Privacy Policy
Effective Date: August 24, 2026
This Privacy Policy explains how CiviHosting, operator of the Nihul Mosdot software service ("Nihul Mosdot," "CiviHosting," "we," "us," or "our"), collects, uses, discloses, stores, and protects personal information in connection with our websites, applications, and related services (collectively, the "Service").
Nihul Mosdot provides administrative software to educational institutions and other organizations ("Customers").
1. Scope and Our Role
The Service involves two general categories of personal information.
Information CiviHosting Collects for Its Own Operations
CiviHosting determines how certain information is used for purposes such as managing customer accounts, billing, operating our website, providing support, maintaining security, and communicating with Customers.
For this information, CiviHosting may be considered a controller, business, database controller, or similar responsible entity under applicable law.
Customer Data
Customers also enter and manage information through Nihul Mosdot for their own institutional purposes.
For this information, the Customer generally determines what information is collected, why it is used, and who may access it. CiviHosting generally processes that information on the Customer's behalf to provide the Service.
The precise legal terminology and responsibilities may vary depending on the applicable jurisdiction.
2. Information We Collect
Account and Contact Information
We may collect information concerning users and Customer representatives, including:
- name;
- email address;
- telephone number;
- institution or organization;
- username and account information;
- role and permissions; and
- communications with us.
Customer Data
Customers may use Nihul Mosdot to store and manage information concerning their institutions and the people associated with them.
Depending on the features a Customer chooses to use, Customer Data may include information concerning:
- students;
- parents and guardians;
- families;
- staff members;
- classes and educational programs;
- attendance;
- academic records and assessments;
- transportation;
- charges, payments, and billing records;
- contact information;
- notes and documents; and
- other institutional or administrative records.
Some Customer Data may constitute sensitive or specially protected personal information under applicable law.
The Customer determines what Customer Data it enters into the Service.
Payment Information
When a Customer purchases the Service, payment information may be processed by our payment-processing providers.
We generally do not receive or store complete payment-card credentials where they are collected and processed directly by a third-party payment processor.
We may retain transaction-related information such as payment status, amount, date, subscription information, and billing identifiers.
Technical and Usage Information
When the Service is used, we may automatically receive information such as:
- IP address;
- browser and device information;
- login activity;
- timestamps;
- application and server logs;
- security events;
- pages or functions accessed; and
- diagnostic information relating to errors or performance.
3. How We Use Information
We use personal information where reasonably necessary to:
- provide and operate the Service;
- authenticate users;
- administer accounts and permissions;
- process subscriptions and payments;
- provide customer support;
- maintain backups and system reliability;
- protect accounts and systems against fraud, abuse, and unauthorized access;
- monitor security and availability;
- diagnose and correct technical problems;
- communicate with Customers;
- maintain and improve the Service;
- comply with legal obligations;
- enforce our agreements; and
- establish, exercise, or defend legal claims.
We may also use aggregated or de-identified information for analytics, service planning, security, and product improvement where that information does not reasonably identify an individual or Customer.
4. Legal Bases Where Applicable
Where applicable law requires us to identify a legal basis for processing personal information that CiviHosting controls directly, our legal bases may include:
- performance of a contract or taking steps requested before entering into a contract;
- our legitimate interests in operating, securing, supporting, and improving the Service;
- compliance with legal obligations; and
- consent, where consent is required and requested.
For Customer Data processed on behalf of a Customer, the Customer is generally responsible for determining the appropriate legal basis for its collection and use of that information.
5. Educational Institution Data
Nihul Mosdot acts as a technology service provider to Customers.
We do not independently determine the educational, administrative, billing, personnel, or other institutional purposes for which a Customer uses Customer Data.
We process Customer Data to provide the Service, follow Customer's lawful instructions, maintain security and reliability, comply with applicable agreements, and satisfy legal obligations.
Individuals seeking access to, correction of, or deletion of information maintained by a Customer should generally contact that Customer directly.
We will reasonably assist Customers with applicable privacy requests as required by law or an applicable data-processing agreement.
6. Children's and Student Information
The Service is designed primarily for use by educational institutions, administrators, staff members, and other authorized users rather than for children acting independently as consumers.
Customers may use the Service to maintain information concerning children and students.
Customers are responsible for ensuring that their collection and use of children's or students' information is lawful and that required notices, authorizations, permissions, or consents have been obtained.
CiviHosting does not use student records for behavioral advertising or unrelated commercial profiling.
7. Sale and Advertising
We do not sell Customer Data or student information.
We do not disclose Customer Data to third parties for their own targeted or behavioral advertising.
We do not use student records to advertise third-party products or services to students.
8. Service Providers and Subprocessors
We use third-party service providers where reasonably necessary to operate and support the Service.
These providers may assist with services such as:
- infrastructure and hosting;
- backups and storage;
- email delivery;
- payment processing;
- monitoring and error reporting;
- communications;
- security; and
- technical support.
We provide service providers only the access reasonably necessary for their functions and require appropriate contractual or other protections where required by applicable law.
We do not authorize service providers to use Customer Data for their own advertising purposes.
Where required by an applicable data-processing agreement or applicable law, we will address the use of subprocessors and applicable data-protection obligations in that agreement.
9. Other Disclosures
We may disclose personal information:
- at the direction of the Customer;
- to service providers as described in this Policy;
- where reasonably necessary to investigate or prevent fraud, abuse, or security threats;
- where necessary to protect the rights, property, or safety of CiviHosting, our Customers, users, or others;
- where required by law, regulation, court order, subpoena, or another valid governmental demand;
- in connection with legal claims or proceedings;
- in connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business; or
- with consent or other lawful authorization.
Where legally permitted and reasonably practicable, we may notify an affected Customer before disclosing Customer Data in response to compulsory legal process.
10. Where Information Is Stored and Processed
Our primary application infrastructure and Customer Data storage are currently located on servers in the European Union.
CiviHosting operates from the United States, and we or our service providers may access or process certain information from other jurisdictions where reasonably necessary to provide, secure, support, or administer the Service.
As a result, personal information may be processed outside the country where the Customer or individual is located.
Where applicable law requires safeguards for an international transfer of personal information, we use contractual or other lawful mechanisms designed to satisfy those requirements.
11. Data Security
We use administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, destruction, or loss.
Measures may include access controls, authentication, encrypted communications, backups, monitoring, logging, and restrictions on administrative access, as appropriate to the Service and risk involved.
No electronic system can be guaranteed to be completely secure, and we cannot guarantee absolute security.
We maintain procedures for responding to security incidents and will provide notifications required by applicable law or applicable contractual obligations.
12. Data Retention
We retain personal information only for as long as reasonably necessary for the purposes for which it is processed, including to:
- provide the Service;
- fulfill contractual obligations;
- maintain security and appropriate records;
- comply with legal obligations;
- resolve disputes; and
- enforce our agreements.
Retention periods may differ depending on the type of information, the Customer's instructions, legal requirements, and backup cycles.
Customer Data may be deleted following termination of a Customer account, subject to applicable agreements, reasonable backup retention periods, legal obligations, and legitimate requirements to preserve information relating to disputes or security incidents.
13. Access, Correction, Deletion, and Other Privacy Rights
Depending on applicable law and the circumstances, individuals may have rights concerning personal information relating to them, which may include rights to:
- obtain information about processing;
- request access to personal information;
- request correction of inaccurate information;
- request deletion where legally applicable;
- object to or restrict certain processing;
- withdraw consent where processing is based on consent; or
- make a complaint to an applicable privacy or data-protection authority.
These rights are not absolute and may be subject to legal exceptions.
Where a request concerns Customer Data controlled by an educational institution or other Customer, the request should normally be directed to that Customer.
If we receive a request relating to Customer Data that we process on behalf of a Customer, we may refer the individual to the Customer or forward the request to the Customer where appropriate.
Requests concerning information controlled directly by CiviHosting may be sent to help@nihulmosdot.com.
We may request information reasonably necessary to verify identity, authority, and the scope of a request before responding.
14. Cookies and Similar Technologies
Our websites and Service may use cookies or similar technologies for purposes such as:
- authentication;
- session management;
- security;
- user preferences; and
- operation of the Service.
If we use optional analytics, advertising, or other non-essential tracking technologies that require notice or consent under applicable law, we will provide appropriate notice or choices.
Browser settings may allow users to block or delete cookies, although blocking cookies necessary to operate the Service may prevent certain features from functioning.
15. Communications
We may send administrative or transactional communications relating to:
- accounts;
- subscriptions and billing;
- security;
- support requests;
- service operation;
- policy or contractual changes; and
- other matters relating to an active Customer relationship.
We may also send marketing communications where permitted by applicable law.
Recipients may unsubscribe from marketing emails using the unsubscribe mechanism provided in those messages or by contacting us.
Administrative, security, billing, and other essential service communications may continue while an account or Customer relationship remains active.
16. Business Transfers
If CiviHosting or Nihul Mosdot is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or transfer of the Service or business, personal information may be transferred as part of that transaction.
Any recipient will remain subject to applicable legal obligations regarding the information.
17. Applicable Privacy Laws
We process personal information in accordance with privacy and data-protection laws applicable to our processing activities.
Because Customers may operate in different jurisdictions, additional legal requirements may apply to a particular Customer or category of information.
Where necessary, additional data-protection requirements may be addressed through a DPA or other written agreement with the Customer.
18. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our Service, practices, service providers, or legal obligations.
If we make a material change, we will provide reasonable notice where appropriate.
The effective date at the top of this Policy identifies the current version.
19. Contact Us
Questions, privacy requests, or other inquiries concerning this Privacy Policy may be directed to:
CiviHosting
7113 Creeks Crossing
West Bloomfield Township, MI 48322
United States
Phone: 052.718.1463
Email: help@nihulmosdot.com