Privacy Policy
SemPal helps students keep track of deadlines and classes. This policy explains what we collect, why, who we share it with, and the choices you have. We never sell your data and we don't show ads.
Who we are
SemPal is run in Ireland by its two founders, Mohammad Elmahi and Johnson Mununkum. Together we are the "controller" of your personal data under the GDPR. When we register a company to run SemPal, it will take over this role and we'll update this policy and tell you.
Contact us at support@sempal.ie.
What we collect
| What | Examples | Where it comes from |
|---|---|---|
| Account details | Email address, password (stored encrypted, we can't see it) | You, when you sign up |
| Profile | First and last name, college and campus, course, year of study, current term, time zone | You, during setup or in Edit profile |
| Files you upload | Syllabus PDFs and Word documents, timetable PDFs, screenshots and photos | You |
| Calendar links | The private timetable link from your college (an iCal or similar link) | You |
| Study information | Modules, deadlines, classes, rooms, lecturers, changes you make to a class, classes you hide | Read from your files and links, or added by you |
| Class alerts | Changes you report for a class (e.g. "room changed"), optional notes, your Confirm or Not true votes, alerts you report as abusive | You |
| Campus reports | Campus-wide issues you report, and colleges you ask us to add | You |
| Notification token | A code that lets us send push notifications to your phone | Your phone, if you allow notifications |
| Support messages | Emails you send us | You |
| Crash reports | What the app was doing when it crashed, your phone model and system version, and an anonymous account ID (never your name or email) | The app, automatically |
Stays on your phone only: your reminder settings and scheduled reminders, notices you dismiss, and anything you add to your phone's own calendar. We never see these.
We don't collect: your location, contacts, or advertising IDs. The app only uses your camera or photos when you choose to upload a timetable or syllabus.
Class alerts are anonymous to other students. Classmates see what was reported, never who reported it. We can see who sent a report, so we can deal with abuse.
Why we use it
| Purpose | Data used | Lawful basis (GDPR) |
|---|---|---|
| Run your account and the app | Account, profile, study information | Contract: we need it to provide the service you signed up for |
| Read your syllabus or timetable and find dates | Files you upload, calendar links | Contract |
| Keep your timetable up to date each day | Calendar links | Contract |
| Send reminders and timetable or campus notifications | Notification token, study information, campus | Contract. You can turn notifications off at any time. |
| Share class alerts with classmates, and campus notices with your campus | Class alerts, campus, campus reports | Legitimate interests: keeping students informed about changes to shared classes |
| Keep the app safe, stop spam and abuse | Class alerts, votes, reports, who sent them | Legitimate interests: protecting users |
| Fix crashes and bugs | Crash reports | Legitimate interests: keeping the app working |
| Answer you when you contact us | Support messages | Legitimate interests |
| Meet legal obligations | Whatever the law requires | Legal obligation |
We don't use your data for advertising, and we don't make decisions about you that have legal or similar effects using automated processing. We don't use your files to train AI models, and our AI supplier doesn't either.
Who we share it with
We use trusted suppliers to run the app. They only use your data to provide their service to us, under contracts that protect it.
| Supplier | What they do | Data they handle |
|---|---|---|
| Supabase | Database, sign-in, file storage and server code | Everything stored in your account |
| Anthropic | Reads the syllabus and timetable files you upload to find modules, deadlines and classes | Files you upload, and the text in them |
| Expo, Google and Apple | Deliver push notifications to your phone | Notification token and the notification's text |
| Brevo | Sends account emails, such as welcome and password reset emails | Email address, first name |
| ImprovMX | Forwards emails sent to our @sempal.ie addresses | Emails you send us |
| Sentry | Collects crash reports (EU data centre) | Crash reports |
| Google Play and Apple App Store | Distribute the app and, in future, handle payments | Covered by Google's and Apple's own privacy policies |
Your college: when you add a calendar link, we fetch your timetable from your college's website. We don't send your college any of your data.
Classmates: class alerts you report are shown to students who have the same class. Campus notices are shown to students at that campus. Your name is never shown with them.
We may share data if the law requires it, or to protect someone's safety. If SemPal is ever sold or merged, your data would move to the new owner under this policy, and we'd tell you first.
International transfers
Some suppliers, including Anthropic, Expo and ImprovMX, process data outside the European Economic Area, mainly in the United States. Where data leaves the EEA, we rely on the EU–US Data Privacy Framework where the supplier is certified, or on the European Commission's Standard Contractual Clauses.
Our database and files are hosted by Supabase in the EU (Ireland, eu-west-1).
How long we keep it
| Data | How long |
|---|---|
| Your account, profile, modules, deadlines, classes and calendar links | Until you delete your account |
| Uploaded files | Until you remove them, or delete your account |
| Class alerts and votes | Shown until the class ends; kept for 90 days after that to deal with abuse reports, then deleted |
| Campus notices and reports | Shown until they expire; kept for 90 days, then deleted |
| Moderation records (reports, bans) | For as long as needed to keep the app safe, up to 2 years |
| Support emails | Up to 2 years |
| Crash reports | Up to 90 days |
When you delete your account, your account, profile, study information and uploaded files are deleted straight away. Copies in our backups are removed within 30 days.
How we keep it safe
Data is encrypted while it travels between the app and our servers. Each student can only access their own data. Our secret keys are only kept on the server, never in the app.
Your rights
Under the GDPR you can:
- See your data: ask for a copy of what we hold about you.
- Correct it: most of it you can change yourself in the app. Ask us for anything else.
- Delete it: go to Profile → Delete account. This deletes your account and data. Or email us.
- Take it with you: ask for your data in a format you can reuse.
- Object or restrict: ask us to stop or limit using your data for things based on legitimate interests.
- Withdraw permission: turn off notifications, camera or photo access in your phone's settings at any time.
Email support@sempal.ie to use any of these rights. We'll reply within one month.
If you're unhappy with how we handle your data, you can complain to Ireland's Data Protection Commission (dataprotection.ie). We'd appreciate the chance to fix it first.
Age
SemPal is for students aged 16 and over. If you're under 16, please don't use it. If we learn that someone under 16 has an account, we'll delete it.
Changes to this policy
If we make important changes, we'll tell you in the app or by email before they take effect. The date at the top shows when this policy last changed.
Contact
Email: support@sempal.ie