Privacy Policy

1. Data We Collect

Pupil records

Schools create pupil profiles containing: full name, admission number, class and campus assignment, date of birth, gender, photograph (if uploaded by the school), guardian/parent name and contact details (phone number, email address), and academic records including attendance, examination scores, homework assignments, and report cards. Pupil data is entered and maintained by authorised school staff (owners, principals, teachers, and finance staff).

Payment information

Fee structures, invoices, payment records, and transaction references. When a parent or guardian pays via Paystack, the payment is processed entirely on Paystack’s secure infrastructure — we never receive or store card numbers, bank account details, or PINs. We store only the payment amount, Paystack transaction reference, payment status, and the date the payment was confirmed.

Account and contact data

School owner, staff, student, and parent accounts include: email address, name, role within the school, and phone number. We also collect correspondence sent through the platform’s in-app communication channels (email, SMS, WhatsApp) when schools use those features.

Usage data

We log basic technical data (IP address, browser type, timestamps) for security, audit trails, and troubleshooting. Server-side audit events record who performed privileged actions (fee approvals, payment reversals, exam overrides) for accountability.

2. How We Use Your Data

• Fee management: to generate invoices, record payments, track outstanding balances, and manage fee credits and overpayments.
• Academic management: to record attendance, create and grade computer-based exams, assign homework, and generate report cards.
• AI Study Assistant: a student’s class notes, homework, and subject context are sent to Google Gemini (our AI provider) solely to generate study assistance responses. The AI provider does not retain this data for training purposes beyond the duration of the request.
• School communication: to send fee reminders, homework notifications, and announcements to parents and guardians via email, SMS, or WhatsApp (when configured by the school).
• Platform administration: to manage subscriptions, verify payments, prevent fraud, and maintain audit trails.

We do not sell, rent, or share personal data with third parties for marketing purposes. Data is shared only with the service providers listed in Section 4 below, and only to the extent necessary to operate the platform.

3. Children’s Data & Parental Rights

SchoolPay Lite processes personal data of pupils who are minors. We do not collect data directly from children — all pupil data is entered and managed by the school. Students access the platform using credentials provided by their school.

Parents and legal guardians have the following rights regarding their child’s data:

• Access: request a copy of the personal data we hold about your child.
• Correction: ask the school to correct inaccurate pupil records (name, class, contact details). The school is the data controller for pupil records; we process them on the school’s instructions.
• Deletion: request that your child’s data be removed when it is no longer needed (e.g., after the pupil leaves the school). Deletion requests must be made through the school, as the school controls the pupil record.
• Withdrawal of consent: withdraw consent for your child’s data to be processed for the AI Study Assistant. The school can disable AI features for individual students.

To exercise any of these rights, contact your school administrator first. If you need to escalate a concern, contact us directly at avenixlabsadmin@gmail.com.

4. Third-Party Service Providers

Paystack (payment processing)

Paystack processes all card and bank payments on SchoolPay Lite. When you make a payment, you are redirected to Paystack’s secure checkout page. Paystack handles the transaction and sends us a confirmation with the payment reference and amount. We never see or store your card number, CVV, or bank PIN. Paystack is PCI DSS compliant and is regulated by the Central Bank of Nigeria. See Paystack’s privacy policy at paystack.com/privacy.

Supabase (database & authentication)

User accounts, authentication, and all application data are stored on Supabase (a PostgreSQL-based platform). Data is protected by row-level security policies that enforce school isolation — a user from one school cannot access another school’s data. See supabase.com/privacy.

Google Gemini (AI Study Assistant)

When a student uses the AI Study Assistant, their question and relevant study context are sent to Google’s Gemini API to generate a response. The Gemini API key is stored server-side and never exposed to the browser. Google does not use this data to train its models. See policies.google.com/privacy.

Communication providers

When a school configures email, SMS, or WhatsApp communication, those services (e.g., SMTP providers, SMS gateways, WhatsApp Business API) receive message content and recipient contact details for the sole purpose of delivering the message.

5. Data Retention

• Active school accounts: all data is retained for as long as the school has an active subscription.
• Suspended accounts: if a school’s subscription is suspended (after the trial and grace period), data is preserved — it is not deleted. The school can restore access by resuming payment.
• Account closure: when a school closes its account or requests data deletion, we will remove all pupil records, payment history, and associated data within 30 days, except where retention is required by Nigerian law or for legitimate financial audit purposes.
• Audit logs: security and financial audit events are retained for a minimum of 24 months for accountability and fraud prevention.
• AI conversation history: AI Study Assistant conversations are stored per-student and can be deleted by the student at any time from their dashboard.

6. Data Security

We implement industry-standard security measures to protect your data:

• Row-level security (RLS): every database table uses RLS policies to enforce school isolation. A user from School A cannot query School B’s data, even with direct database access.
• Server-side authorization: all privileged actions (fee approvals, payment reversals, exam management) are verified server-side against the user’s role and school membership.
• Encrypted transmission: all traffic uses HTTPS / TLS encryption.
• Secrets isolation: payment and database credentials are stored server-side only and are never embedded in the browser application bundle.
• Content Security Policy: strict CSP headers prevent data exfiltration and unauthorised script execution.

No system is perfectly secure. If we become aware of a data breach affecting your personal data, we will notify affected schools and users without undue delay in accordance with applicable Nigerian law.

7. Your Rights

Under the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Regulation (NDPR), you have the right to:

• Be informed about how your data is collected and used
• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Request deletion of your data (subject to legal retention)
• Object to or restrict certain processing of your data
• Lodge a complaint with the Nigeria Data Protection Commission

8. Contact Us

For any privacy-related questions, data requests, or to report a privacy concern:

We aim to respond to all privacy requests within 7 working days.

9. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated revision date. Schools will be notified of material changes via email.