Effective date: 13.09.2026
This Privacy Policy explains how YOPO processes personal data when you use the YOPO service.
YOPO is operated by:
SIRRES Raphaël
Luxembourg
Email: contact@yopo.lu
YOPO is currently offered directly to individual teachers and is not currently deployed as an institutional service contracted with schools or educational authorities.
YOPO is a digital planning and organisation service designed primarily for teachers.
The Service allows users to organise timetables, lessons, events and other professional information and may optionally allow them to record information concerning pupils, including attendance, lateness, evaluations, observations and related documents or files.
This Privacy Policy applies to personal data processed in connection with YOPO.
Depending on how you use YOPO, we may process the following categories of information.
This may include:
YOPO does not store your password in plain text.
The Service may contain information entered by the user concerning their professional organisation, such as:
YOPO provides optional fields that may allow a teacher to record:
None of these fields is mandatory.
The teacher may use pseudonyms, initials or other identifiers instead of a pupil's real name where appropriate.
These fields exist solely to make information available to the teacher within the YOPO service and to provide the functionality requested by the teacher.
YOPO may process technical information necessary to operate and secure the Service, such as:
Application and security logs are retained for a maximum of 30 days, unless a longer retention period is required by law or is necessary to investigate a specific security incident.
YOPO does not intentionally record the contents of pupil observations or other pupil information in application logs.
YOPO processes personal data for purposes including:
Pupil information entered into YOPO is processed to provide the functionality requested by the teacher.
YOPO does not sell pupil information, rent it to third parties, use it for advertising, or use it for independent profiling or unrelated commercial purposes.
The legal responsibilities of YOPO and the teacher may differ depending on the particular processing activity.
YOPO determines the purposes and essential technical means necessary to operate and secure its platform.
The teacher determines, within their professional context, which pupil information they choose to enter into YOPO and the professional reasons for recording that information.
The teacher must only enter information that they are authorised and legally entitled to process.
Nothing in this Privacy Policy is intended to transfer to the teacher responsibilities that legally belong to YOPO, or to claim responsibilities for the teacher that do not legally belong to YOPO.
Where the legal relationship between the parties requires a controller/processor arrangement under applicable data-protection law, the relevant legal requirements will apply.
YOPO is not intended for the storage of special categories of personal data within the meaning of applicable data-protection legislation.
Users must not enter or upload such information concerning pupils or other individuals.
This includes, in particular:
This prohibition applies to:
If prohibited information is accidentally entered or uploaded, the user should remove it as soon as reasonably possible.
YOPO does not sell or rent personal data.
YOPO may use technical service providers where necessary to operate the Service. Such providers receive or process only the information necessary for the service they provide and are subject to appropriate contractual and security requirements.
Current service providers include:
YOPO uses Hetzner infrastructure for hosting and storage.
YOPO production infrastructure is located in Germany.
YOPO also uses backup storage located in Falkenstein, Germany.
YOPO uses Stripe to process subscription payments.
Payment-card information is handled by Stripe in accordance with Stripe's own privacy and security practices. YOPO does not need to store complete payment-card details.
Subscription information may be communicated to YOPO through secure webhooks so that YOPO can determine whether a subscription is active, expired or otherwise changed.
YOPO uses Open-Xchange for email services.
Email is used for purposes such as:
YOPO does not use email to transmit pupil information as part of its normal operation.
YOPO does not currently use analytics platforms, advertising trackers, behavioural profiling tools or similar analytics applications.
YOPO production data are hosted on infrastructure located in Germany.
YOPO's backup storage is located in Falkenstein, Germany.
Based on YOPO's current infrastructure and configuration, production and backup data are stored within the European Union.
YOPO implements technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration or disclosure.
Depending on the type of data and the relevant processing activity, these measures include:
Pupil information and observations stored in the database are protected using AES-256 encryption.
YOPO uses HTTPS/TLS for network communications.
Uploaded files are not publicly accessible.
Access requires an authenticated user and a valid temporary access token.
Temporary file-access tokens expire after 120 seconds.
YOPO also checks that the authenticated user is authorised to access the requested file.
User passwords are stored using bcrypt password hashing.
Existing sessions are invalidated following a password change.
Administrative access is protected by two-factor authentication.
YOPO performs regular backups of production data.
Backup data are encrypted on the production side before transmission and storage.
Backups are stored on infrastructure located in Falkenstein, Germany.
The backup storage is not publicly accessible from the Internet. Access is restricted through the Hetzner network and SSH keys.
Backups are retained for a maximum of 14 days.
Security measures are reviewed and improved where appropriate as the Service evolves.
YOPO retains personal data only for as long as necessary for the relevant purpose, subject to legal obligations and the specific retention periods described below.
Data associated with an active account are retained for as long as necessary to provide the Service.
If a trial account remains inactive and is not converted into a paid subscription, the account and associated production data are deleted after a maximum of three months.
When a paid subscription expires, the account and associated production data are deleted after a maximum of three months if the subscription is not renewed.
When a user requests deletion of their account, the corresponding production data are deleted.
Temporary copies may remain in encrypted backups until the applicable backup copy reaches the end of its retention period.
Encrypted backups are retained for a maximum of 14 days.
Application and security logs are retained for a maximum of 30 days, except where a longer period is necessary to investigate a specific security incident or required by law.
Depending on the circumstances and applicable law, you may have rights concerning your personal data, including:
You may exercise applicable rights by contacting:
You may also have the right to lodge a complaint with the competent data-protection supervisory authority.
For users in Luxembourg, the competent supervisory authority is the Commission nationale pour la protection des données (CNPD).
YOPO uses cookies and similar technical mechanisms where necessary to provide essential functionality, such as maintaining authenticated sessions and protecting the Service.
YOPO does not currently use third-party analytics applications or advertising tracking technologies.
YOPO is designed for use by adults such as teachers and does not knowingly collect personal data directly from children as users of the Service.
Teachers may enter information concerning pupils into their YOPO account as part of using the Service.
Pupil information must only be entered where the teacher is authorised and legally entitled to process it.
Pupil information must not include the special categories of personal data prohibited under this Privacy Policy.
YOPO's current production and backup infrastructure is located in Germany.
YOPO will take appropriate measures where personal data are transferred outside the European Economic Area and where such a transfer is subject to applicable data-protection requirements.
YOPO may update this Privacy Policy from time to time to reflect changes in the Service, infrastructure, legal requirements or data-protection practices.
The effective date at the beginning of this Privacy Policy will be updated when the Policy is changed.
Where a change is material, YOPO will take reasonable steps to communicate the change to users.
For questions about this Privacy Policy or the processing of personal data by YOPO, please contact:
SIRRES Raphaël
Luxembourg
Email: contact@yopo.lu