Privacy Policy

Last updated: April 2026

GhanaSchool Platform ("the Platform") is a school management system that helps Ghanaian schools track student attendance, manage fees, and communicate with parents. This policy explains how we collect, use, and protect personal data in accordance with the Ghana Data Protection Act, 2012 (Act 843).

1. Data Controller

Each school that registers on the Platform is the data controller for its own students, staff, and parent data. The Platform operator provides the technology infrastructure but does not own or control school-level data.

2. What Data We Collect

School registration: School name, administrator name, email address, phone number, and physical address.

Student records: Student name, class, parent or guardian phone number, QR code identifier, and attendance history. Schools enter this data themselves.

Staff accounts: Name, email, phone number, and role. Passwords are stored as one-way hashes and cannot be read by anyone, including the Platform operator.

Attendance records: Timestamp, student identity, scan method (QR code), and device identifier.

Fee records: Fee types, amounts, payment dates, and payment method.

3. How Data Is Used

All data collected is used solely for the purpose of school administration:

Recording and reporting student attendance. Managing school fee collection and receipts. Sending arrival and departure notifications to parents (when enabled by the school). Generating reports for the school administration and the Ghana Education Service as required.

We do not sell, rent, or share personal data with advertisers or third parties for marketing purposes.

4. Data Isolation Between Schools

The Platform uses strict multi-tenant data isolation. Each school's data is separated at the database level using unique identifiers. This means:

School A cannot see School B's students, attendance records, or financial data. Staff members can only access data belonging to their own school. The Platform operator cannot view individual student records, attendance details, or fee information for any school. The Platform administrator can see only aggregate statistics (total number of schools, total student count) and school-level contact details for billing and support purposes.

5. Support Access

If a school requires technical support, the school administrator may generate a temporary support access code from their Settings page. This code grants the Platform support team limited, time-bound access to the school's dashboard for troubleshooting purposes only. The access code expires after 24 hours and all support access is logged. Support access can be revoked by the school administrator at any time.

6. Data Storage and Security

Data is stored on secure cloud servers operated by Render, Inc., with databases hosted in the European Union (Frankfurt, Germany). All data in transit is encrypted using TLS 1.2 or higher. Passwords are hashed using bcrypt with a cost factor of 12. Access to the database is restricted to the application server only. The mobile app stores login tokens in the device's secure enclave (Android Keystore).

7. Data Retention

School data is retained for as long as the school's subscription is active. If a school cancels its subscription, the school administrator may request data export (CSV) before deletion. Data will be permanently deleted 90 days after subscription cancellation unless the school requests an extension.

8. Rights of Data Subjects

Under the Ghana Data Protection Act, 2012, individuals whose data is stored on the Platform have the right to:

Request access to their personal data held by the school. Request correction of inaccurate data. Request deletion of their data (subject to the school's record-keeping obligations). Withdraw consent for parent notifications at any time.

These requests should be directed to the school administrator, who manages student and staff data. The Platform operator will assist schools in fulfilling such requests upon written notice.

9. Parent Notifications

Schools may optionally enable WhatsApp notifications to inform parents when their child arrives at or departs from school. This feature requires the school to configure it and is powered by Twilio's messaging API. Parent phone numbers are transmitted to Twilio solely for message delivery and are not stored by Twilio beyond delivery confirmation. Parents may opt out by contacting their school administrator.

10. Changes to This Policy

We may update this policy from time to time. Schools will be notified of material changes via the email address registered on their account. Continued use of the Platform after notification constitutes acceptance of the updated policy.

11. Contact

For questions about this privacy policy or data protection matters, contact the Platform operator at the email address provided on the landing page.