Privacy policy
How moblit collects, uses and protects personal data. Last updated 29 October 2026.
1. Who we are
moblit is software for schools and organisations that run Erasmus+ mobilities, made in Portugal. In this policy, "moblit", "we" and "us" mean the operator of moblit and of this website. Write to [email protected] about anything here; a person, not a system, will answer, within 30 days at the latest.
We have two roles, and this policy keeps them apart:
- Controller for this website, pilot requests, update emails, our outreach to schools, and the business relationship with the schools that use moblit (who signs, who pays, who we write to).
- Processor for everything a school puts into its own moblit: its staff, participants, partner schools, host organisations, documents and grants. That data belongs to the school, which is its controller. We process it only on the school's documented instructions, under a data processing agreement (GDPR Article 28) signed before any participant is added. If you're a participant or a member of a school's staff, ask your school first about your data in its moblit; we'll help it answer.
2. What we collect, why, and on what basis
Visiting this website
The site sets no cookies and runs no analytics, advertising or tracking scripts. To deliver it and keep it secure, our servers and our network provider (Cloudflare) see technical data with each request: IP address, browser, the page asked for and the time. We use it only to run and protect the site (legitimate interest, Article 6(1)(f)) and keep it no longer than 90 days. If you arrive through a link with a ?ref= tag, your browser remembers that tag for the tab you're in, and it's sent to us only if you fill in the pilot form. If the site shows a video, it's served from YouTube's privacy-enhanced mode, which sets nothing until you press play.
Joining the pilot
We keep your name, work email, school and role, what you tell us about how you run Erasmus+ (your setup, roughly how many participants a year, what takes your time), and where you came from (for example, a link in one of our emails). We use them to answer you, set up your pilot and send you a short series of emails about it. The basis is your request (Article 6(1)(b)). If nothing comes of it, we delete them 12 months after our last contact.
Update emails
If you tick the box, we'll email you a few times a year about moblit. We first send an email asking you to confirm. The basis is your consent (Article 6(1)(a)), which you can withdraw at any time: every email has an unsubscribe link, and unsubscribing is immediate.
If we emailed your school first
We write to schools and organisations that coordinate Erasmus+ mobility projects. Their names and project details come from the European Commission's public Erasmus+ project lists (© European Union, CC BY 4.0). The contact address comes from the organisation's own website, and we only use organisational addresses such as info@ or secretaria@, never a named person's.
Our basis is legitimate interest (Article 6(1)(f)): software for running Erasmus+ mobilities is relevant to an organisation that runs them, and we've weighed that against your interests in a written assessment, available on request. We send one email and at most one reminder. You can object at any time: reply "no" or write to [email protected]. We then keep the address on a do-not-contact list, and nothing else, so that we never write to it again. If there's no reply, we delete the rest after 12 months.
Schools that use moblit
For each school that signs, we keep the contract (plan, dates, price), invoicing details, and the names, work emails and roles of the people we deal with. We use them to provide the service, bill for it and talk to the school about it (contract, Article 6(1)(b)), and keep contracts and invoices as long as Portuguese tax and accounting law requires, currently 10 years (legal obligation, Article 6(1)(c)).
To run, secure and support each school's moblit, we also see operational data about its use: sign-in records, error reports, and counts such as how many participants it holds (never their details). We use them to keep the service working and to apply plan limits (legitimate interest), and keep them no longer than 12 months.
Your moblit login
Everyone who uses a school's moblit signs in through moblit accounts (accounts.moblit.app), one login for every moblit they belong to. For it we keep your name, email address, your password (only as a one-way hash, never the password itself), your two-step settings, which Microsoft or Google account you've linked, if any, and the devices you're signed in on. We use them only to sign you in and keep your login secure; a school's moblit learns that you signed in and who you are, nothing else, and no school can see which other moblits you belong to. The basis is providing the service you and your school use (Article 6(1)(b)) and keeping it secure (legitimate interest). Your login stays while at least one moblit has you; when none has for 30 days, we delete it, after emailing you a week before.
Writing to us
If you email us, we keep the conversation to answer you and for as long as it's useful to the relationship, and no longer than 3 years after the last message, unless it's part of a contract we have to keep.
3. Who processes data for us
We use a small number of service providers. Each works only on our instructions, under a data processing agreement, and only for the purpose listed.
| Provider | What for | Where |
|---|---|---|
| Our server host | The servers that run each school's moblit, its database and its backups | Netherlands |
| Cloudflare, Inc. | Network, security and delivery of the website and every moblit; storage for files and documents | EU storage; global network |
| Backblaze, Inc. | Encrypted backup copies of each school's database and files, for recovery; we encrypt them before they leave our servers, so Backblaze can't read them | EU (Netherlands) |
| Resend, Inc. | Sending email (sign-in links, notifications, pilot and update emails) and the pilot contact list | EU |
| Google Ireland Ltd (Google Workspace) | Our own email | EU and USA |
If a school turns on Microsoft or Google sign-in, those providers authenticate its users under their own terms with that school. We tell schools at least 30 days before adding or replacing a provider that processes their data, so they can object. We never sell personal data, and never share it for anyone's advertising.
4. Transfers outside Europe
We keep data in the European Economic Area wherever we can choose. Where a provider may access it from outside the EEA (for example for support or security), the transfer relies on the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework, with the safeguards they require.
5. How we protect it
Each school's moblit runs on its own, with its own database and its own files; no school can see another's data. Data travels encrypted (HTTPS), and sensitive personal data is also encrypted where it's stored. Every change to a school's database is copied, encrypted before it leaves our servers, to a separate provider in the EU within a minute, so it can be brought back to any moment in the last 30 days; its files are copied the same way every night. Those copies can't be changed or deleted by anyone for 30 days, not even by us, and we restore one each month to check they work. Only the people who need it to run the service have access to production systems, each with their own account. If a breach puts personal data at risk, we tell the schools affected without undue delay so they can meet their own duty to report within 72 hours, and we notify the supervisory authority where we're the controller.
6. How long we keep it
- Website request data: up to 90 days.
- Pilot requests and outreach that lead nowhere: 12 months after the last contact. The do-not-contact list: for as long as we do outreach.
- Update emails: until you unsubscribe; then only the fact that you did, so it stays that way.
- Contracts and invoices: 10 years, as the law requires.
- A school's data in its moblit: for as long as its contract runs. After it ends, the school can still sign in, read and export everything; we delete it 90 days later, or sooner if the school asks. Backups roll off within a further 30 days.
7. Your rights
You can ask to see, correct, export or erase what we hold about you, to restrict how we use it, or to object to it, including to any use based on legitimate interest, and you can withdraw consent at any time without affecting what happened before. Write to [email protected]; we may ask you to confirm who you are. We answer within one month (extendable by two more for complex requests, and we'll tell you if so). For data in a school's moblit, we pass your request to the school and help it answer.
You can also complain to a data protection authority: in Portugal, the Comissão Nacional de Proteção de Dados (cnpd.pt), or the authority where you live or work, such as the Data Protection Commission in Ireland, the Data Protection Authority in Belgium or the CNIL in France. We'd appreciate the chance to put it right first.
8. Children
This website and our emails are for adults who work in education. Schools may hold data about participants under 18 in their moblit; they decide what goes in, under their own lawful basis and with their own safeguards, and we process it only as their processor, never for anything else.
9. Automated decisions
We don't make decisions about people by automated means that have legal or similarly significant effects, and we don't profile anyone.
10. Changes to this policy
We'll update this page when what we do changes, and change the date at the top. If a change matters to you, for example a new purpose or a new kind of provider, we'll tell schools and update-email subscribers by email before it takes effect.