How MySchoolHQ looks after personal data

MySchoolHQ is school management software run by MySchoolHQ. You can reach us at support@myschoolhq.app.

The school is in charge of its records. When a school uses MySchoolHQ, the school decides what it records about its pupils, parents and staff and why. Under the Nigeria Data Protection Act 2023 the school is the data controller and MySchoolHQ is its data processor: we hold and process those records only to provide the service to that school, on its instructions, and for no other purpose.

We are the controller only for the small amount of information about a school’s owner and billing contact that we need to run the school’s MySchoolHQ account and send its invoices.

What a school puts into MySchoolHQ, and what its users do in it. Depending on what the school uses, that can include:

• Pupils: name, admission number, date of birth, gender, class, attendance, marks, results and report cards, quiz and game attempts, work they submit, messages to the AI tutor, and photos the school chooses to share.
• Parents and guardians: name, email address, phone number, relationship to the child, fees billed and paid, and messages with the school.
• Staff: name, email address, phone number, staff number, role, the classes and subjects they teach, and the work they create (lesson plans, quizzes, comments).
• Sign-in and safety records: passwords (stored only as one-way hashes), two-step sign-in settings, the time and network address of sign-ins, and an audit trail of important actions such as publishing results or changing fees.

We do not collect card or bank details: payments go straight to Paystack. We do not run advertising, and nothing in MySchoolHQ tracks people across other websites.

Only to run the school on MySchoolHQ:

• to let each person sign in and see what their role allows (a parent sees only their own children);
• to take registers, record marks, publish results and produce report cards;
• to bill fees, record payments and issue receipts;
• to carry messages and notifications between the school and families, by app, email and, if the school turns them on, text or WhatsApp;
• to provide the AI features the school switches on (see below);
• to keep the service secure, prevent misuse, and fix problems.

The legal basis is the contract between the school and MySchoolHQ, the school’s own lawful basis for keeping school records, and our legitimate interest in keeping the service secure. We never sell personal data and never use pupils’ data for marketing.

Most pupils on MySchoolHQ are under 18. Their accounts are created by their school, not by the children themselves, and the school is responsible for telling parents and obtaining any consent the law requires.

• Each family sees only its own children. Pupils see only their own work and their class.
• There are no adverts, no public profiles, and no way for pupils to message strangers.
• The AI tutor for pupils stays off until the school names a safeguarding lead. If a pupil writes something that suggests they may be at risk, the reply is written by people, not the AI, and the school’s safeguarding lead is told.

When a school switches on the teacher copilot, pupil tutor or parent assistant, the text needed for that request (for example a lesson topic, a pupil’s question, or a summary of a child’s results for their own parent) is sent to our AI provider, Anthropic, to produce the answer. We send the least information the task needs, and names and contact details are removed where the task does not need them.

Anthropic processes this under terms that do not allow it to train its models on that data. Schools can switch every AI feature off.

We use a small number of providers, each only for its job:

• Supabase — the database and private file storage, in the European Union (Ireland).
• Vercel — runs the MySchoolHQ application, in the European Union (Dublin).
• Anthropic — the AI features, when the school switches them on.
• Resend — sends emails such as invitations, password resets and notifications.
• Termii and WhatsApp (Meta) — text and WhatsApp messages, only if the school turns them on.
• Paystack — online fee and subscription payments.

Records are stored outside Nigeria, in the European Union, whose data-protection law gives at least the protection the Nigeria Data Protection Act requires. Some providers above may process a request in other countries; we only use providers bound by contractual safeguards for that.

A school’s records are kept for as long as the school uses MySchoolHQ, because schools need past results and fee records. A school can export its records at any time from inside MySchoolHQ.

When a school leaves, it can ask us at support@myschoolhq.app to delete its records. We delete them within 90 days of that request, except anything the law requires us to keep (for example our own invoices to the school). Backups age out on their normal cycle after that.

Every school is kept apart in the database itself, everything travels over HTTPS, passwords are hashed, staff can be required to use two-step sign-in, and important actions are written to an audit trail. The details are on our Security page. If we ever learn of a breach that affects a school’s records, we will tell the school without delay so it can meet its own duties.

Under the Nigeria Data Protection Act 2023 you have the right to be told what is held about you or your child, to have it corrected, to object to some uses, to have it deleted where the law allows, and to receive a copy you can take elsewhere.

Because the school controls its records, please start with your school: they can see, correct and export what is held. If you cannot resolve it with them, write to us at support@myschoolhq.app and we will help the school answer you. You can also complain to the Nigeria Data Protection Commission.

MySchoolHQ uses only the cookies it needs to keep you signed in and to protect forms from misuse. It sets no advertising or analytics cookies, so there is nothing to opt out of.

If this policy changes in a way that matters, we will tell schools before it takes effect, and the date at the top will change. Questions about privacy go to support@myschoolhq.app.