This policy explains how Eden Creative Systems ("Edensys", "we") handles personal information in two separate situations: information you send us through this website, and information held inside the boarding management system that a school uses.
Information you send through this website
If you submit the demonstration request form or contact us directly, we receive the details you provide: your name, your role, your school's name, your region, your phone number, your email address, an optional estimate of your boarding population, an optional preferred contact method, and any message you write. We also record a one-way cryptographic hash of the network address the request came from, together with your browser's user-agent string, solely to detect and limit automated abuse. The raw network address is not stored.
Why we use that information
We use it to respond to your enquiry, to arrange and deliver a demonstration, and to keep a record of who we have spoken to. On the form we ask for your agreement to be contacted; that agreement is the basis on which we contact you. We do not sell enquiry details, and we do not use them for advertising.
How long enquiry information is kept
Enquiries are retained for as long as they are useful for following up with your school and for our business records. If you would like an enquiry you submitted to be deleted, contact us using the details on the contact page and we will remove it, unless we are required to keep it.
Student information inside the system
When a school uses the boarding management system, the school remains responsible for the student records it holds. Eden Creative Systems stores and processes those records on the school's instructions and for no other purpose. We do not use student information for our own marketing, and we do not disclose it to anyone else except as needed to operate the service or where the law requires it.
Who can see student information
Access is limited by the school's own staff permissions. A housemaster is restricted to their own house; senior staff and administrators see more. Within Eden Creative Systems, access to a school's environment is limited to the personnel who support that school, and technical access is granted for a specific reason, is time-limited, and is recorded.
Separating one school from another
Each school is provisioned into its own isolated database schema. A request is served only against the school whose verified domain it arrived on, and an unrecognised hostname is refused rather than resolved to any school's data.
Text messages to guardians
Where a school enables guardian notifications, the guardian's name and phone number held in the school's records are used to send text messages about that student's boarding events. Message content is limited to the boarding event itself. Message delivery is handled by a communications provider, and delivery records are kept so usage can be reviewed and problems investigated.
Cookies and sessions
This public website sets no tracking or advertising cookies and runs no third-party analytics. When staff sign in to the school application, a session cookie is used to keep them signed in; that session expires after 30 minutes of inactivity and when the browser is closed. A separate cookie protects forms against cross-site request forgery.
Where information is stored
The application, its database and uploaded files are hosted on managed cloud infrastructure selected by Eden Creative Systems. Data is transmitted over encrypted connections, and production traffic is served over HTTPS only.
Your choices
You may ask us what information we hold about you, ask for it to be corrected, or ask for it to be deleted. If your question concerns a student record held by a school, the school is the right point of contact because the school controls that record; we will assist the school if it asks us to.
Changes to this policy
If this policy changes, the updated version will be published on this page with a new date.
Contacting us about privacy
Privacy questions can be sent to the email address on the contact page, or raised by phone or WhatsApp using the published number.
How the system protects student information
The measures below are the ones in place today, described in plain terms.
- Each school's data is isolated. Every school is provisioned into its own PostgreSQL schema. A request is served only against the school whose verified domain it arrived on, and an unregistered hostname is rejected rather than resolved to any school's data.
- Permissions are enforced on the server. Role restrictions are applied in the application itself, not merely hidden in the interface. A housemaster's access to student records, approvals and roll calls is limited to their own house.
- Student photographs are not publicly reachable. Photographs are stored outside the public web directory and are served only to authenticated staff, or through the deliberately limited student ID verification page.
- Sessions are short-lived. A staff session expires after 30 minutes of inactivity, is refreshed by activity, and ends when the browser is closed, so an unattended shared machine is not left signed in.
- Abuse is rate limited. Sign-in attempts and public forms are rate limited by client address, and public forms are protected against cross-site request forgery.
- Privileged changes are logged. Configuration changes, administrative actions and corrections to disciplinary records are recorded with the user responsible and the time it happened.
- Backups are verifiable. School environments are backed up with a checksum recorded alongside each archive, and a restore verifies that checksum and the archive's contents before it writes anything. A restore never drops or overwrites an existing database.
- Transport is encrypted. In production the service is served over HTTPS only, with HSTS, secure session and CSRF cookies, and a restrictive Content Security Policy.
What we do not claim
No system can guarantee absolute security, and this one does not claim to. Eden Creative Systems makes no claim of formal certification against any security or privacy standard, and publishes no availability guarantee. Your school remains responsible for the accuracy of the records it holds and for deciding who on its staff should have access.
Questions or requests
Contact Eden Creative Systems using the details on the contact page and we will help.