This Privacy Policy explains how Hylen Technologies ("we", "us") collects, uses, shares, and protects personal information in connection with Hylen Education. It applies to our marketing website (ed.hylen.tech) and to the Hylen Education application we provide to schools. Because Hylen Education is a tool that schools use to run their own communities, this policy distinguishes between data we handle on our own behalf and data we process on behalf of a school.
1. Who we are
Hylen Education is operated by Hylen Technologies, a company registered in the State of Wyoming, United States, with a registered office at 30 N Gould St, Ste R, Sheridan, WY 82801, USA. Hylen Education is part of the Hylen family (hylen.tech).
For any privacy question, or to exercise a privacy right, contact us at info@hylen.tech.
2. Our two roles: processor and controller
When a school uses Hylen Education, the school decides what information to collect about its students, families, and staff, and why. In data-protection terms the school is the "controller" and we are the "processor" — we handle that information only to provide the service, on the school's documented instructions and under our customer agreement. Under US student-privacy law we act as a "school official" performing a service the school would otherwise perform itself.
For our website visitors and prospective customers, we act as the controller of the limited information described below. This policy covers both situations and notes which applies.
3. Information we collect
Information schools put into Hylen Education
- Student records — names, dates of birth, guardians, attendance, grades, and any notes a school chooses to store.
- Family and guardian contact details.
- Staff and HR records the school manages.
- Financial records — fees, invoices, and payroll the school runs through the platform.
- Operational data — timetables, transport, boarding, store and inventory records.
Information we collect about website visitors
- Contact-form submissions — your name, email, school, and message.
- Basic technical data — IP address, browser type, and pages viewed, used for security and to understand interest.
- Cookies and similar technologies — see our Cookie Policy.
Information from creating and running an account
- Account holder name and email.
- School name and subdomain.
- Billing and pilot details.
- Support correspondence with us.
4. How and why we use information
For data we process on a school's behalf, we use it only to provide, secure, support, and improve Hylen Education as the school instructs, and as set out in our customer agreement.
For data we control (website, prospect, and account data), we rely on the following lawful bases under the GDPR, where applicable, and equivalent principles elsewhere:
- Contract.
- to set up and run your account and pilot.
- Legitimate interests.
- to secure our systems, prevent abuse, and respond to schools that contacted us — balanced against your rights.
- Consent.
- for non-essential cookies and any marketing email, which you can withdraw at any time.
- Legal obligation.
- to meet tax, accounting, and other legal duties.
We do not sell personal information, and we do not use children’s data for advertising.
5. Children’s data (COPPA & FERPA)
Hylen Education is used by schools to educate and support children, so children’s personal information is often processed. We treat it with particular care.
COPPA (United States)
Where the US Children’s Online Privacy Protection Act applies, we collect and process information about children under 13 only on behalf of, and under the authorisation of, the school. Schools provide and manage consent for this processing in their role acting for parents, consistent with the COPPA school-consent framework. We use children’s information only to provide the service to the school — never for our own commercial purposes or advertising.
FERPA (United States)
For schools subject to the Family Educational Rights and Privacy Act, Hylen Technologies acts as a "school official" with a "legitimate educational interest" in the education records it processes, under the school’s direct control. We use education records only to provide the contracted service and do not re-disclose them except as the school directs or the law permits.
Schools outside the US
We apply the same principle everywhere: we process children’s data strictly on the school’s documented instructions and under the GDPR-grade safeguards described in this policy.
7. International data transfers
We are a United States company incorporated in Wyoming, serving schools worldwide. Depending on your school’s location, personal information may be processed in the United States or in other countries where we or our sub-processors operate.
Where we transfer personal data out of the UK/EEA or other regions with transfer restrictions, we put appropriate safeguards in place — such as the European Commission’s Standard Contractual Clauses (and the UK Addendum) — and take additional measures so your information keeps an equivalent level of protection. Contact info@hylen.tech for details.
8. Data retention
For data we process on a school’s behalf, we keep it while the school’s account is active, then return or delete it as described in our customer agreement (typically within a defined window after the account ends). For data we control, we keep it only as long as needed for the purpose it was collected, or as the law requires, then delete or anonymise it.
9. How we protect your data
Security is built into Hylen Education. Key measures include:
- Per-school isolation — each school’s records are separated at the database level (per-school PostgreSQL row-level security) so one school’s data cannot appear on another’s screens.
- Encryption — data is encrypted in transit and at rest.
- Access controls — staff access is least-privilege and logged.
- Testing — isolation and security are tested regularly.
No system is perfectly secure, but we work hard to protect your information and will notify the school without undue delay if a breach affects its data, as required by law and our customer agreement.
10. Your rights and choices
Depending on where you live, you may have rights over your personal information — including to access, correct, delete, restrict, or object to processing, to port your data, and to withdraw consent. Under the GDPR these are the data-subject rights; several US states provide similar rights.
If your data is held by a school in Hylen Education, contact the school first — as controller it manages these requests, and we assist it. For data we control, contact info@hylen.tech and we will respond within the timeframes the law requires. You also have the right to complain to your local data-protection authority.
11. Exporting and taking your data with you
A school can export its records from Hylen Education at any time, without asking us, and we will help it migrate to another system if it ever decides to leave — that is part of our agreement, not an add-on. Your school’s data is yours.
12. Changes to this policy
We may update this policy as Hylen Education evolves or the law changes. We will post the new version here with a revised "last updated" date and, for material changes, give schools reasonable notice.
13. How to contact us
Questions, requests, or concerns: email info@hylen.tech, or write to Hylen Technologies, 30 N Gould St, Ste R, Sheridan, WY 82801, USA.