Nativora System

Privacy Policy

Last updated: 14 September 2026  ·  Effective: 14 September 2026

This Privacy Policy explains how Antara Arceneaux (“Nativora”, “we”, “us”) collects, uses, shares, and protects personal data in the Nativora System platform (the “Platform”) — a management system for academies and driving schools covering enrolment, courses, live and on-site classes, attendance, assessments, document signing, messaging, and payments.

1. Who controls your data

The Platform is multi-tenant: each academy or driving school (a “School”) operates its own isolated workspace, and data is scoped to that School throughout.

• Schools are the data controllers for their students, instructors, and administrators. A School decides who to enrol, what courses and classes to run, what attendance to record, and what documents to require.
• Nativora is the data processor acting on a School’s instructions, and the controller only for the limited data we need to operate the Platform itself — account credentials, platform subscription billing, security logs, and support correspondence.

If you are a student or instructor, direct requests about your learning records to your School first. We will assist the School in responding.

2. Data we collect

Account and profile

• Name, email address, and a password (stored only as a bcrypt hash — never in readable form).
• Optional profile details: date of birth, gender, phone number, residential address, profile photo.
• Role (student, instructor, school administrator, or platform superadmin) and the School you belong to.
• Account state: email verification, last login, and whether the account is suspended or blocked.
• One-time passcodes used for email verification and password reset, stored only as SHA-256 hashes.

Learning records

• Enrolment applications and their status through the request → approval → payment → access flow.
• Courses, chapters, and lessons assigned to you, and your video watch progress per lesson.
• Quiz attempts and answers, assignment submissions and uploaded attachments, and grades or feedback from an instructor.
• Orientation and onboarding form responses configured by your School.

Attendance

• Attendance records per class session: status (Present, Absent, Late), the method used (manual marking by an instructor, QR code scan, or derived from Zoom), who marked it, when, and any notes.
• For live classes, participation evidence derived from Zoom meeting events: seconds attended, percentage of the class attended, first join and last leave times, and number of joins.

Documents and signatures

• Policy acknowledgements and electronic signatures you apply to School documents, together with the time of signing.

Communications

• Messages and file attachments you send in course chats and class-group chats, and read receipts.
• Notification preferences, and device push tokens used to deliver notifications.
• Transactional emails we send you (verification, password reset, welcome, reminders, reports).

Payment-related

• Payment records: amount, currency, status, and the identifiers issued by our payment processor.
• Instalment plans and their schedules, where a School offers them.

We never receive or store full card numbers, CVC codes, or bank credentials. See Payments.

Technical

• Authentication tokens issued to your browser or app, and a token version counter used to revoke sessions on logout.
• Server logs containing request metadata such as IP address, timestamp, and endpoint, used for security and debugging.

3. How we use data

• Provide the service — authenticate you, show your courses and classes, record attendance, run assessments, deliver messages, and issue receipts.
• Administer enrolment and access — a School administrator reviews your enrolment request; access to course content is granted once the enrolment is approved and paid.
• Process payments — collect enrolment and tuition fees on behalf of your School, and collect a School’s own subscription to the Platform.
• Communicate — send transactional email and, if enabled, push notifications about classes, assignments, payments, and messages. You can adjust notification categories in your profile.
• Keep the Platform safe — rate limiting, abuse prevention, and investigating suspected misuse.
• Improve the Platform — diagnose faults and improve reliability and usability.

We do not sell personal data, and we do not use your learning records for advertising.

4. Legal bases

Where data-protection law requires a legal basis, we rely on:

• Contract — to provide the Platform to you and to your School.
• Legitimate interests — security, fraud prevention, service improvement, and defending legal claims, balanced against your rights.
• Consent — optional features such as push notifications and optional profile fields. You may withdraw consent at any time.
• Legal obligation — accounting, tax, and any record-keeping a School is required by law to maintain.

5. Sharing and third-party services

We share data only as described here. Our service providers process data on our instructions.

We may also disclose data:

• Within your School — instructors and school administrators can see the learning records, attendance, submissions, and messages relevant to their role. Students never see other students’ records.
• To comply with law — where required by a valid legal process, or to protect rights, safety, and property.
• On a business transfer — in a merger, acquisition, or asset sale, subject to this policy continuing to apply.

6. Zoom integration

Live classes are hosted on Zoom using the assigned instructor’s own connected Zoom account. This section describes that integration specifically.

• Authorisation. An instructor connects their Zoom account through Zoom’s OAuth flow. We store the resulting access and refresh tokens encrypted at rest (AES-256-GCM) and use them only to create, read, update, and delete that instructor’s meetings for their classes.
• Meeting data we store. The Zoom meeting identifier, passcode, timezone, and the participant join URL. Host start credentials are deliberately not stored — they are requested from Zoom at the moment the instructor starts the class and expire shortly after.
• Participation data. We receive Zoom meeting event webhooks (meeting started and ended, participant joined and left) and use them to derive attendance: seconds attended, percentage of the class attended, join and leave times, and join count.
• What we do not access. We do not access, record, store, or process Zoom meeting audio, video, chat, transcripts, or recordings.
• Retention and deletion. Zoom-derived attendance is retained as part of the School’s academic record. An instructor may disconnect Zoom at any time from their profile, which revokes our authorisation with Zoom and deletes the stored tokens. Uninstalling the app from the Zoom Marketplace has the same effect.

7. Payments

Payments are processed by Stripe. Card details are entered directly into Stripe’s hosted checkout and are never transmitted to or stored on our servers — we retain only the transaction outcome and Stripe’s identifiers.

Two separate payment flows exist:

• Student payments to a School — enrolment and tuition fees, paid to the School through Stripe Connect.
• School subscriptions to Nativora — a School’s own subscription for access to the Platform.

Stripe processes this data as an independent controller under its own privacy policy.

8. How we protect data

• Passwords are hashed with bcrypt; one-time passcodes are hashed with SHA-256. Neither is ever stored or logged in readable form.
• Third-party credentials, such as Zoom tokens, are encrypted at rest with AES-256-GCM.
• Sessions use short-lived access tokens with longer-lived refresh tokens, and every session can be revoked centrally.
• Access is role-based and tenant-scoped: requests are restricted to the School the account belongs to.
• Transport is encrypted with HTTPS. The service applies security headers, a cross-origin request allowlist, request size limits, and rate limiting.
• Payment webhooks are verified by cryptographic signature before being accepted.

No system is perfectly secure. Keep your password confidential, do not reuse it elsewhere, and tell us promptly if you suspect unauthorised access to your account.

9. Retention and deletion

• Account and learning records are retained while your account is active and for as long as your School needs them for academic, accounting, or legal record-keeping.
• Deleting an account removes it from the Platform and releases the email address for reuse; the underlying record is retained in a deactivated state so that historical academic and financial records stay intact and auditable.
• Chat messages you delete are hidden from view rather than erased, so that a School can meet its moderation and record-keeping duties.
• Files stored in S3 are deleted when the record referencing them is deleted, subject to the retention rules above.

Ask your School, or contact us, for the retention schedule that applies to you.

10. Your rights

Depending on where you live, you may have the right to:

• access a copy of your personal data;
• correct data that is inaccurate or incomplete — most profile fields are editable in the app;
• request erasure of your data;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent for optional processing, such as push notifications; and
• complain to your local data-protection authority.

To exercise these rights, contact your School first, or write to us at antara.apurpose@gmail.com. We may need to verify your identity before acting. Where we act as processor for a School, we will forward your request to that School and support their response.

11. Children and young learners

The Platform is designed to be used by a School, and some Schools enrol learners under the age of majority. Where a learner is a minor, the School is responsible for obtaining any parental or guardian consent required by local law before creating an account or recording personal data. We do not knowingly collect personal data from children directly. If you believe a child’s data has been provided without the necessary consent, contact us and we will work with the School to remove it.

12. Cookies and local storage

The Platform uses browser storage for strictly functional purposes: holding your authentication tokens so you stay signed in, and remembering interface preferences. We do not use advertising or cross-site tracking cookies. A School’s own website may use analytics independently of the Platform; that is governed by the School’s own policy.

13. International transfers

Our infrastructure and service providers may process data in countries other than your own, including the United States. Where data is transferred out of a jurisdiction that restricts such transfers, we rely on appropriate safeguards such as standard contractual clauses or an adequacy decision.

14. Changes to this policy

We may update this policy as the Platform evolves or the law changes. The “Last updated” date at the top reflects the current version. For material changes we will give notice in the Platform or by email before they take effect. Continued use after a change takes effect means you accept the updated policy.

15. Contact us

Antara Arceneaux
Privacy enquiries and general support: antara.apurpose@gmail.com

If you are a student or instructor, your School is the first point of contact for questions about your learning records.