Privacy Policy

Last updated: June 2026

GhanaSchool Platform ("the Platform") is a school management system that helps Ghanaian schools track student attendance, manage fees, and communicate with parents. This policy explains how we collect, use, and protect personal data in accordance with the Ghana Data Protection Act, 2012 (Act 843).

1. Data Controller

Each school that registers on the Platform is the data controller for its own students, staff, and parent data. The Platform operator provides the technology infrastructure but does not own or control school-level data.

2. What Data We Collect

School registration: School name, administrator name, email address, phone number, and physical address.

Student records: Student name, class, parent or guardian phone number, QR code identifier, and attendance history. Schools enter this data themselves.

Staff accounts: Name, email, phone number, and role. Passwords are stored as one-way hashes and cannot be read by anyone, including the Platform operator.

Attendance records: Timestamp, student identity, scan method (QR code), and device identifier.

Fee records: Fee types, amounts, payment dates, and payment method.

3. How Data Is Used

All data collected is used solely for the purpose of school administration:

Recording and reporting student attendance. Managing school fee collection and receipts. Sending arrival and departure notifications to parents (when enabled by the school). Generating reports for the school administration and the Ghana Education Service as required.

We do not sell, rent, or share personal data with advertisers or third parties for marketing purposes.

4. Data Isolation Between Schools

The Platform uses strict multi-tenant data isolation. Each school's data is separated at the database level using unique identifiers. This means:

School A cannot see School B's students, attendance records, or financial data. Staff members can only access data belonging to their own school. The Platform operator cannot view individual student records, attendance details, or fee information for any school. The Platform administrator can see only aggregate statistics (total number of schools, total student count) and school-level contact details for billing and support purposes.

5. Support Access

If a school requires technical support, the Platform support team may need limited access to assist. The Platform operator cannot view individual student records, attendance details, or fee information as part of normal operation (see Section 4). Any access beyond aggregate statistics and school contact details happens only with the school administrator's knowledge and cooperation, for the specific purpose of resolving a reported issue. Administrative actions taken on staff accounts are recorded in an internal audit log.

6. Data Storage and Security

Data is stored on secure servers operated by Hetzner Online GmbH, located in Germany. All data in transit is encrypted using TLS 1.2 or higher. Passwords are hashed using bcrypt with a cost factor of 12. Database access is restricted to the application server only and is not exposed to the public internet. The mobile app stores login tokens in the device's secure storage (Android Keystore).

7. Data Retention

School data is retained for as long as the school's subscription is active. If a school cancels its subscription, the school administrator may request a copy of their data, and may request deletion, by written notice to the Platform operator. Such requests are handled manually by the operator. Data is not automatically deleted; it remains until a deletion request is received and processed, subject to any record-keeping obligations the school may have.

8. Rights of Data Subjects

Under the Ghana Data Protection Act, 2012, individuals whose data is stored on the Platform have the right to:

Request access to their personal data held by the school. Request correction of inaccurate data. Request deletion of their data (subject to the school's record-keeping obligations). Withdraw consent for parent notifications at any time.

These requests should be directed to the school administrator, who manages student and staff data and can correct records directly through the Platform. Requests for data access, export, or deletion are fulfilled manually by the school administrator with the assistance of the Platform operator upon written notice. Parents who wish to stop arrival and departure notifications may ask their school administrator to remove or change the phone number on file.

9. Parent Notifications

Schools may optionally enable WhatsApp notifications to inform parents when their child arrives at or departs from school. This feature requires the school to configure it and is powered by Twilio's messaging API. Parent phone numbers are transmitted to Twilio solely for message delivery and are not stored by Twilio beyond delivery confirmation. Parents may opt out by contacting their school administrator.

10. Changes to This Policy

We may update this policy from time to time. Schools will be notified of material changes via the email address registered on their account. Continued use of the Platform after notification constitutes acceptance of the updated policy.

11. Contact

For questions about this privacy policy or data protection matters, contact the Platform operator at the email address provided on the landing page.