Privacy Policy — STA Timetabler
Last Updated: August 4, 2026
Status: Active
Revision History
| Version | Date | Author | Description of Change |
|---|---|---|---|
| 1.0.0 | May 21, 2026 | STA Timetabler Team | Initial release. Configured compliance with Trinidad and Tobago Data Protection Act, 2011 (DPA). |
| 1.1.0 | August 4, 2026 | STA Timetabler Team | Accuracy review: added name as collected data, removed unimplemented analytics claims, disclosed email delivery provider (Mailtrap), added security log and email personalisation disclosures, fixed cookie/localStorage cross-reference. |
1. Introduction
1.1 We are committed to safeguarding the privacy of our website visitors and service users.
1.2 This policy applies where we are acting as a data controller with respect to the personal data of our website visitors and service users; in other words, where we determine the purposes and means of the processing of that personal data under the laws of Trinidad and Tobago, including the Data Protection Act, 2011 (DPA).
1.3 We use cookies on our website. Insofar as those cookies are not strictly necessary for the provision of our website and services, we will ask you to consent to our use of cookies when you first visit our website.
1.4 In this policy, “we”, “us” and “our” refer to STA Timetabler. Our website is located at https://statimetabler.com and the web application is available at https://app.statimetabler.com.
2. What Personal Data We Collect
2.1 We may process the following categories of personal data about you:
- (a) Contact data — including your email address.
- (b) Account data — including your display name, username (email), password (stored in encrypted form), and account security information.
- (c) Usage data — including server-side technical logs generated when you interact with our services, such as request timestamps, HTTP status codes, and IP addresses retained for security and abuse-prevention purposes. We do not use client-side analytics, tracking pixels, or click-tracking.
- (d) Schedule data — including your selected UWI course codes, lecture times, manually-added custom events, deadlines, activities, and calendar preferences (only processed and stored when cloud synchronization is enabled).
3. How We Use Your Personal Data
3.1 We may process your personal data for the following purposes:
- (a) Providing our services to you, including rendering calendars, course clash alerts, parsing schedule details, and syncing your timetables across your devices.
- (b) Managing accounts, including creating, maintaining, and securing your user account.
- (c) Personalising communications, including using your display name to address transactional emails (such as verification and password-reset emails).
- (d) Security and abuse prevention, including enforcing rate limits on authentication endpoints and retaining server-side request logs to detect and prevent unauthorised access.
- (e) Compliance, including complying with legal obligations and regulatory requirements applicable to our business in Trinidad and Tobago.
4. Legal Basis for Processing
4.1 We will only process your personal data where we have a lawful basis for doing so in accordance with the general privacy principles of the Trinidad and Tobago Data Protection Act, 2011 (DPA). The legal bases we rely on include:
- (a) Consent — you have given us clear consent to process your personal data for a specific purpose (such as creating an account to sync schedules). You have the right to withdraw your consent at any time by contacting us or disabling synchronization.
- (b) Legal obligation — the processing is necessary for us to comply with laws and regulatory requirements.
- (c) Legitimate interests — the processing is necessary for our legitimate interests (such as diagnostics and maintaining site security), unless there is a good reason to protect your personal data which overrides those legitimate interests.
5. Sharing Your Personal Data
5.1 We may disclose your personal data to the following categories of third parties:
- (a) Cloud infrastructure and database providers for the purpose of hosting our website infrastructure, edge compute, and securely storing synchronized schedule data.
- (b) Email delivery providers for the purpose of sending transactional emails on our behalf, including email verification and password-reset messages. Your email address and display name are shared with these providers solely for delivery purposes.
5.2 We do not use third-party analytics, advertising, or profiling services.
5.3 We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
6. International Data Transfers
6.1 We may transfer your personal data to countries outside of Trinidad and Tobago, as our cloud database and hosting infrastructures are situated in secure cloud regions internationally.
6.2 Where we transfer personal data to a country outside Trinidad and Tobago, we ensure that appropriate safeguards are in place, including the use of secure transmission protocols (TLS) and storage encryption (AES-256), in compliance with Section 46 of the Data Protection Act, 2011.
6.3 You may request further information about the safeguards we have put in place by contacting us using the details set out below.
7. Data Retention
7.1 We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.
7.2 To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process your personal data, whether we can achieve those purposes through other means, and the applicable legal, regulatory, accounting, or other requirements.
7.3 In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
7.4 Self-Service Erasure: You retain complete control over your data. You can instantly and permanently delete all your stored schedule items, account settings, and profile data from our servers by clicking Delete Account in the Settings panel of the app. This will immediately purge all cloud records.
8. Your Rights
8.1 Under Trinidad and Tobago data protection law, you have a number of rights in relation to your personal data. We voluntarily support these rights in accordance with international best practices:
- (a) Access — request access to your personal data (commonly known as a “subject access request”). This enables you to receive a copy of the personal data we hold about you.
- (b) Rectification — request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected.
- (c) Erasure — request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You can perform this self-service deletion instantly in the Settings panel.
- (d) Restriction — request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in certain circumstances.
- (e) Portability — request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format.
- (f) Objection — object to processing of your personal data where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground.
8.2 If you wish to exercise any of the rights set out above, please contact us using the contact details provided below.
8.3 You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
9. Cookies
9.1 Our website uses cookies and browser local storage. A cookie is a file containing an identifier that is sent by a web server to a web browser and is stored by the browser. Local storage is a browser mechanism that stores key-value pairs on your device.
9.2 We only use strictly necessary technical cookies (or local authentication tokens) required to keep you securely signed in between visits, and local storage to persist your display preferences (such as theme, calendar filters, and layout choices). We do not use advertising, marketing, tracking, or profiling cookies. For full details, please refer to our Cookies Policy.
10. Children’s Privacy
10.1 In accordance with Trinidad and Tobago’s general legal definitions of minors and international standards, our website and services are not intended for children under the age of 13, and we do not knowingly collect personal data from children under 13.
10.2 If we learn that we have collected personal data from a child under the age of 13, we will take steps to delete that information as quickly as possible.
11. Third-Party Links
11.1 Our website may include links to third-party websites, plug-ins, and applications (such as external university portals). Clicking on those links or enabling those connections may allow third parties to collect or share data about you.
11.2 We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.
12. Changes to this Policy
12.1 We may update this privacy policy from time to time by publishing a new version on our website.
12.2 You should check this page occasionally to ensure you are happy with any changes to this policy.
12.3 We may notify you of significant changes to this policy by email or through a notice on our website.
13. How to Contact Us
13.1 If you have any questions about this privacy policy or our treatment of your personal data, please contact us:
13.2 by email: support@statimetabler.com
14. Supervisory Authority
14.1 You have the right to make a complaint at any time to a supervisory authority. In Trinidad and Tobago, the supervisory authority for data protection issues is the Office of the Information Commissioner of Trinidad and Tobago.
14.2 The Office of the Information Commissioner’s contact details will be as established under the Data Protection Act, 2011.
14.3 We would, however, appreciate the chance to deal with your concerns before you approach the Information Commissioner, so please contact us in the first instance.