1. Introduction

Thankdigit Co. (“Thankdigit,” “we,” “us,” or “our”) provides the Thankdigit SNS (Student Notification System) (the “Service”), a software-as-a-service platform enabling higher education institutions to deliver proactive notifications and communications.

This Privacy Policy explains how personal data is collected, used, disclosed, and protected when the Service is accessed or used by educational institutions and their authorized users.

2. Scope and Roles

2.1 Data Controller vs. Data Processor

Educational institutions (“Institutions”) act as Data Controllers.

Thankdigit acts as a Data Processor, processing personal data strictly on behalf of Institutions.

Thankdigit does not independently determine the purposes or means of processing student data.

2.2 Direct Interactions

For limited interactions (e.g., website visits, demos), Thankdigit may act as a Data Controller.

3. Categories of Personal Data

Thankdigit processes personal data only as provided or authorized by Institutions.

3.1 Core Identity Data

Full name, Email address, Student ID, Phone number.

3.2 Academic and Institutional Data

Faculty, department, program, specialization, course, group, semester, academic year, enrollment status, level, and form of education, GPA, honors, financial status (e.g., grants, debts), admission and graduation dates, internal classification fields (e.g., plan_code, direction).

3.3 Sensitive or Extended Attributes (if provided)

Birthdate, Gender, Citizenship / foreigner status, Socio-economic or preferential education indicators.

3.4 Communication Data

Notification content, Delivery logs (timestamps, delivery status), Interaction data (opens, clicks, engagement).

3.5 Technical and Usage Data

IP address, Device and browser information, Log files, Usage analytics.

3.6 Custom Data Fields

Any additional data fields explicitly configured and exported by Institutions.

4. Purpose of Processing

Thankdigit processes personal data solely to:

Provide, operate, and maintain the Service;

Deliver notifications configured by Institutions;

Enable segmentation, filtering, and targeting;

Support integrations with institutional systems;

Monitor performance, reliability, and security;

Prevent fraud, abuse, and unauthorized access;

Comply with legal obligations.

No Advertising Use:

Thankdigit does not sell personal data and does not use student data for advertising.

5. Legal Basis for Processing

Where applicable under the General Data Protection Regulation (GDPR):

Processing is performed under instructions of the Data Controller (Institution);

Article 6(1)(b) — performance of a contract;

Article 6(1)(c) — legal obligations;

Article 6(1)(f) — legitimate interests (e.g., security, system integrity).

6. FERPA Compliance

Thankdigit acts as a “school official” under the Family Educational Rights and Privacy Act (FERPA).

Accordingly:

Data is processed only for authorized educational purposes;

Access is limited to legitimate educational interests;

Data is not disclosed without Institutional authorization;

Safeguards are implemented to protect education records.

7. Data Sharing and Disclosure

7.1 Subprocessors and Service Providers

Thankdigit may engage subprocessors, including:

Cloud infrastructure providers (e.g., DigitalOcean, AWS, GCP, Azure);

Messaging and delivery providers (messengers, push notifications);

Analytics providers (e.g., Google Analytics).

All subprocessors are contractually bound to:

Process data only on instructions;

Maintain confidentiality;

Implement appropriate security measures.

7.2 Institutions

Personal data is accessible to and controlled by the Institution that provided it.

7.3 Legal Disclosure

Data may be disclosed if required by:

Applicable law;

Court order or legal process;

Government authority.

8. International Data Transfers

Personal data may be processed in the United States and other jurisdictions.

Where required, Thankdigit implements safeguards such as:

Standard Contractual Clauses (SCCs);

Equivalent lawful transfer mechanisms.

9. Data Retention

Thankdigit retains personal data:

As instructed by Institutions.

For the duration of the service agreement.

As required for legal, regulatory, or security purposes.

Upon termination:

Data is deleted or anonymized within a commercially reasonable timeframe;

Backup retention may persist temporarily per standard practices.

10. Data Security

Thankdigit implements industry-standard technical and organizational measures:

Encryption in transit (TLS);

Secure data storage;

Access control and role-based permissions;

Authentication and identity management;

Logging and monitoring;

Incident response procedures.

11. Data Subject Rights

Under laws such as:

General Data Protection Regulation.

California Consumer Privacy Act.

Individuals may have rights to:

Access their personal data;

Request correction;

Request deletion;

Restrict or object to processing;

Request data portability.

Important:

Requests must be directed to the Institution (Data Controller).

Thankdigit will assist Institutions in fulfilling such requests.

12. Cookies and Tracking Technologies

Thankdigit uses cookies and similar technologies to:

Maintain user sessions;

Ensure platform functionality;

Analyze usage and performance.

Third-party analytics tools (e.g., Google Analytics) may collect aggregated usage data.

Users can manage cookies through browser settings.

13. Third-Party Integrations

The Service may integrate with:

Learning Management Systems (LMS);

Student Information Systems (SIS);

Identity Providers (SSO);

University websites;

ERP systems;

Scheduling, grading, and academic tools;

Finance and administrative systems;

Public safety systems;

Messaging platforms and push notification services.

Data sharing is limited to what is necessary for functionality.

14. Children’s Privacy

The Service is intended for higher education environments and is not directed to children under 13.

15. Changes to This Privacy Policy

Thankdigit may update this Privacy Policy from time to time.

Updates will be posted with a revised “Effective Date.” Continued use of the Service constitutes acceptance of updates.

16. Contact Information

Thankdigit Co.

Email: info@thankdigit.com

For privacy-related inquiries or data requests, please contact your Institution or email us directly.

17. Governing Law

This Privacy Policy is governed by the laws of the State of Delaware, United States, unless otherwise required by applicable data protection laws.