Privacy Policy

Effective date: September 29, 2026 · Last updated: September 29, 2026

This Privacy Policy explains how Lothlorien Labs (“we”, “us”) handles personal information in eSkwela: the eSkwela mobile apps for Android and iOS (the “App”) and the eSkwela school dashboard at admin.e-skwela.com (the “Dashboard”). Together we call them the “Services”.

eSkwela is provided to schools. Each school decides what information it puts into eSkwela and how it communicates with its students, parents and staff. For that information, the school is the personal information controller and we act as its personal information processor, handling it only on the school’s instructions and as described here. We follow the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules.

1. Information we collect

When you use the App

• Sign-in information. When you sign in with Google or Apple, we receive your account identifier, email address, name and profile photo from that provider. If you use Apple’s “Hide My Email”, we receive the relay address Apple gives us instead. We never receive your Google or Apple password.
• Messages you send. The content of chat messages you exchange with your school, along with the time they were sent and the display name shown to the school.
• Student ID. Before you can message a school, the App asks for a Student ID, which is checked against the school’s records. A valid ID shows the student’s first name in the greeting.
• Faculty link code. If you are a school staff member, you may enter a one-time code from your school to link your sign-in to your staff record.
• Device and app information. An app-generated identifier for your installation (used to keep your chat conversation with the school) and, if you allow notifications, a push notification token issued by Firebase Cloud Messaging.

The App does not request access to your location, contacts, camera, microphone or files, and it does not show advertising.

When a school uses the Dashboard

• School staff accounts: name, username, email address, role and an encrypted (hashed) password.
• Records the school enters: student details such as name and student ID, grade level and section; faculty and staff details such as name, position, staff ID, mobile number, email and photo; announcements, events, downloadable forms and emergency (SOS) contacts.
• Photos and documents that school staff upload for announcements, events, faculty profiles and forms.

When you visit e-skwela.com

If you request eSkwela for your school on our Get started page, we collect the school name, your work email and, if you provide them, a contact number and the school’s Facebook page. We use these only to contact you about eSkwela.

Our website uses Google Analytics to understand how visitors use it, such as pages viewed, approximate location derived from your IP address, and device and browser type. You can opt out with your browser’s privacy settings or the Google Analytics opt-out add-on.

2. How we use information

• To sign you in and keep you signed in.
• To show you your school’s announcements, events, faculty directory, forms and emergency contacts.
• To deliver messages between you and your school, and to verify that you are connected to the school before messages reach its staff.
• To send push notifications about new announcements, events and chat replies.
• To let school staff manage their school’s records and reset forgotten passwords by email.
• To keep the Services secure, prevent abuse (for example, limiting repeated wrong Student ID attempts) and fix problems.

We do not sell personal information, and we do not use it for advertising or to build marketing profiles.

3. How information is shared

With your school. Messages you send, your display name, profile photo and verified student link are visible to your school’s authorized staff. Each school can only see its own data.

With service providers who run parts of the Services for us, only as needed to provide them:

When required by law. We may disclose information if required by law, court order or a lawful government request, or to protect the safety of students, staff or the public.

4. Automated chat replies

Schools can turn on an assistant that answers common questions automatically. When it is on, your chat messages, together with the school’s public information such as announcements and events, are sent to Anthropic’s Claude AI to write a reply. School staff can see these conversations and can take over from the assistant at any time. Anthropic processes this information to provide the service to us and does not use it to train its models.

5. How long we keep information

We keep information for as long as your account is active or the school uses eSkwela, and as long as needed for the purposes described in this policy. When a school ends its subscription, we delete or return its data at the school’s request. Push notification tokens are removed when you sign out or when Firebase reports them as no longer valid. Backups are overwritten on a rolling basis.

6. Deleting your account and data

• Chat messages: you can delete individual messages, or your whole conversation with a school, from inside the App.
• Your App account: email contact@lothlorienlabs.com with the subject “Account deletion request”. Send it from the email address you sign in with, or include it in your message. We will delete your account, your sign-in details, your chat conversations and your push notification tokens within 30 days and confirm by email.
• Records held by your school (for example, student or staff records): ask your school directly, since it controls that information. We will help the school fulfil your request.

We may keep a limited record of the deletion request itself, and information we are legally required to retain.

7. Your rights

Under the Data Privacy Act of 2012, you have the right to be informed, to access, to object, to correct, to erasure or blocking, to data portability, and to file a complaint with the National Privacy Commission (privacy.gov.ph). To use any of these rights, contact us at the address below or contact your school. We will respond within a reasonable time and may need to verify your identity first.

8. Security

Information is encrypted in transit (HTTPS) and stored with our hosting providers’ encryption at rest. Staff passwords are stored only as hashes, and one-time faculty codes are stored only as hashes. Access to each school’s data is limited to that school’s authorized staff and to our team where needed to operate the Services. No method of transmission or storage is completely secure, but we work to protect your information and will notify affected schools, users and the National Privacy Commission of a personal data breach as the law requires.

9. Children and students

eSkwela is used by schools that may serve students under 18. Student records are entered by the school, which is responsible for obtaining any consent needed from parents or guardians. The App is intended for use by students, parents, guardians and staff of participating schools. It has no advertising and no in-app purchases, and it collects only what is described above. If you believe a child has given us personal information without appropriate consent, contact us and we will work with the school to address it.

10. Where information is stored

Our servers and database are located in Japan (Tokyo), and some files and email services run in the United States. Our providers may process information in other countries. When information leaves the Philippines, we require these providers to protect it as described in this policy and as required by the Data Privacy Act.

11. Changes to this policy

We may update this policy as the Services change. We will post the new version on this page with a new “Last updated” date and, for significant changes, notify schools or show a notice in the App.

12. Contact us

For questions, requests or complaints about privacy, contact our Data Protection Officer:

Lothlorien Labs — eSkwela
Email: contact@lothlorienlabs.com
Website: e-skwela.com