Last updated: 26 October 2026

This Privacy Policy is published by EDSolutions, the developer named on our Google Play store listing. It explains what personal data we collect, why we collect it, who we share it with, how long we keep it, how it can be deleted and what rights you have.

It applies to:

• the Mentiplex Android application (package name tn.edsolutions.lms.mentiplex), distributed on Google Play;
• the EDSolutions school management and learning platform (EDLMS) and EDQuiz, which the app connects to (together with the app, the "Platform"); and
• our website at edsolutions.com.tn.

1. Our two roles: controller and processor

The way we handle personal data depends on the context, and this distinction matters for your rights:

• We act as data controller for data collected through our website, our sales and support channels, and our own business administration. Here we decide why and how the data is used.
• We act as data processor for the data held inside a school's Platform account, which is what the Mentiplex app displays. The school, institution or organisation that subscribes to the Platform is the data controller: it creates the accounts, decides which data is entered, who may see it and how long it is kept. We process that data only on the school's documented instructions, under our service agreement with it.

If you are a student, parent, teacher or staff member using Mentiplex through your school, your school is the first point of contact for questions about your data, including deletion. We will support your school in answering you, and you can always escalate to us using the contact details in section 14.

2. The Mentiplex mobile application

2.1 What the app does

Mentiplex gives students, parents, teachers and school staff mobile access to the school account they already have on the Platform. There is no sign-up inside the app: accounts are created by the school and the app only signs you in to an existing account. Through the app you can view courses and learning materials, take quizzes, see grades and gradebook entries, consult timetables, follow attendance and behaviour records, read and send messages within your school, read the school's social feed, view fees and invoices, raise support tickets and manage your profile. Parents use the same app to follow their own children.

2.2 Data the app accesses, collects, uses and shares

Data	Why the app uses it	Shared with
Account credentials you type at sign-in (username or email, password) and the authentication token returned	To sign you in and keep you signed in	Our backend servers only. Passwords are sent over an encrypted connection and are never stored on the device.
Profile information (name, email address, phone number, profile photograph, language preference, school and class)	To display your profile and address content to the right person	Our backend servers only
Academic information (courses, learning materials, assignments, quizzes and attempts, grades, gradebook entries, competency and rubric assessments, timetables)	To show you your schoolwork and results	Our backend servers only
School-life information (attendance, absences, lateness, behaviour and discipline records)	To show you or your child's school record	Our backend servers only
Messages, social-feed posts and comments, notifications and support tickets you write or receive	To deliver communication inside your school community	Our backend servers, and the members of your school whom the message or post is addressed to
Financial information (fees, invoices, payments, receipts) where the school enables it	To show families what is due and what has been paid	Our backend servers only. The app does not take payments and never asks for card numbers.
Push notification registration token and the platform label "ANDROID"	To send you notifications about messages, grades, absences and school announcements	Google Firebase Cloud Messaging, which delivers the notification to your device
Files you open or download (documents, PDFs, report cards)	To let you read them and, if you choose, save or share them	Nobody, unless you yourself use the Android share sheet to send a file to another app

The app communicates only with our own servers at backend.edsolutions.com.tn, over encrypted HTTPS and secure WebSocket connections, and with Google Firebase Cloud Messaging for push delivery. It sends data to no other destination.

2.3 Permissions the app requests

• Internet access (INTERNET) — required to reach your school's account on our servers.
• Notifications (POST_NOTIFICATIONS) — asked for when you first sign in, so we can alert you to new messages, grades, absences and announcements. You may refuse it, or turn notifications off later in Android settings or in the app; everything else keeps working.
• Vibration (VIBRATE) — short haptic feedback when you tap certain controls. No data is collected through it.

Mentiplex does not request and does not use: camera, microphone, precise or approximate location, contacts, calendar, SMS, call logs, phone number, body sensors, nearby devices, or the Android advertising ID (AD_ID). It does not read your device's files outside its own storage, and it does not transmit hardware or network identifiers such as the advertising ID, IMEI, IMSI, SIM serial, build serial, MAC address, BSSID or SSID.

2.4 Data stored on your device

The app keeps a small amount of information in its own private storage so it can work and remember your choices: your authentication token, the school you selected, your interface language and whether you enabled push notifications. This information never leaves your device except as part of signing in to our servers, and it is removed when you sign out or uninstall the app. Signing out also deletes your push notification token from our servers.

2.5 No advertising, no analytics, no tracking

Mentiplex contains no advertising and no advertising SDKs. It contains no third-party analytics, attribution or tracking SDKs. We do not build advertising or behavioural profiles, we do not carry out interest-based advertising or remarketing, we do not sell or rent personal data, and we do not use student data to train commercial advertising models. The only third-party service embedded in the app is Google Firebase Cloud Messaging, used solely to deliver the notifications described above.

3. Children's data, COPPA and the Google Play Families policy

Mentiplex is a school application and its audience includes children. We have declared a target audience that includes children in Google Play Console, and the app participates in the Designed for Families programme. We handle children's data as follows:

• No self-registration. Children cannot create an account. Accounts are created and administered by the school, which decides who gets one and what it contains.
• Consent. Where consent is required, the school obtains and manages it. Under the U.S. Children's Online Privacy Protection Act (COPPA), a school may provide consent on behalf of parents for an educational service used in the classroom context, and we rely on the school having done so. Under Article 8 of the EU General Data Protection Regulation, consent for children below the applicable age is given or authorised by the holder of parental responsibility, again through the school. Parents may ask the school to review, correct or delete their child's data, or to stop its collection.
• No advertising to children. The app shows no ads of any kind, uses no ads SDKs, and performs no interest-based advertising or remarketing.
• No advertising or device identifiers. The app does not request the AD_ID permission and transmits no Android advertising ID or other persistent hardware identifier. The only persistent identifier it uses is the Firebase push notification token, which exists solely to deliver the app's own notifications and is deleted when you sign out.
• No location, camera or microphone. The app never requests location, camera or microphone access and collects no data from them.
• Closed community. Messaging and the social feed are limited to members of the child's own school. They are not open to the public and not open to other schools. The school moderates this content and can remove posts and restrict accounts.
• Minimal collection. We collect from children only what the school needs to run its educational service, and we never use it for our own marketing.

4. Information we collect through the website and the web platform

4.1 Website visitors

• Contact and enquiry data — the name, email address, phone number, organisation and message you send us through a contact form, by email or by phone.
• Technical data — IP address, browser type and version, device and operating system, referring page, pages viewed and the date and time of your visit, collected in our web server logs.
• Comments — if commenting is enabled on a page or blog post, the content of your comment together with your name, email address, IP address and browser user agent string, used to help detect spam.

4.2 Platform accounts

Schools use the Platform to run their day-to-day operations, so the account may contain a broader range of data than the app itself displays. Depending on the modules the school has enabled and the information it chooses to enter, this can include:

• Identity and profile data — first and last name (including transliterations in Arabic, French and English), username, email address, phone number, date and place of birth, gender, nationality, national identity number (CIN) where the school records it, postal address, student code, profile photograph, and family relationships between students and parents or guardians.
• Academic data — enrolment and group membership, courses and subjects, timetables, assignments, quizzes and quiz attempts, grades, gradebook entries, competency and rubric assessments, report cards and academic history.
• School-life data — attendance records, absences and lateness, behaviour and discipline logs, punishments and related reports.
• Sensitive data — medical notes and other health or welfare information, where the school chooses to record it in order to care for a student. Schools should record this only where they have a lawful basis to do so.
• Financial data — fee structures, invoices, payments and payment methods (cash, bank transfer, card, cheque, online), payment proofs, receipts, discounts, waivers, credit notes and refunds. We do not collect or store full payment card numbers.
• Communications and content — messages, notifications, social-feed posts, support tickets, and files, images or documents uploaded by users.
• Account and security data — password (stored only in hashed form), authentication tokens, one-time codes and password-reset tokens, language and display preferences.
• Audit and usage data — a security audit trail recording events such as logins, failed logins, logouts, record creation, modification and deletion, permission and role changes, password changes, file uploads, downloads and deletions, and data exports and imports, together with the date, time and the account that performed the action.

5. Why we use personal data, and on what basis

Purpose	Basis
Providing, operating and maintaining the Platform and the Mentiplex app for a school	Performance of our contract with the school; the school's own lawful basis towards its users
Authenticating users and protecting accounts	Legitimate interest in the security of the service; legal obligation
Delivering push notifications you have agreed to receive	Performance of contract; your consent given through the Android notification permission
Keeping a security audit trail and detecting abuse	Legitimate interest in security; the school's instructions
Responding to enquiries and providing support	Your request; our legitimate interest in answering it
Issuing invoices and managing payments	Performance of contract; legal and accounting obligations
Improving reliability, diagnosing faults and planning capacity	Legitimate interest in improving our services
Sending service announcements about outages, releases or policy changes	Performance of contract; legitimate interest
Sending commercial or marketing messages	Your consent, which you can withdraw at any time. We never send these to student accounts.

6. Cookies and similar technologies

The Mentiplex app uses no cookies and no tracking technologies; it stores only the items listed in section 2.4. On our website and web platform we use:

• Strictly necessary storage — keeping you signed in, maintaining your session and protecting forms against abuse. These cannot be switched off without breaking the service.
• Preferences — remembering your language, theme, selected institution and display settings.
• WordPress cookies on this website — if you leave a comment, you may choose to have your name, email address and website saved in cookies so you do not have to fill them in again. If you have an account and sign in to this site, we set a temporary cookie to check that your browser accepts cookies, plus cookies that store your login state and screen preferences. The login cookie lasts two days, or two weeks if you select "Remember Me"; screen-option cookies last one year.

7. Who we share data with

We share personal data only with the following categories of recipient:

• Your school — the controller of the account, and the other members of your school community to the extent the school's role settings allow.
• Hosting and infrastructure providers — the servers that host the website, the Platform, its databases and its backups.
• Google (Firebase Cloud Messaging) — receives the push notification token and the notification payload in order to deliver notifications to your device, under Google's Privacy Policy.
• Google reCAPTCHA — used on sign-in and other sensitive forms on the web platform to tell humans from automated scripts.
• Zoom — where a school enables virtual classes on the web platform, meeting details and participant information are processed by Zoom under its own privacy terms.
• Email delivery providers — for transactional messages such as account activation, password resets and notifications.

These providers act on our instructions and are bound by confidentiality and data protection terms. We disclose personal data outside this circle only where the law requires it, where it is necessary to establish or defend legal claims, or where the school instructs us to. We do not sell personal data and we do not share it with data brokers or advertising networks.

8. International transfers

Our services are operated from Tunisia. Some of the providers listed above process data outside Tunisia. Where personal data is transferred abroad, we take the steps required by Tunisian Organic Law No. 2004-63 — including, where applicable, the authorisation of the Instance Nationale de Protection des Données à Caractère Personnel (INPDP) — and, for data covered by the EU General Data Protection Regulation, we rely on appropriate safeguards such as the European Commission's standard contractual clauses.

9. How long we keep data

• Platform and app data — kept for as long as the school's subscription is active and the account exists. When the agreement ends, we make the data available to the school for export for an agreed period and then delete or anonymise it, unless the school or the law requires otherwise.
• Push notification token — deleted from our servers as soon as you sign out of the app, and replaced whenever Android issues a new one.
• Audit logs — kept for the retention period configured by the school in its audit settings, then archived or deleted.
• Enquiries and support correspondence — kept for as long as needed to handle the matter and for a reasonable period afterwards.
• Invoices and accounting records — kept for the period required by Tunisian commercial and tax law, normally ten years, even after an account is deleted.
• Website comments — kept indefinitely so that follow-up comments can be recognised and approved automatically, unless you ask us to remove them.
• Server logs — kept for a short period for security and troubleshooting.

10. Deleting your account and your data

Mentiplex accounts are not created in the app and cannot be created by users: they are issued and administered by the school, which owns and controls the account. Deletion therefore runs through the school.

To have your account and its associated data deleted:

• Contact your school's administration — the head of school, the school secretariat or the person who issued your account — and ask for your account and data to be deleted. Students under the applicable age of consent should ask through a parent or guardian.
• The school can delete or anonymise the account and its associated records directly in the Platform, which removes them from our active systems.
• If you have contacted your school and it has not acted, write to us at sales@edsolutions.com.tn with your name, your school and a description of your request. We will acknowledge within 5 working days, raise it with the school as its processor, and respond within 30 days.

What deletion covers. Deleting an account removes the profile, academic, school-life, communication and device data associated with it from our active systems, and we instruct our service providers to do the same. Your push notification token is deleted from our servers immediately when you sign out, and uninstalling the app removes everything the app stored on your device.

What we may keep, and why. After deletion we may retain a limited set of data where the law or legitimate security needs require it: invoices and accounting records for the period required by Tunisian commercial and tax law; security audit log entries for the retention period the school has configured, to protect against fraud and unauthorised access; and anything we are ordered to preserve in connection with a legal claim or an official request. This data is not used for any other purpose and is deleted once the period expires. Backups are rotated on a fixed cycle, so a deleted record may persist in an encrypted backup until that cycle completes.

11. How we protect data

• Traffic between the app, our website and our servers is encrypted in transit using HTTPS and TLS, including the WebSocket connection used for live updates.
• Passwords are stored only as salted hashes; we never store them in readable form and our staff cannot read them.
• Each school's data is logically separated from every other school's data.
• Access is governed by roles and permissions, and administrative access is limited to staff who need it.
• Security-relevant actions are recorded in an audit trail, with configurable alerts for events such as repeated failed logins or bulk deletions.
• Backups are taken regularly and protected to the same standard as live data.
• On your device, the app stores its data in Android's private per-application storage, which other applications cannot read.

No system can be guaranteed to be completely secure. If a breach affects your personal data, we will notify the school concerned without undue delay and support it in meeting its own notification obligations to users and to the INPDP or other competent authority.

12. Your rights

Under Tunisian Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data, and under the GDPR where it applies to you, you have the right to:

• know whether we hold personal data about you, and obtain a copy of it;
• have inaccurate or incomplete data corrected;
• have data deleted, as described in section 10;
• object to certain processing, or ask that it be restricted;
• withdraw consent at any time, where processing is based on consent — this does not affect what was done before you withdrew it;
• receive data you provided in a structured, commonly used, machine-readable format, where that right applies;
• lodge a complaint with the INPDP in Tunisia, or with your local supervisory authority.

Parents and guardians may exercise these rights on behalf of their children. To exercise any of them over data held in a school's account, contact the school; for data we hold as controller, contact us using the details below. We will respond within 30 days; if a request is complex we will tell you and may take longer. We may need to verify your identity before acting.

13. Changes to this policy

We may update this policy as our services, our providers or the law change. We will post the revised version at this address and update the date at the top. Where a change materially affects how we handle your data, we will give notice through the Platform, in the app or by email.

14. Contact us

For any question about this policy, about how we handle personal data, or to raise a privacy or deletion request:

EDSolutions SARL
Developer of the Mentiplex application (tn.edsolutions.lms.mentiplex)
Société à Responsabilité Limitée registered in Tunisia
Unique identifier (RNE / matricule fiscal): 1808746H — D-U-N-S: 952456842
Registered office: 01 Rue Ghar El Melh, 2015 El Kram, Tunis, Tunisia
Email: sales@edsolutions.com.tn
Telephone: +216 24 759 521
Website: edsolutions.com.tn

You may also contact the Tunisian data protection authority, the Instance Nationale de Protection des Données à Caractère Personnel (INPDP), at www.inpdp.tn.