Privacy Policy for SeatSheet
Last updated: July 29, 2026
This Privacy Policy explains how SeatSheet and Edlabs AS process personal data about teachers, other users, customers, contact persons, and visitors. It also explains how responsibility is allocated for student data entered by teachers in SeatSheet.
1. Who is responsible?
SeatSheet is provided by:
Edlabs AS
- Company registration number: 936 155 553
- Hovseterveien 68J, 0768 Oslo, Norway
- Email: hello@seatsheet.com
- Phone: +47 92 29 71 85
Edlabs AS is the data controller when we determine why and how personal data is processed, including for user accounts, customer administration, product analytics, support, sales, orders, payments, and marketing.
When a school or municipality uses SeatSheet and a teacher enters student data as part of the school’s activities, the school or municipality is the data controller. Edlabs AS then processes the student data as a data processor in accordance with the school’s instructions and the applicable data processing agreement.
2. Who uses the service?
SeatSheet is used by teachers and other authorized staff. Students do not create accounts or sign in to the service.
3. Data we process
User account and sign-in
We may process:
- name and email address
- Firebase user ID (UID)
- selected sign-in method and necessary identity information from Feide, Google, or Microsoft
- account, license, and user settings
- times of registration, sign-in, and account events
Sign-in is available with email and password, Feide, Google, and Microsoft. Firebase Authentication sends necessary account emails, such as email verification and password reset messages.
Student, class, and collaboration data
A teacher may enter:
- the student’s first name or the name the teacher chooses to enter
- optional gender
- a class nickname or identifier
- classroom layout and seat
- group compositions
- rules about who should or should not sit or work together
- seating and group composition history
- collaboration statistics
Student, class, and collaboration data is stored in Google Cloud/Firebase.
SeatSheet is not intended for health data or other special categories of personal data. Teachers must not enter diagnoses, disabilities, religion, ethnicity, or reasons that reveal such information. Collaboration rules are entered without sensitive explanations.
Usage and product analytics
To understand how the service is used and improve the product, Edlabs AS processes information that may be linked to a teacher account, including relevant usage events.
Identifiable account and usage data is stored in Neon in Frankfurt. The data may be displayed in Edlabs AS’s administrative sales and product dashboard. Access is restricted to authorized personnel.
Troubleshooting and security
Sentry is used for error logging and limited performance monitoring in the signed-in app. We limit the data sent, use a pseudonymous user identifier, and do not send email addresses or student names as user data. Technical identifiers and information from underlying errors may occur in error events.
Website and app analytics
We use Plausible Analytics on the public website and in the signed-in app. Plausible receives page views and aggregate usage events. We do not send user IDs, email addresses, or student names to Plausible.
Plausible does not use cookies or persistent identifiers. Raw IP addresses are not stored, and visitor data is processed in the EU.
Orders, licenses, and payment
When an order or payment is made, we may process:
- the purchaser’s name and contact details
- school, municipality, or other organization
- order, license, subscription, and invoice data
- country, language, and relevant correspondence
- payment status and identifiers from Stripe
Stripe is used for both individual subscriptions and school licenses. Edlabs AS does not receive or store complete card details.
Support, feedback, and email
When you contact us or send feedback, we may process your name, email address, message content, relevant account details, and technical information you provide.
Resend is used for support and feedback messages, internal notifications about school license orders, order confirmations, other transactional messages, information, and marketing. Marketing is only sent to registered users who have consented to it. Marketing emails contain an unsubscribe link.
4. Why we process the data
| Purpose | Legal basis |
|---|---|
| Create an account, authenticate the user, and provide agreed features | Necessary to enter into or perform a contract, GDPR Article 6(1)(b). For users covered by a school agreement, processing may also be necessary for the school’s and Edlabs AS’s legitimate interest in administering and securing the service, point (f). |
| Process student data for a school or municipality | The school or municipality determines the legal basis. Edlabs AS processes the data as a processor under documented instructions. |
| Secure the service, prevent misuse, and troubleshoot | Legitimate interest in secure and stable operations, GDPR Article 6(1)(f). |
| Analyze usage and improve SeatSheet | Legitimate interest in understanding service usage and developing the product, GDPR Article 6(1)(f). |
| Process orders, subscriptions, and payments | Necessary to enter into or perform a contract, point (b), and to comply with legal obligations related to accounting and tax, point (c). |
| Respond to support requests and process feedback | Performance of a contract and legitimate interest in customer service and product improvement, points (b) and (f). |
| Send necessary account, license, and service messages | Performance of a contract and legitimate interest in administering the customer relationship, points (b) and (f). |
| Send marketing to registered users who have chosen it | Consent, GDPR Article 6(1)(a). |
When we rely on legitimate interests, we balance the need for the processing against the privacy impact on the data subject. You may object to such processing by contacting us.
5. Service providers and recipients
We use the following providers when Edlabs AS is the data controller:
| Provider | Purpose and processing location |
|---|---|
| Google Cloud/Firebase | User accounts, authentication, and student and app data. Firebase App Check with reCAPTCHA is used to protect the service against misuse. Student and app data is processed in Belgium. According to Google’s documentation, Firebase Authentication is processed in the United States. |
| Neon | Account, order, lead, feedback, and identifiable usage data. The database is located in Frankfurt. |
| Vercel | Hosting of the public website and backend for licenses and orders. Vercel may process request data and operational logs in the United States and other countries. |
| Resend | Transactional emails, support, feedback, information, and marketing. Email is sent from Ireland, while certain account data, metadata, and logs are stored in the United States. |
| Stripe | Payments, subscriptions, payment status, and fraud prevention. Stripe may process data in several countries depending on the service and payment flow. |
| Sentry | Error logging and limited performance monitoring. Event data is stored in Frankfurt, while some account and operational metadata may be processed in the United States. |
| Plausible Analytics | Aggregate, cookie-free analytics on the website and in the app. Visitor data is processed in the EU and raw IP addresses are not stored. |
Feide is provided by Sikt and the user’s host organization. Google and Microsoft are external identity providers when the user selects these sign-in methods. These providers may process data as independent data controllers under their own terms.
6. Processing outside the EEA
Some providers or their subprocessors are established outside the EEA or process data there. This includes Firebase Authentication, certain services and metadata at Sentry, Resend, and Vercel, and parts of Stripe’s international payment infrastructure.
When personal data is transferred outside the EEA, we use the providers’ data processing agreements and a valid transfer mechanism, such as the European Commission’s Standard Contractual Clauses, supplementary measures where applicable, or an adequacy decision such as the EU–US Data Privacy Framework when its conditions are met.
7. How long we retain data
- Active account, student, class, rule, seating, group, history, and statistics data in Firebase is retained while the account and relevant class or school agreement remain active, unless deleted earlier.
- Copies in provider-managed backups may remain until overwritten under the provider’s ordinary rotation. They are not used for ordinary purposes.
- Detailed, identifiable usage events in Neon are deleted no later than 24 months after the event was recorded. Account-linked totals and product metrics are retained while the account is in use, but deleted after 24 months of inactivity or earlier when the user deletes the account, unless continued retention is necessary for another documented purpose and legal basis.
- Data about leads that do not become customers is deleted no later than 12 months after the last contact.
- Support requests and identifiable feedback are deleted or anonymized no later than 24 months after the matter is closed. Data may be retained longer where necessary to document an agreement, comply with a legal obligation, or handle a legal claim.
- Resend states that email data is retained for 30 days by default. Any copies of email content or metadata that SeatSheet stores in other systems follow the retention period for the relevant purpose.
- Technical error events and security logs are retained only for as long as necessary for operations and security and are deleted under the configured rotation.
- Evidence of marketing consent is retained while consent is used as the legal basis and for as long as necessary to demonstrate that the communication was lawful. When consent is withdrawn, marketing stops. A limited suppression record may be retained to ensure the unsubscribe request is honored.
- Accounting records are generally retained for five years after the end of the financial year, while other agreement and order materials are retained for as long as accounting rules or the need to document the agreement requires.
8. Account deletion
The user can delete their account in SeatSheet. Deletion covers active account, student, class, and usage data associated with the user in Firebase and Neon.
Deleting an account does not necessarily mean that all data is immediately deleted from every system. Data may still be retained where necessary for:
- accounting and other legal obligations
- documenting orders, payments, or legal claims
- honoring a marketing unsubscribe request
- backups and security logs until ordinary overwriting
9. Information security
We use technical and organizational measures appropriate to the nature and risk of the data, including:
- access controls and strong authentication for administrative systems
- encryption in transit and at providers where supported
- data minimization in logs, error events, and test environments
- procedures for deletion, backups, and handling security incidents
10. Your rights
When Edlabs AS is the data controller, you may request:
- access to the personal data we process about you
- correction of inaccurate or incomplete data
- deletion where the conditions are met
- restriction of processing
- data portability for data covered by this right
- objection to processing based on legitimate interests
- withdrawal of consent without affecting the lawfulness of prior processing
Contact hello@seatsheet.com.
For student data, the school or municipality is the data controller. Requests concerning a student’s rights should therefore normally be directed to the school. Edlabs AS assists the school in accordance with the data processing agreement.
If you believe personal data is being processed in breach of applicable law, you may lodge a complaint with the data protection authority where you live or work, where the alleged infringement took place, or with the Norwegian Data Protection Authority.
11. Marketing and consent
Registered users may voluntarily consent to receive marketing about SeatSheet by email. Consent is not required to create an account or use the service.
We record when and how consent was given and what information the user received. Consent may be withdrawn at any time through the unsubscribe link in the email or by contacting hello@seatsheet.com. Withdrawal does not affect the lawfulness of communications sent before consent was withdrawn.
Necessary messages about accounts, security, orders, payments, licenses, or material changes to the service are not marketing and may be sent where necessary to provide or administer the service.
12. Changes
We may update this Policy when the service, providers, or applicable law changes. Material changes will be announced in the service, on the website, or by email where necessary.