Privacy Policy

This Privacy Policy explains what personal data CenterNest collects, how we use and protect it, and the rights you have. It applies to our website getcenternest.com and to the CenterNest application. By using the Service, you agree to the collection and use of information as described here.

The data controller is Sara Abdelwahid, an individual sole trader based in Marrakesh, Morocco, trading as CenterNest. For any question about your data, write to support@getcenternest.com.

We follow Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data. Because our customers may be anywhere in the world, this policy also includes the wording required by the European Union’s General Data Protection Regulation (GDPR), and by California law (CCPA/CPRA and CalOPPA).

In this Privacy Policy:

• “We”, “us”, “our” means Sara Abdelwahid, an individual based in Morocco, who provides CenterNest. For the purposes of the GDPR, we are the data controller of Account Data.
• “Service” means the CenterNest website (getcenternest.com) and application.
• “Centre” means a tutoring school, training centre or other organisation that has created a CenterNest account.
• “Account” means a unique account created for you to access the Service.
• “You” means the person using the Service, or the Centre on whose behalf that person uses it.
• “Personal Data” means any information that relates to an identified or identifiable person.
• “Account Data” means Personal Data about Centres and their users (name, email and so on), which we control.
• “Centre Data” means the records a Centre enters about its students, parents, teachers and finances. The Centre controls this data; we process it only on the Centre’s behalf (under the GDPR, we are its “processor”).
• “Usage Data” means data collected automatically when the Service is used, such as IP address, browser type and the time of a request.
• “Service Provider” means a company that processes data on our behalf to help us run the Service.
• “Cookies” means small files placed on your device by a website.
• “Country” refers to the Kingdom of Morocco.

Account Data. When a Centre signs up and adds users, we collect each user’s first and last name and email address, and a password, which is stored only in hashed form that nobody can read. We also store the Centre’s name, logo, currency and settings.

Centre Data. Whatever a Centre chooses to enter. This typically includes students’ names, phone numbers, email and home addresses, academic levels, enrolments, attendance, payments and notes; teachers’ names, contact details and pay; and the Centre’s expenses.

Payment information. Users can pay for our Service. Payments are processed by Paddle.com, our reseller and Merchant of Record. Paddle collects your card or other payment details directly; we never see or store them. Paddle tells us your plan, the status of your subscription and your billing email address.

Usage Data. Our servers automatically record IP addresses, browser type and version, the pages requested and the time of each request. We use this only for security and to fix problems.

We do not offer sign-in with Facebook, Google, X (Twitter) or any other social network, and we do not collect information from social media profiles.

For each use, we name the data involved and its legal basis (explained in section 13):

• to provide and maintain the Service, including sign-in and the features you use — Account Data and Centre Data; contract;
• to manage your Account, trial and subscription — Account Data and payment information; contract;
• to contact you by email about your Account (see section 5) — name and email address; contract;
• to provide support when you ask for it — the data your request concerns; contract;
• to keep the Service secure, prevent abuse and fix errors — Usage Data; legitimate interests;
• to meet our legal obligations, such as keeping billing records — payment information; legal obligation.

We do not sell Personal Data. We do not use Centre Data for our own purposes, and we only look at a Centre’s records when the Centre asks us to help with a support request, or when the law requires it.

We send emails only when they are needed to run your Account:

• to confirm your email address and to reset a forgotten password;
• about your trial, subscription and payments (some of these come from Paddle);
• important notices, such as changes to these policies or to our prices.

We do not currently send marketing or newsletter emails. If we start, we will only send them to those who agree, and every one will contain a link to unsubscribe.

We do not use analytics or tracking tools such as Google Analytics. We do not show advertisements in the Service, and we do not use remarketing or behavioural advertising services. We do not use third-party tools such as reCAPTCHA, Mouseflow or Google Places. If this changes, we will update this policy first.

The Service uses only what it needs to work:

• Necessary cookies — a session cookie that keeps you signed in, and a security cookie that protects forms against forgery (CSRF). Without them you cannot sign in.
• Preferences — your browser’s local storage remembers your language, light or dark mode, and which notifications you have read. This stays on your device.

We do not use advertising or tracking cookies. When you pay, Paddle’s checkout may set its own cookies, which are covered by Paddle’s privacy policy.

We share Personal Data only with the Service Providers we need to run the Service:

• Paddle.com — our reseller and Merchant of Record, which processes payments and is an independent controller of the details you give at checkout;
• our hosting provider — which runs our servers and stores the database;
• Cloudflare — which manages our domain and forwards emails sent to our support address;
• our email delivery provider — which sends service emails.

Each may use the data only to provide their service to us. Where needed, we may also share Personal Data with professional advisers such as accountants or lawyers, who are bound by confidentiality. We may disclose Personal Data if a court, tax authority or other competent authority lawfully requires it, or if the Service is ever transferred to a new owner, in which case this policy will continue to protect your data and we will tell you before it happens.

Some of our Service Providers are located outside Morocco and outside your own country, so your Personal Data may be processed abroad. We choose providers that protect data to a standard comparable to Moroccan law and the GDPR, and where the GDPR requires it, transfers are covered by appropriate safeguards such as the European Commission’s standard contractual clauses.

We keep Account Data and Centre Data for as long as the Centre’s Account exists, including while it is read-only after a trial or subscription ends, so the Centre can come back or export its data. When a Centre asks us to delete its Account, we delete its data within 30 days; copies in backups are overwritten within a further 30 days. Usage Data in server logs is kept for a short period for security. Billing records are kept for as long as tax law requires.

A Centre can also erase its own records at any time from Settings → Database.

• all traffic to the Service is encrypted (HTTPS);
• each Centre’s data is kept separate, and one Centre can never see another’s;
• passwords are stored hashed, never in readable form;
• access inside each Centre is limited by the roles and permissions the Centre sets;
• our own administrator access is protected by two-factor authentication;
• we take regular backups of the database.

No method of sending or storing data over the internet is 100% secure, but we use commercially reasonable means to protect your data.

Wherever you live, you can ask us to:

• tell you what Personal Data we hold about you, and give you a copy;
• correct data that is wrong or incomplete;
• delete your data;
• stop or limit using your data, or object to how we use it, for legitimate reasons.

Account administrators can view, correct and export most data directly in the Service. For anything else, write to support@getcenternest.com. We answer within one month and may ask you to prove your identity first. If your data was entered by a Centre, please contact that Centre first; we will help it answer you.

In Morocco, you can complain to the data protection authority, the CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel). Elsewhere, you can complain to your local authority.

We process Account Data on these legal bases:

• Contract — to provide the Service you signed up for, manage your Account and take payment;
• Legitimate interests — to keep the Service secure and to improve it, in ways you would reasonably expect;
• Legal obligation — to keep billing records and answer lawful requests;
• Consent — where we ask for it, for example for marketing emails; you can withdraw it at any time.

In addition to the rights in section 12, you have the right to data portability (to receive your data in a structured, machine-readable format — the export in Settings → Database provides this), and the right to complain to the supervisory authority in the country where you live or work.

For Centre Data, the Centre is the controller and we act as its processor: we process it only on the Centre’s instructions, keep it confidential and secure, and help the Centre answer requests from the people concerned.

In the last 12 months we have collected these categories of personal information: identifiers (such as name and email address), commercial information (such as your subscription and payment history, handled by Paddle) and internet activity (Usage Data). We collect them from you directly and from your use of the Service, for the purposes described in section 4, and share them only with the Service Providers in section 8.

We do not sell or share personal information for money or for cross-context behavioural advertising, and we have not done so in the last 12 months. We do not use sensitive personal information for purposes other than providing the Service.

California residents have the right to know what personal information we collect, use and disclose; to request its deletion; to correct inaccurate information; to opt out of sale or sharing (although we do neither); and not to be discriminated against for using these rights. To use them, write to support@getcenternest.com. You may also authorise an agent to make a request for you.

Under the California Online Privacy Protection Act (CalOPPA), we state that: anyone can visit our website anonymously; this policy is linked from every page of our website; and we will tell you about changes to it on this page. Because we do not track users across websites over time, we do not change our behaviour in response to “Do Not Track” browser signals, and we do not allow third parties to do such tracking on our Service.

The Service is not directed to children under the age of 13, and we do not knowingly collect Personal Data directly from them. CenterNest accounts are for Centres and their adult staff.

Centres may record information about students who are minors. The Centre is responsible for obtaining the consent of parents or guardians where the law requires it. If you are a parent and believe your child’s data was entered without your consent, please contact the Centre, or write to us and we will help.

The Service may contain links to websites we do not operate, such as Paddle’s. We are not responsible for their content or privacy practices, so please read the privacy policy of every site you visit.

We may update this policy from time to time. We will post the new version on this page and change the “Last updated” date above. If a change is significant, we will also tell Account administrators by email or in the Service before it takes effect.

If you have any questions about this Privacy Policy, you can contact us by email: support@getcenternest.com. See also our Terms of Service and Disclaimer.