are not deleted.
Ivrigo does not use Google user data for advertising, does not sell it, does not transfer it to anyone except as needed for the features above, and does not use it to train AI models. Kalirox AS staff do not read it, except when you ask us to, when it is needed for security, or when the law requires it.
Ivrigo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
05AI features
Some features use an AI service from a cloud provider we have a data processing agreement with: suggestions for feedback, translation, test questions, reading text from images, and book lookups. They send only the text the feature needs. The provider does not use the data to train its models. The AI features can be turned off for a school.
06Where data is stored
Data is stored in data centres in Norway. Some sub-processors may process data in other countries; where that is outside the EU/EEA, it happens on a valid transfer basis, such as the EU's standard contractual clauses.
07Sub-processors
- Cloud hosting and storage.
- E-mail delivery (invitations, notifications and sign-in codes).
- Notifications to the mobile app, through a notification service and the phone's own notification service (Apple or Google). Previews never show sensitive content.
- Notifications in the browser and in the app on the Home Screen, when you turn them on: they are sent encrypted through the browser's own notification service (for example Apple, Google or Mozilla), which cannot read the content. Signing out stops them.
- Google: sign in with Google and Google Drive, when the school uses them.
- The AI features described above.
The full list of sub-processors is part of the data processing agreement each school has with us. A book search sends only the ISBN number to public book registers.
09Security
Traffic is encrypted, and sensitive data and files are stored encrypted. Administrators must use two-factor sign-in. Schools are kept apart from each other, access depends on the role, and important actions are logged. Location and camera data are removed from photos.
10Storage and deletion
The school decides how long data about its pupils, guardians and staff is kept, and deletes it in Ivrigo. When a school stops using Ivrigo, it can download an encrypted export for 30 days before the data is deleted. The Google Drive access tokens are deleted when you disconnect.
11Your rights
You have the right of access, rectification, erasure, restriction, objection and data portability under the GDPR. For data the school is responsible for, contact the school; we help the school answer. For data Kalirox AS is responsible for, contact us. You can complain to the Norwegian Data Protection Authority (datatilsynet.no).
12Children
Data about pupils is processed only on the school's instructions and only for the school's purposes. Ivrigo shows no advertising and does no marketing to children.
13Changes
We update this policy when new features change how personal data is processed. The date at the top shows the latest change.
14Contact
Kalirox AS, org. no. 836 971 752, Tårnveien 14, 3047 Drammen, Norway. E-mail: info@kalirox.com.