The short version
A school counsellor enrols a student, with a parent or guardian’s consent recorded first. From then on we hold what that student chooses to tell the platform, plus the notes their counsellor writes.
That information is there so a named adult in that school can help sooner. It is not sold, not shared with advertisers, not used to build profiles, and not read by us except when we have to fix a fault — which is logged.
You can ask for a copy of it, ask us to correct it, or ask us to delete it. You can withdraw consent at any time without giving a reason.
The rest of this page is the same thing said carefully. Where the careful version and the short version disagree, tell us, because that means we have written it badly.
Who we are
The Level Up Labs is operated by Vriesea LLC, a limited liability company registered in the State of New York, United States. We are establishing a Guyanese entity to hold this work locally; until that exists, the New York company is the operator, and we would rather say so than let the Guyanese branding imply otherwise.
For the purposes of the Guyana Data Protection Act 2023, we act as a data processor on behalf of each participating school, which is the data controller for its own students’ records. In plain terms: the school decides what happens to a student’s information, and we run the system that holds it, under the school’s instruction.
The Act applies to the processing of personal data of people in Guyana regardless of where the processor is established, and it requires a processor not established in Guyana to nominate a representative who is. We will nominate a representative in Guyana before the first student is enrolled, and name them on this page.
Where we process information about counsellors, visitors to this website, or people who write to us, we are the controller.
Contact: leveluplabs.gy@gmail.com. We aim to answer within five working days.
What we collect
| Category | What it is | Where it comes from |
|---|---|---|
| Identity | Name, school, year group, and a Level Up ID | Entered by the counsellor at enrolment |
| Credential | A PIN, stored only as an irreversible hash, plus recovery answers | Chosen by the student |
| Check-ins | How a student says they are feeling on a given day | Given by the student |
| Screening responses | Answers to structured questionnaires a counsellor has assigned | Given by the student |
| Case records | Counsellor notes, appointments, reports, follow-ups | Written by the counsellor |
| Activity | Modules completed, points earned, book club entries | Generated by use |
| Access log | Who opened which record, and when | Generated automatically |
| Technical | Approximate device type and error reports | Generated automatically |
Some of this is sensitive personal data under the Act, because it concerns a person’s health. We treat all of it that way rather than trying to draw a line.
What we do not collect
- Location, contacts, camera, microphone, photographs or files from the device.
- Advertising identifiers, tracking pixels, or third-party analytics scripts.
- Behavioural profiles inferred from how a student moves through the app. We built a system that did this. We switched it off, and it will not be switched back on without explicit, separate, informed consent.
- Anything about a student’s family, friends or contacts that the student has not been asked to give and that those people have not agreed to.
Why we hold it, and on what basis
| Purpose | Lawful basis |
|---|---|
| Enrolling a student and running their account | Consent of the parent or guardian, and the student’s own agreement |
| Letting a counsellor see and act on a concern | Consent, and the school’s duty of care to its students |
| Acting where there is a risk to a child’s life or safety | Protection of vital interests — this does not depend on consent |
| Keeping the service secure and diagnosing faults | Our legitimate interest in a system that works and is not attacked |
| Statistics for a school, region or the Ministry | Consent, and only ever in aggregate with small groups suppressed |
We do not rely on consent for the safeguarding case. If a counsellor believes a child is at risk of serious harm, that is acted on whether or not consent has been withdrawn, because the alternative is indefensible. Everything else stops when consent stops.
Who can see it
- The guidance counsellor at the student’s school. This is the point of the system.
- The member of staff responsible for safeguarding at that school, where the school requires it.
- A Schools Welfare Officer or regional officer, where the school and the Ministry have set that up, and only for the schools they are responsible for.
- The Ministry of Education would see counts and trends only — never a named student, never an individual record. This is enforced by the server, not by hiding a button.
- Us, only when we have to open a record to fix a fault or investigate a security incident. Every such access is written to a log that cannot be edited.
Teachers generally do not have access. Other students never do. We do not share records with parents automatically — whether and how a parent is told is a decision for the school under its safeguarding policy, and we explain why in our safeguarding statement.
Who else handles it, and where
We use these suppliers. They process data on our instruction and are contractually bound not to use it for anything else.
| Supplier | What for | Where held |
|---|---|---|
| Supabase | Database, authentication and server functions | United States (AWS, us-east-1) |
| Netlify | Serving the website itself | Global content network |
| Cloudflare | Security filtering and traffic protection | Global edge network |
This means student information is held outside Guyana, and the company operating the platform is also outside Guyana. We think you should be told both of those plainly rather than finding them in a footnote. The data is encrypted in transit and at rest, and our contracts with these suppliers restrict what they may do with it.
Being registered in the United States has a consequence worth stating: a US company can, in some circumstances, be compelled by a US court or agency to produce data it holds. We have never received such a request. If we receive one relating to a Guyanese student, we will challenge it, notify the school unless we are legally barred from doing so, and record it in a transparency note on this page. Moving operations to a Guyanese entity is intended in part to reduce this exposure.
If a school requires data to remain in Guyana or in the Caribbean, tell us before enrolling, because at present we cannot offer that.
How long we keep it
| What | How long |
|---|---|
| An active student’s records | While they are enrolled at a participating school |
| After a student leaves or withdraws | Deleted or anonymised within 12 months, unless the school must keep it by law |
| Safeguarding case records | As required by the school’s own retention rules, which override ours |
| Access and security logs | 24 months |
| Enquiries sent to us by email | 24 months |
Deletion means removed from the live database and from backups on the next backup cycle, not hidden from view.
Your rights
Under the Data Protection Act 2023 you may ask us to:
- tell you what we hold about you or your child, and give you a copy;
- correct anything inaccurate;
- delete it, where we are not required to keep it;
- restrict or object to how it is used;
- provide it in a portable form.
Because the school is the controller, a request usually goes to the school first and we help them answer it. If that route does not work, write to us directly and we will act. There is no charge, and we will not ask why.
You may also complain to the Data Protection Commissioner. At the time of writing, the Data Protection Office established by the Act is not yet operational, and we will register as a data controller and processor as soon as the register opens. We would rather say that than imply an oversight body is watching us when it is not yet in place.
How it is protected
- Encrypted in transit and at rest.
- Every request to read or write a record is checked on the server against a verified session. Nothing is trusted because a browser claimed it.
- PINs are stored as irreversible hashes. Nobody at The Level Up Labs can read a student’s PIN, including us.
- Repeated failed sign-in attempts lock an account and require a counsellor to reset it.
- Access to records is logged to a table that cannot be edited or deleted.
- The system is reviewed for security faults, and findings are fixed before a school is enrolled rather than after.
No system is perfectly secure and we will not claim otherwise. What we can commit to is that we look for our own faults, and that we tell you when we find one that matters.
If something goes wrong
If personal data is lost, exposed or accessed without authority, we will notify the affected school without undue delay, and the Data Protection Commissioner within 72 hours of becoming aware where the Act requires it. Where there is a real risk to the people affected, we will tell them too, in plain language, including what happened and what we are doing about it.
Children
Almost everyone using this platform is under 18. That shapes every decision here: a counsellor enrols students rather than students signing themselves up; consent is recorded from a parent or guardian before an account exists; screening is assigned by an adult rather than taken alone; and no score, severity or label is ever shown to the student.
A student can stop using the platform at any time, and nothing at school depends on their taking part.
Changes to this policy
If we change anything that materially affects how student information is handled, we will tell participating schools directly and note the change here with a date. We will not make a substantive change quietly.
Contact
Write to leveluplabs.gy@gmail.com with “Data protection” in the subject line. If your question is about a specific student, contact their school’s guidance counsellor first — they can act faster than we can.