Privacy Policy

Last updated: November 2026

school365.ky is a product of Sanmol Software, Cayman Islands. Each school, food vendor or ministry using it (a “tenant”) controls the personal data it loads; we process that data for the tenant. Questions: privacy@school365.ky.

What we hold

• Account — name, email, password (stored only as a salted hash), language.
• Membership — which schools or vendors you belong to and your role.
• School operations — meal orders, payments, attendance and similar records the tenant uses.
• Payments — a token from the payment gateway, card brand, last 4 digits and expiry. Never the full card number or CVV.
• Security records — sign-ins and security actions (date, time, IP address, browser). You can see yours under Account → Sign-in activity. Kept 13 months.

Children

Most pupils are under 16. The school is responsible for obtaining parent or guardian consent.

Where it is stored

Oracle Cloud Infrastructure in London, United Kingdom. We back up our databases every night and keep those copies for 7 days; our hosting provider, Oracle Cloud, also keeps backup copies of our servers for up to 21 days. All backups stay in London, United Kingdom, and are deleted automatically after that.

Services we use

• Oracle Cloud Infrastructure — hosting (London, UK)
• SMTP2GO — sending email
• CyberSource or PlugnPay — card payments, only when a tenant uses them
• Google Analytics — visit statistics on our public pages, only if you accept analytics cookies
• Meta (Facebook) — visitor measurement and marketing on our public pages, only if you accept analytics cookies
• jsDelivr and cdnjs — deliver our page scripts and styles, so they receive your IP address

Cookies

Essential cookies only (sign-in, form protection, language, and your cookie choice), unless you accept analytics cookies on our public pages — which then enable Google Analytics and a Meta (Facebook) marketing pixel. Our sign-in and signed-in pages never load analytics. We don't sell your data.

Your rights

Ask your school or vendor, or email privacy@school365.ky, to see, correct, export or delete your data. Financial records are kept as long as the law requires (usually 7 years). You can complain to the data protection authority where you live.

Security

All connections use TLS 1.2 or higher. Two-factor sign-in is available on every account.