Your privacy matters. Here is exactly how we handle your data.

Account Information: When a school registers or a user is invited, we collect names, email addresses, phone numbers, and role assignments (e.g., teacher, parent, student, administrator).

Student Records: Schools may upload or enter student data including names, admission numbers, dates of birth, class assignments, academic scores, attendance records, and guardian contact details. This data is entered and managed by the school.

Authentication Data: We collect login credentials (email/password for staff and parents; admission number/PIN for students). Passwords are cryptographically hashed and never stored in plain text.

Usage and Device Data: We automatically collect device type, operating system, app version, IP address, browser type, pages visited, features used, and session duration. This data helps us improve the Service and diagnose technical issues.

Payment Information: When schools or parents make payments through the platform, payment details are processed by third-party payment processors. We do not store full credit card or bank account numbers on our servers.

Communications Data: Messages sent through the platform (staff-to-parent, announcements, SMS, email) are stored to enable delivery, history, and audit functionality.

Biometric Data: If a school enables biometric features (e.g., fingerprint attendance), biometric templates are processed locally or through secure hardware integrations. We do not centrally store raw biometric samples.

We use personal information to: (a) provide, operate, and maintain the Service; (b) authenticate users and enforce role-based access; (c) enable schools to manage academic records, attendance, fee billing, communications, and report generation; (d) send transactional notifications such as fee reminders, result publications, and account alerts; (e) improve, personalize, and develop new features; (f) detect, prevent, and address fraud, abuse, and security issues; (g) comply with legal obligations and respond to lawful requests.

We do not sell personal information to third parties. We do not use student data for advertising or marketing purposes unrelated to the Service.

With Schools: School administrators control their tenant data. They determine which staff, parents, and students have access, what records are published, and how communications are sent.

Service Providers: We share data with third-party service providers who help us operate the Service, including cloud hosting (Vercel, Supabase), email delivery, SMS providers, push notification services, and payment processors. These providers are contractually obligated to protect your data and use it only for the services they provide to us.

Legal Requirements: We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of SchoolPilot, our users, or the public.

Business Transfers: In the event of a merger, acquisition, or sale of assets, user data may be transferred as part of that transaction. We will notify affected users before their data is subject to a different privacy policy.

With Consent: We may share information with third parties when we have your explicit consent to do so.

We implement industry-standard security measures to protect your data, including: encryption of data in transit (TLS/HTTPS) and at rest; secure authentication with hashed passwords and token-based session management; role-based access control (RBAC) ensuring users only access data relevant to their role; tenant isolation so each school's data is logically separated from other schools; regular security reviews and monitoring for unauthorized access.

While we take reasonable measures to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

We retain personal information for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Schools may request deletion of their tenant data upon account termination.

Student records, academic data, and communication history are retained for the duration of the school's active subscription. After account closure, data is retained for up to 90 days to allow for reactivation, after which it is permanently deleted unless legal retention requirements apply.

Usage logs and analytics data are retained in aggregated, anonymized form and may be kept indefinitely for product improvement purposes.

SchoolPilot processes children's data as a data processor on behalf of schools (the data controllers). Schools are responsible for obtaining any necessary parental consent before entering student data into the platform.

Student accounts are created and managed by the school, not directly by children. Students access the platform through school-issued credentials (admission number and PIN) under the school's supervision.

We do not knowingly collect personal information directly from children under 13 (or the applicable age of consent in your jurisdiction) without school and parental authorization. If we learn that we have collected personal information from a child without proper authorization, we will take steps to delete that information promptly.

Depending on your jurisdiction, you may have the following rights regarding your personal information: the right to access and receive a copy of your data; the right to correct inaccurate or incomplete data; the right to request deletion of your data (subject to legal retention requirements); the right to restrict or object to certain processing of your data; the right to data portability; the right to withdraw consent where processing is based on consent.

For school-managed accounts (staff, students, parents), requests should be directed to your school administrator, who controls your account and data within the platform. For platform-level requests, contact us at support@schoolpilot.xyz.

SchoolPilot's servers and service providers may be located in different countries. By using the Service, you consent to the transfer of your information to countries that may have different data protection laws than your country of residence.

We ensure appropriate safeguards are in place for international transfers, including standard contractual clauses and data processing agreements with our service providers.

The Service may contain links to third-party websites or integrate with third-party services (e.g., Google Meet for virtual classes, payment gateways). This Privacy Policy does not apply to third-party services, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party services you interact with through our platform.

We may update this Privacy Policy from time to time. When we make material changes, we will notify users through the platform, by email, or by posting a prominent notice. The "Last Updated" date at the top of this page indicates when the policy was last revised.

Your continued use of the Service after changes become effective constitutes acceptance of the revised Privacy Policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: SchoolPilot Technologies Inc., Email: support@schoolpilot.xyz, Website: https://schoolpilot.xyz/privacy