latlongCALL · Document version 2026-09-22-school-v1
Account and school notices
Before creating or joining a school, review this combined notice. Your existing account acceptance stays unchanged. Joining a particular school is a separate next step.
Account and school terms
Existing account notice · 2026-09-21-pilot-v2
Who operates this pilot
latlongCALL is a project led by KARAM BEN — Founder & Sole Developer. A company has not yet been registered. These terms cover the limited Education account pilot in Hanoi, Vietnam; they do not offer paid work or promise a launch date.
Who may join
This pilot is for adults aged 18 or over acting for themselves as teachers or as authorized school representatives. Use accurate account information and an email address you control. Choosing a school role does not give you access to a school or permission to represent it.
What an account provides
Account access covers registration, email confirmation, sign-in, password recovery and a basic account page. Email confirmation proves control of an inbox only. It is not identity, qualification or work-eligibility approval. School onboarding, teacher approvals, bookings and payments need separate releases and checks.
Safe account use
Keep your password and recovery links private. Do not share accounts, impersonate someone, bypass access controls, harass other people or submit unlawful content. Do not upload passports, ID documents, bank details or children's information during this account pilot.
Availability and restrictions
This is an evolving pilot and access may be interrupted for maintenance or security. Access may be restricted when there is a security or misuse concern. Contact the support address to ask for a review. The pilot is not an emergency service and does not guarantee a job, worker, arrival or income.
No payments or employment agreement
Registration does not authorize a charge or create an employment relationship. Cover collection, commission and teacher payouts are not enabled in this account pilot. Any future services will have their own clear terms; employment salaries remain the employer's responsibility.
Leaving, help and changes
You may stop using the pilot and contact support for account closure, a privacy request or an access dispute. Requests require proportionate verification of account control, never sending a password or ID document by email. Material changes to these notices will be published with a new version and any required acceptance requested before affected use. Nothing here removes rights that applicable law does not allow us to exclude.
School addition
Eligibility and school authority
This pilot is for adults aged 18 or over. Act for a school only when authorized. Use accurate information and update errors. Invite only colleagues you are permitted to contact for school access. Do not use invitations for unsolicited promotion, impersonation or repeated unwanted contact.
Personal accounts and credentials
Use your own verified email and keep passwords and recovery links private. Do not share logins or bypass another school’s permissions. Tell support promptly if your access appears compromised. An organization administrator manages school membership, not your personal password or unrelated account access.
Membership is not a subscription
In this release, school membership means permission to access a particular workspace or branch. Joining does not authorize a charge, create an employment agreement or sign you up for a recurring payment. Any future paid service will require its own visible price, billing/cancellation terms and authorization. Removing a school membership, closing a personal account and closing an organization are separate actions.
Grant only the access needed
Owners choose appropriate administrators and staff scopes. Review the recipient and role before sending an invitation, remove access when colleagues leave and transfer ownership deliberately. Email verification only establishes mailbox control; it does not verify an institution, identity, qualifications or eligibility to work.
Handle colleagues’ information responsibly
Use school details and staff information only for the authorized purpose of operating the school workspace. Do not scrape private directories, sell contact details, harass people or submit children’s records or unnecessary sensitive documents. Only provide school or colleague information you are authorized to share for the purposes explained in the notice. This does not give latlongCALL a general right to publish it in advertisements.
Restrictions and a route to review
Access may be restricted for a suspected security incident, unauthorized representation, misuse or maintenance. Contact latlongcall@gmail.com with the affected account and school to request review by KARAM BEN. We will explain the reason and available next step where doing so would not compromise safety, another person’s privacy or a specific legal obligation. No automatic reinstatement or fixed appeal outcome is promised.
Scope of the school release
This release is for school setup, branches and staff access. It does not promise timetables, cover bookings, payments, hiring outcomes, worker arrival or income. It is not an emergency service. Registration and membership do not authorize payment or form an employment agreement. Employment salaries remain the employer’s responsibility.
Leaving, closure and changes
Contact latlongcall@gmail.com for membership removal, personal account closure, organization closure, privacy requests or access disputes. A verified school closure requires appropriate authority; one person cannot delete other people’s independent records. We handle an only-owner departure through authorized transfer or organization restriction/closure. Material changes use a new notice version and appropriate renewed choices before affected use. Nothing in these pilot terms removes rights that cannot lawfully be excluded.
Account and school privacy
Existing account notice · 2026-09-21-pilot-v2
Responsibility and contact
KARAM BEN — Founder & Sole Developer operates this account pilot for latlongCALL. Contact latlongcall@gmail.com for account support or privacy requests. The project is not yet a registered company. This notice describes the account pilot, not the proposed future marketplaces.
Information used
We process your email address, display name, chosen teacher or school journey, interface language, authentication records and the version and time of your terms and privacy choices. Authentication uses a password hash held by Supabase, session cookies and confirmation or recovery tokens. Security systems also process technical request information such as IP address, time and browser information. Do not send passwords to support.
Why it is used
We use account information to create and protect your account, verify your email, deliver essential account messages, recover access and investigate support or security issues. We record the choices you submit and the relevant notice version. Selecting a role is onboarding intent, not a grant of permissions. The pilot does not use your account information for advertising or marketing emails.
Services and overseas processing
Hostinger hosts the web app. Supabase provides authentication and the database in Tokyo, Japan. Resend routes account emails through Tokyo but stores customer data, including message content and delivery logs, in the United States. Your email provider also processes delivery and keeps your mailbox copies. These services involve processing outside Vietnam. Registering does not publish a worker profile or share your account with schools. Access is limited to account services and authorized support or security work.
Cookies and temporary drafts
Essential cookies keep you signed in and secure account actions; a preference cookie remembers your language. While registering, the browser may temporarily retain only an unfinished display name and role for up to 30 minutes. Passwords, email addresses and login tokens are not stored in that draft. Signing out clears the app's account-related browser state.
What this pilot does not collect
The account pilot does not collect live location, passports, qualification files, payment details or children's records. Maps and worker examples in the vision presentation are illustrative. Future location sharing, verification, media and payment features will need separate explanations and controls before activation.
Retention and requests
We keep account and acceptance records while the account is open. We check the support inbox each working day. You may request access, correction, deletion, restriction or withdrawal of consent. After verifying an account-closure request, we restrict access promptly and complete ordinary deletion from active application records within 30 days, including the linked acceptance receipt. Minimal support-case records are deleted 90 days after resolution. If specific records must be preserved for an actual security investigation or legal obligation, we restrict their use, record the reason and review date, and explain the exception when permitted. A shorter applicable legal deadline takes precedence. Withdrawing required processing consent may require closing the account. Never send a password or identity document to support.
Service logs and backup copies
Server logs rotate automatically: web logs retain 14 daily rotations; system logs retain four weekly rotations, with empty logs skipped. The system journal is limited to seven days, but forwarded system-log copies follow the weekly schedule. Resend currently retains email and log data for 30 days and backups for seven days on the configured free plan. Supabase may retain up to seven daily backup copies on its free plan; that practice is not guaranteed. Provider security records and backup copies follow the relevant service retention and deletion processes. Closing an app account does not instantly erase provider backups or copies in your mailbox. We request provider assistance where needed and prevent a restored backup from silently reactivating a closed account.
Your choice and safety
Account processing consent is requested separately from agreement to the terms and is not preselected. No marketing consent is requested or inferred. You may read the public vision without creating an account. Access controls and protected connections reduce risk but cannot eliminate every security risk. Tell support if you suspect unauthorized access; never email a password, recovery token or identity document.
Retention and deletion
- School and branch details
- Keep while the organization is active. Delete or anonymize personal contact details within 30 days after a verified organization-closure request.
- Invitation links and recipient details
- Links expire after 72 hours; resending replaces the old link. Delete recipient email and token-hash records within 30 days after acceptance, expiry or revocation. Membership and security records follow their own periods below.
- Staff membership
- Keep while access is active. Removing a member blocks access immediately. Delete or anonymize their former membership association within 30 days after removal, unless a documented preservation exception applies.
- School security/activity records
- Keep the minimal record of who changed access or school settings for 90 days from the event, then delete or irreversibly anonymize it. Ordinary verified account-deletion requests take precedence over this general period.
- Account deletion and support — already confirmed
- Review the inbox each working day. Complete ordinary verified account deletion within 30 days. Delete minimal support-case records 90 days after the case closes.
School addition
Who operates this pilot
latlongCALL is operated by KARAM BEN — Founder & Sole Developer. The project is not yet a registered company. This notice covers adults aged 18 or over in the limited Education account and proposed school pilot in Hanoi, Vietnam. Contact latlongcall@gmail.com for privacy requests, unwanted invitations, access problems or complaints. You do not need to create an account to report an unwanted invitation.
Account data and school data
Account services use your email, display name, selected teacher/school journey, language, authentication records and the version and time of submitted terms/privacy choices. Supabase holds a password hash; session cookies and confirmation/recovery tokens support access. Security systems process request information such as IP address, time and browser information. School features add organization and branch names, entered addresses, contact emails and time zone; account-to-school/branch links, display names, roles and access status; invitation email, role, scope, expiry and lifecycle/delivery status; and minimal activity records of actor, action, affected record and time. An entered address is not live GPS or proof of verification.
Where information comes from and why it is needed
You supply your account details and any school details you are authorized to enter. An authorized school representative supplies an invitation recipient email and intended role. The system creates identifiers, access and security records. We use these to operate accounts, show the right workspace, deliver requested invitations, manage access and investigate support/security issues. This school flow does not import phone contacts, calendars or social-media profiles. Required fields are identified in the relevant form; without the information needed for an account or school membership, that feature cannot be provided. The public vision remains readable without an account.
Who can see it
Active members can see basic information for their organization. Owners and administrators can manage all its branches and view staff names, roles, access status and invitation recipient details. Recruiters see their permitted branches; branch staff see only their assigned branch. Recruiters and branch staff see their own membership rather than the full staff/invitation directory. Different schools cannot read each other's private workspace through these features. Authorized project support may access the minimum necessary records for a support or security task. These school records are not published as a public directory.
Invitations before you join
An authorized school owner or administrator enters the colleague email and intended role/scope. The email identifies the school; the signed-in review screen shows the proposed role and branch before acceptance. If unexpected or incorrect, do not accept it; ignore it or contact support to investigate and revoke it. Joining requires signing in with the exact verified recipient email, reviewing the proposed school access and explicitly accepting. Receiving or opening the email is not acceptance, and selecting a school journey at registration grants no school permissions. Links expire after 72 hours. Resending replaces the earlier link; revocation prevents its use. These actions do not recall a message already delivered to a mailbox. This release has no automatic invitation-reminder campaign or address-book upload.
Membership changes and school-held copies
Membership is an access relationship, separate from your personal account. The owner can manage administrators and transfer ownership. Owners and administrators can manage recruiter and branch-staff access; administrators cannot change or remove the owner or another administrator. Removal blocks the affected school access immediately. If you want to leave or dispute a change, contact the school owner or latlongCALL support; a self-service leave-school button is not promised in this release. Your other authorized memberships and personal account are handled separately. School representatives remain responsible for data they independently hold outside latlongCALL, such as their own employment records or copies they made. We can restrict platform access, but cannot erase another party’s independent files or the recipient’s mailbox remotely.
Essential messages and optional uses
Email confirmation, password recovery, requested staff invitations and necessary service/security notices support the service. They are separate from promotion. This pilot does not use account or school data for advertising or marketing emails, and a school invitation is not permission for marketing. It does not create a public staff directory. Any future optional marketing, public profile or other new use will need a separate explanation and appropriate choice before it starts. Email-service acceptance or delivery status is not proof that the recipient read or agreed to a message.
Service providers and processing locations
Hostinger hosts the web app. The current Supabase project provides the database and account services in Tokyo, Japan. Resend processes invitation email content and delivery information and stores customer data in the United States; the sending region does not determine its storage location. The recipient's email provider also handles the message and mailbox copy. These services involve processing outside Vietnam. Provider access and deletion use each service's applicable controls; this notice does not promise instant deletion from every provider system.
Browser storage and private links
Essential account cookies protect signed-in access. To carry an invitation through sign-in, a signed HttpOnly browser cookie temporarily contains the invitation hash for up to 20 minutes; the email link can be reopened if that handoff expires. The database stores the invitation-token hash, not the raw token. The email provider and recipient necessarily receive the invitation link. Unfinished school name/address fields may be kept in account-bound browser session storage and offered for recovery for up to 24 hours. Successful saving or sign-out clears that draft. The 24-hour recovery limit is not an automatic deletion timer; an unused expired draft may remain in that browser session until cleared. That form draft does not retain the contact email, password or identity documents.
Requests, correction, withdrawal and complaints
Write to latlongcall@gmail.com from the relevant mailbox where possible. State the school, the issue and what you want: access to or a copy of your personal data, correction, membership review, restriction, withdrawal or deletion. Do not include passwords, recovery links or identity documents. We check this inbox each working day, verify control proportionately and explain the action, timing and any justified limit. A request for your data must not expose another person’s private information. Data-copy requests are handled by support; no instant export tool is promised. Withdrawing consent for processing required for a feature may require ending that feature or account. Privacy withdrawal does not retroactively undo earlier processing. You may ask KARAM BEN to review a refusal or access decision; this does not restrict remedies available under applicable law.
Retention and deletion
The retention table above forms part of this notice. On an ordinary verified account-closure request, access is restricted promptly and personal account and linked acceptance records are deleted within 30 days; linked school identifiers are deleted or irreversibly anonymized within the same period. Closing one staff account does not automatically close its school's workspace or delete other people's records. If the person is the only owner, support arranges an authorized ownership transfer or restricts the organization and processes its closure. We do not require an account to remain usable while this is resolved. Requests must be verified proportionately; never email a password, recovery link or identity document.
Exceptions, providers and restoration
If particular records are needed for an actual security investigation or a specific legal preservation obligation, their use is restricted, the reason and review date are recorded, and the exception is explained where permitted. A shorter applicable legal deadline takes precedence. Provider logs, backups and recipient mailbox copies can have separate retention periods. Resend currently describes 30-day email/log retention and seven-day backups for its Free plan. We do not promise a fixed Supabase Free-plan backup expiry or instant removal from every backup. Before restoring data, access stays restricted until later removals/deletions are reapplied.
Security and review of access decisions
Protected connections, role/record permissions and restricted support access reduce risk; they cannot guarantee that no incident will occur. Report suspected impersonation, a compromised account or misuse of invitations to support. Use your own account, protect passwords and do not forward invitation or recovery links. Expiry and permission checks automatically allow or deny access according to recorded membership; they do not assess teaching quality, creditworthiness or work eligibility. You can ask support to review an access error. Any necessary incident response must limit exposure, preserve only relevant evidence and make required notifications.
New features and notice versions
School setup does not collect children’s records, passports, qualifications, bank details or live location. Bookings, payments, teacher media and verification need separate releases and notices. Location shown in the vision is illustrative. Before any future foreground location sharing, we must explain who receives it, when it starts/stops, freshness, retention and a manual fallback. It cannot independently prove job completion. Material changes to the account/school notice must receive a new version and be presented before affected use, with explicit, unselected choices where required. Terms acceptance, privacy consent and joining a school are distinct actions. Existing account consent is not silently converted into consent for wider school processing.