Privacy policy
Version 1.3, November 2026.
TASA is a study planner for children, free for families. This policy explains in plain language what data we collect, why, how long we keep it, and the rights of the child and the parent.
In short, for children
TASA helps you see what to do today, in small steps. To do that, we know your first name, school, class and what homework and tests you have. Your teachers can’t see your plan. Your data is never sold and there are no ads. If you are 13 or older, you give consent to use TASA yourself. If you don’t want to any more, everything can be deleted with one button. Questions: maria@sildpartners.com.
1. Who is responsible
The controller is Sild Growth OÜ (registry code 14067479), Telliskivi 33-1, 10611 Tallinn, Estonia. Questions and requests: maria@sildpartners.com, +372 5826 2802.
The current version of the TASA app keeps all data on the phone only. We cannot see it and it goes nowhere. This policy also covers the school pilot version, where data is stored securely on a server in the European Union so that the child’s and the parent’s phones can share it and homework from the e-diary can reach the app.
2. What data we collect
From the parent: name, email address, the parent PIN (stored only in encrypted form), date of consent.
About the child:
- first name or nickname, school and class;
- from the e-diary (eKool or Stuudium): homework, deadlines, test dates and topics, and grades needed to plan a retake;
- tasks the parent adds by hand (for example a book, or work a teacher did not post in the e-diary);
- the plan and its progress: which steps were done and when, the daily study time;
- the reward settings and balance the parent chose;
- a test photo, if the parent takes one (see section 4), and the problem numbers read from it.
What is required and what is optional: no data is required by law. To use TASA we need the child’s first name, school and class and a parent’s email; without them an account can’t be created. The e-diary connection, test photos, rewards and pilot interviews are optional; TASA works without them, tasks are just added by hand.
Where data comes from: from the parent and the child in the app, and from the e-diary (eKool or Stuudium) with the school’s permission. We fetch nothing from the e-diary before the family has given consent and knows about it.
What we do not collect: diagnoses or health data, e-diary passwords, location, contacts, advertising or tracking data. TASA shows no ads and never sells data.
3. Why we use data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Building and showing the child’s daily plan, counting rewards | Parent’s consent (GDPR art 6(1)(a), Estonian Personal Data Protection Act § 8) |
| Fetching tasks from the e-diary | Consent. A precondition is also the school’s written permission for the e-diary to share the data; the school’s permission is not itself our legal basis |
| Reading wrong problem numbers from a test photo | Parent’s consent |
| Evaluating the pilot (usage statistics, interviews) | Parent’s consent to take part in the pilot |
| Security and fixing errors (technical logs) | Legitimate interest in keeping the service secure (art 6(1)(f)) |
| Answering a school’s or partner’s enquiry sent through the website form | Legitimate interest in answering the enquiry (art 6(1)(f)) |
Legitimate interest balancing: we keep logs only to keep the service secure and find errors, never to track users. Logs hold only the IP address, time and action, are kept up to 30 days and are seen only by technical support. Interest form data is used only to answer the enquiry, which the school sent itself and expects an answer to. In both cases we find the impact on people small and outweighed by our interest (a secure service, answering enquiries). You can object at maria@sildpartners.com.
Who gives consent: for a child under 13, a parent or guardian consents (one parent’s consent is enough; if it turns out the other parent does not agree, there is no valid consent and we stop processing). A pupil aged 13 or older gives consent themselves; we also want the parent to know. We ask for separate consent for each purpose and keep a record of when and how consent was given.
Consent can be withdrawn at any time. This does not make earlier processing unlawful, but we stop processing and delete the data as described in section 8.
4. Test photos and AI
AI does one thing in TASA: it reads from the parent’s photo which problem numbers were wrong. It does not solve problems, create practice tasks or assess the child. The parent checks and can edit the result. The child never sees the photo or the grade, only the practice steps. The photo is deleted right after reading; only the list of problem numbers is kept. The AI provider processes the photo in the EU and does not use it to train its models.
The plan follows simple rules (nearest deadline first, steps of about 25 minutes). The plan is a suggestion: the child and parent can change, postpone or excuse steps. We make no automated decisions about the child with legal or similarly significant effects.
5. Who sees the data
- The child sees their daily plan and reward balance.
- The parent sees the parent view, protected by a PIN. The child cannot see the parent view.
- Teachers and the school do not see the child’s plan or data. At the end of the pilot the school gets a summary report in which no child can be identified.
- Sild Growth OÜ staff access data only when needed for technical support or at the parent’s request.
- Service providers (processors) under a data processing agreement: hosting and database in the EU, an AI service in the EU for reading photos, and an email delivery service. The current list of providers is available on request. They process data only on our instructions.
- eKool and Stuudium send data to TASA with the school’s permission, agreed with the school in writing. The school is the controller of the e-diary data; Sild Growth OÜ is the controller of the data used in the TASA app. We send nothing back to the e-diary.
6. The tasaplan.ee website
The website uses no cookies or tracking tools. The demo runs only in your browser and sends us no data.
- Interest form: when a school or partner fills in the form, we receive the school or organisation, the contact name and role, email, which e-diary they use and any message. The form is delivered to our email by Formspree (Formspree Inc., USA). We keep this data as long as the conversation needs it, and no longer than 2 years.
- Hosting and fonts: the site is hosted on GitHub Pages (GitHub Inc., USA) and its fonts come from Google Fonts (Google, USA). For technical reasons these services see the visitor’s IP address.
Transfers to these US services rely on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. No child or family data from the TASA app is sent to these services.
7. Where data is stored
TASA app data is stored in the European Union and we do not transfer it outside the European Economic Area. If that ever becomes necessary, we will tell you in advance and use GDPR safeguards.
8. How long we keep data
- Test photo: deleted right after reading.
- Account data: while the account is in use. After a deletion request or closing the account, we delete the data within 30 days, including backups.
- Pilot data: deleted or anonymised no later than 3 months after the pilot ends, unless the family keeps using TASA.
- Technical logs: up to 30 days.
- Proof of consent (who agreed to what, and when): for as long as we process the data and up to 3 years after the account is closed, so we can show consent if needed. If purposes or conditions change, we ask for new consent.
9. Your rights
For themselves and for their child, the parent can (a pupil aged 13 or older who gave consent themselves can also withdraw it and ask for their data to be deleted):
- see what data we hold and get a copy;
- have wrong data corrected;
- delete all data with one button in the app, or by email;
- download the data in a machine-readable format;
- restrict processing or object to it;
- withdraw consent at any time.
We answer requests as soon as possible and within one month at the latest. For a complex request this can be extended by up to two months; we tell you within the first month if so. You can complain to the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon (Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee).
10. Security
Data is encrypted in transit and protected on the server. The parent view is behind a PIN. Access to data is limited. We report a data breach to the Data Protection Inspectorate within 72 hours, and to families without delay if it may affect them.
11. Changes
If this policy changes, we publish the new version on this page and tell parents about important changes in advance. If a change needs new consent, we will ask for it.