Legal

Privacy Policy

Last updated: May 2026. We process personal data on behalf of schools under GDPR and Swiss nDSG.

1. Who we are

Cnoté is a school-parent communication service operated from Switzerland. For the purposes of GDPR, Cnoté acts as a data processor on behalf of schools (the data controllers). Schools determine the purposes and means of processing personal data; Cnoté processes data only on the school's documented instructions.

Contact: hello@cnote.app

2. Roles and responsibilities

Your school is the data controller. The school decides which data is shared with Cnoté, which parents are enrolled, and when the service is terminated.

Cnoté is the data processor. We process email metadata, calendar events, and parent contact data only on the school's behalf, only for the purpose of delivering school-parent communication via WhatsApp.

This relationship is formalised in a Data Processing Agreement (DPA) signed between Cnoté and each school before any data processing begins. The DPA complies with GDPR Article 28 and Swiss nDSG Article 9.

3. What data we collect

Data provided by the school

  • Parent names and WhatsApp numbers — used to deliver school communications via WhatsApp
  • Child first names and year group — used to personalise communications per child
  • Email account access (OAuth tokens) — read-only access to the school's Gmail inbox for fetching school communications

Data we generate through processing

  • Email metadata and summaries — subject, sender, received date, AI-generated summary of content. We process email summaries, not full email bodies, to the extent needed to generate useful notifications.
  • Calendar event data — event titles, dates, and descriptions from the school's Google Calendar
  • WhatsApp message records — inbound and outbound messages between Cnoté and parents (for digest delivery and conversation history)
  • Digest and notification delivery records — timestamps of messages sent, for idempotency and audit

Data we collect from this website

  • Demo request submissions — name, email, role, school name, and message when you complete the contact form. Used only to respond to your inquiry. Retained for 3 years.
  • Server logs — IP addresses and user-agent strings in standard server access logs. Retained for 90 days.

4. What we do NOT collect

  • Full email body content (we process summaries only)
  • Analytics cookies or third-party tracking pixels
  • Payment card data (billing handled by third-party provider)
  • Data not explicitly needed to deliver the service

We do not use personal data processed through Cnoté to train AI models. LLM calls use school email content only for real-time processing and do not result in model training.

5. Legal basis for processing

For school data (parents, children, emails): Processing is carried out on the basis of the school's legitimate interest in communicating with families, and under the DPA where Cnoté acts as processor.

For website contact form submissions: Consent (you choose to submit the form).

6. Where we store data

All personal data is stored on servers located in France (EU), operated by OVH Cloud. No personal data is transferred to the United States or to any country outside the EEA or Switzerland without adequate safeguards.

7. How long we keep data

  • Parent contact data — retained for the duration of the school contract plus 90 days for backup, then deleted.
  • Email and calendar data — retained for 3 years from receipt, then deleted.
  • WhatsApp message records — retained for 3 years, then deleted.
  • Website contact form data — retained for 3 years, then deleted.
  • Server logs — retained for 90 days.

8. Your rights

Under GDPR and Swiss nDSG, you have the following rights:

  • Access — Request a copy of the personal data we hold about you
  • Rectification — Request correction of inaccurate data
  • Erasure — Request deletion of your data ("right to be forgotten")
  • Portability — Request your data in a machine-readable format
  • Objection — Object to processing based on legitimate interest
  • Restriction — Request that processing be restricted while a dispute is resolved

For data held on behalf of a school, please contact your school directly — they are the data controller. For data held directly by Cnoté (website contact data), email hello@cnote.app. We respond within 30 days.

9. Data Processing Agreement

Schools are provided with a GDPR Article 28 / Swiss nDSG Article 9 DPA before any data processing begins. The DPA is available on request. Contact hello@cnote.app.

10. Contact

For privacy-related questions, data access requests, or to request the DPA:

Cnoté
Switzerland
hello@cnote.app

You have the right to lodge a complaint with your national data protection authority. In Switzerland: FDPIC (Federal Data Protection and Information Commissioner).